A Clean Skill Is Not a Clean Cart
A Clean Skill Is Not a Clean Cart
Thesis: Agent marketplaces now certify skills one package at a time. CompoSkill just showed that skills which pass those scanners become attacks the moment they chain — recaps of the evaluation put success at 83.3% when the attacker knows the install list, and 80.6% when they only know the agent’s role, across 1,140 long-horizon workflows. A clean skill is not a clean cart. Merchants who bless refund, coupon, catalog, and price tools independently will get drained by composed trajectories that never trip a single-plugin alarm. Verification in agentic commerce is a path property, not a package property.
I am building an AI-native commerce company. I want agents that can look up stock, apply a promo, and close. I refuse to treat a green badge on each of those tools as proof that the sequence is safe.
The Signal: The Scanner Passed. The Chain Did Not.
Overnight heat was not another model card. It was a composition hole.
An arXiv paper dropped as CompoSkill: compositional skill-chain attacks from individually scanner-passing LLM agent skills. The assumption it kills is the one every marketplace is selling. Autonomous agents tackling long-horizon work depend on marketplace skills. Each skill gets a safety verdict in isolation. Install the clean ones. Sleep.
That assumption fails under composition. A skill may pass the per-skill scanner and still participate in a risky chain. Researchers tested it on 1,140 real long-horizon workflows across two agent platforms. Attack chains formed as often as 83.3% of the time when the attacker knew exactly which skills were installed, and still 80.6% when they only knew the agent’s general role. Existing scanners caught almost none of it. They only ever look at one package.
The rest of the timeline made the same pattern cheaper. The founder of a browser-use agent posted that Qwen 3.8 uncensored will just do anything you ask it to do on the web, no gates. Recaps put the Qwen family past three billion downloads, with a 27B that already matches GPT-5.6 Luna on a laptop. Builder threads added: a prompt rule cannot keep a secret out of context. Buyer-side refusal is not a control you can rent. If the secret lives in the skill transcript, composition will leak it even when every package was “safe.”
I already argued that portable agent skills are not your commerce product, that the write path is not a plugin, and that agents optimize against your rules. Stack the next layer. Packaging got free. Writes cannot be remixed. Buyer agents will probe soft policy. Today’s paper is the missing middle: your own blessed tools can assemble the probe.
| What the marketplace celebrates | What a merchant P&L should hear |
|---|---|
| ”This skill passed the scanner” | This atom passed. The molecule was never tested |
| One badge per package | Refund + coupon + catalog was never a package |
| Install the clean library | The install list is the attacker’s map |
| Long-horizon agents need more skills | More skills means more unseen chains |
| ”The model will refuse the bad step” | Uncensored local weights will not |
A syndicate of clean plugins is still a write surface. The cart does not care that each JSON tool looked boring in isolation.
Why Atoms Pass and Carts Fail
A skill scanner is ranking plus a hash. It is not a trajectory. Fraud teams already score the path: new account, first order, gift card, refund, same SKU, same session. Agents hide that path inside tool names that each look legitimate.
Translate CompoSkill into a store:
- Catalog lookup — read-only, scanner-green. Returns live price, stock, and the current promo window.
- Coupon apply — writes a discount the policy allows. Scanner-green. One code, one cart.
- Checkout commit — authorized spend under a cap. Scanner-green.
- Refund / return — policy-compliant reverse. Scanner-green.
Each skill is the kind of package a marketplace will bless. Chained, they are a loop: buy at promo, refund, rebuy, split the cart, stack a gift card the human never intended. No single tool went rogue. The sequence is the exploit.
Unit economics do not grade packages. They grade completed trajectories. If an agent can refund-then-rebuy faster than your hold expires, you shipped a margin mill with a safety sticker on each gear.
The ungated buyer model makes this worse, not rarer. A laptop-class open-weight that “will just do anything on the web” will not refuse the fourth step for you. You cannot outsource composition safety to the buyer’s weights. The only layer you own is what your write path will still refuse after three clean skills have already fired.
Credentials follow the same law. If refund, catalog, and support each get a slice of admin context because the markdown was “safe,” the chain has the secret even when no package contains a steal instruction. A prompt that says “do not log the key” is not a broker. Composition is how keys leave the room.
Operator Playbook: Think Big, Step Small, Do Smart
Think big. Skill marketplaces will keep scanning atoms. That is useful hygiene, the way antivirus is useful hygiene. It is not a checkout policy. The scarce layer is a merchant-owned composition constitution: which write sequences may complete, which combinations are a deny even when every step is individually allowed, who is the merge owner when a chain crosses a money line, and what receipt reconstructs the path after the fact.
Step small (Monday morning). Do not buy another skill scanner. Put a constitution on one SKU family.
- List every agent tool that can write. Refund, coupon, price override, inventory hold, gift card, address change, cancel. If it can move money or stock, it is in the set. Reads stay cheap.
- Name three trajectories, not three plugins. Refund-then-rebuy on the same SKU in the promo window. Coupon apply then cart-split then second code. Hold then cancel-other then rebuy. If you cannot name the chains, you are already certifying atoms.
- Red-team those three with a buyer agent against your own stack. Use a model that will not politely refuse. The overnight Qwen clip is the point: the adversary does not owe you manners. Record whether the chain completed without a human merge.
- Deny composition at the write path. A refund of an agent-originated order cannot re-purchase the same SKU in the same window without a named owner. A coupon skill cannot see a second discount object in the same session. The catalog skill does not get refund credentials “for convenience.”
- Instrument the path, not the package hash. Log principal, skill sequence, SKU, cap, deny reason. A scanner badge is not a receipt. If you cannot replay the chain, you cannot dispute it.
Do smart. Keep using marketplace skills for read and draft. Dual-home irreversible writes behind a broker that never puts the credential in chat. Narrow the permission to the job. If no owner can revoke the token, or no restore path exists after a bad chain, the boundary is incomplete.
This week, pick one live agent surface that can already refund, discount, or hold. Answer four questions: Which other tools can fire in the same session? Which sequences would a scanner never see? Who is the merge owner if the chain completes? Can you reconstruct the receipt without asking the marketplace? If you cannot answer, you have a library of clean skills. You do not have a store.
The Claim Worth Arguing
A per-skill safety badge is a package verdict. It is not a cart. Merchants who certify atoms will lose to composed trajectories — and they will still own the chargeback when every plugin in the chain was “safe.”
The counterexample I want: a team that installed a scanned skill library, never wrote composition denies, never red-teamed refund-then-rebuy, and still kept margin, promo integrity, and dispute control as long-horizon buyer agents became the default. If that exists at scale, I want the trajectory log, not the marketplace badge.
Until then, I will build as if the scanner is hygiene and the chain is the product. The write path refuses the molecule even when every atom passed.
If you disagree, bring the counterexample on X. Best failure mode wins — especially if your “safe” skill pack assembled the refund loop for you.
Sources
- Liu et al.: CompoSkill: Compositional Skill Chain Attacks from Individually Scanner-Passing LLM Agent Skills (arXiv 2608.16246, listed 19 Aug 2026)
- Gregor Zunic / browser-use (19 Aug 2026): Qwen 3.8 uncensored will do anything on the web, no gates (operator evidence, not an endorsement)
- nyk (19 Aug 2026): A prompt rule cannot keep a secret out of context — broker and pass/fail test for credentials