A single malicious skill can quietly bloat LLM-agent workflows: authors show a publisher-only attack that lures agents into unnecessary skill detours, raising token use by two-thirds and doubling execution time while still returning correct outputs, exposing a new supply-chain governance risk for skill marketplaces.

Main Finding

The paper identifies and demonstrates Convergent Detour Hijacking (CDH), a publisher-only supply-chain attack on skill-based LLM agents that uses only natural-language metadata and a static skill body to (1) get a malicious coordinator skill co-selected alongside legitimate skills, (2) recruit benign native skills into a short, plausible detour during planning, and (3) re-enter the original route so the final task output remains correct. On DeepSeek-V4-Pro, the matched coordinator was selected in 80.02% of held-out tasks; for coordinator-hit runs that still completed the task, token consumption rose by 66.91% and end-to-end execution time rose by 92.45%, while aggregate task completion rates remained comparable. Thus correct outcomes can mask materially less-efficient, costlier execution trajectories.

Key Points

• Attack model
  • Attacker publishes a single static skill (coordinator) consisting of visible metadata/description and a hidden instruction body.
  • No access to model internals, runtime tool responses, execution state, or post-publication interaction.
  • Attack is text-only, runtime-independent, and uses progressive-disclosure platforms where metadata drives selection and bodies are loaded on demand.
• Attack pattern (attract–detour–converge)
  • Attract: a pilot-guided description establishes relevance so the coordinator is co-selected (but does not replace native skills).
  • Detour: the coordinator’s body contains bounded, planner-facing runbook rules that fabricate plausible prerequisites/verification steps, recruiting extra benign skills.
  • Converge: a return rule releases control back to the normal planner so the original task completes correctly.
• Formal definition
  • CDH on task x requires: coordinator selected; all skills used in the clean run are retained in the attacked run; at least one additional native skill is invoked in the attacked run; and both runs successfully complete the task.
• Effectiveness and costs
  • High coordinator activation rate (80.02% on one backend) and substantial resource amplification (≈67% more tokens, ≈92% more latency) for coordinator-hit, task-completing runs.
  • Aggregate task completion remains similar, demonstrating that correctness alone is an insufficient indicator of resource-safety or trajectory necessity.
• Construction and constraints
  • The coordinator is deliberately designed to be non-replacing and bounded (limits on auxiliary invocations, single verification revisit, termination rule).
  • The attack purposely avoids executable payloads or runtime control, relying instead on semantic framing across selection and planning.

Data & Methods

• Platform and registry
  • Used OpenClaw default registry of 53 skills; extracted front-matter metadata (SKILL.md descriptions) as visible routing metadata.
  • Clustered skills via normalized TF–IDF features into nine functional groups to produce plausible multi-skill workflows.
• Benchmark
  • Generated 536 multi-skill tasks (via GPT-5.5), each task annotated with its gold skill set and relevance; split into 45 pilot tasks (5 per group) for description development and 491 held-out tasks for final evaluation.
  • Also evaluated on 30 independently authored tasks for additional generalization checks.
• Coordinator design pipeline
  • Shared coordination rationale ρg per functional group: target concepts (Tg), coordinator role (cg), plausible inter-skill relations (Lg), and non-replacement/return clause (qg).
  • Description optimization: black-box, pilot-guided generate–evaluate–retain loop to maximize coordinator co-selection on pilot tasks while preserving non-replacement.
  • Body (runbook) construction: instantiate Lg as bounded prerequisite/verification rules with Πg (path), Jg (omission consequences), Vg (verifications), Bg (per-skill/total bounds), and Rg (return rule) to ensure bounded detours and eventual re-entry.
• Evaluation protocol
  • Paired clean–injected executions comparing trajectories under S0 and S0 ∪ {h}.
  • Measured: coordinator activation/selection, task completion, skill invocations, token consumption, cached context growth, and wall-clock time.
  • Tested across multiple LLM backends and under single-task and multi-turn conditions; performed component ablations to isolate description vs. body roles.
• Quantitative highlights (reported)
  • Coordinator selected in 80.02% of held-out tasks on DeepSeek-V4-Pro.
  • For coordinator-hit runs that still completed tasks: token consumption +66.91%, end-to-end latency +92.45%.
  • Aggregate task completion remained comparable between clean and attacked runs.
• Threat model limits
  • Single static coordinator per group, fixed at publication time; no runtime adaption, no control over tool responses, no modification of other skills or infrastructure.

Implications for AI Economics

• Hidden resource externalities and cost inflation
  • CDH shows that marketplace publishers can increase per-request compute/token/latency costs while preserving correctness. This imposes hidden externalities on platform infrastructure and downstream payers (users, enterprises) because billing commonly depends on tokens or runtime.
  • Amplified execution length and wall-clock time translate into higher marginal costs for providers (compute, bandwidth, concurrent execution capacity) and higher bills for end users. Widespread occurrence could materially raise operating costs or required prices.
• Incentive misalignment in skill marketplaces
  • Current marketplace incentives reward capability exposure; without safeguards, publishers can profit indirectly (e.g., provider-level revenue sharing tied to invocations or platform-reported metrics) by designing skills that attract selection and drive additional invocations.
  • Publishers face low direct cost to publish text-only skills but can cause outsized resource consumption, suggesting moral hazard and the need for economic mechanisms (penalties, bonds, or reputational costs) to deter such behavior.
• Measurement and billing design
  • Correctness-based metrics are insufficient. Platforms should incorporate trajectory- and resource-based audits into pricing and reputation systems (e.g., flagging large unexplained token/skill invocation deltas relative to typical clean trajectories).
  • New billing primitives could charge not just for tokens but for "trajectory inefficiency" or auxiliary-skill usage, or alternatively require publishers to underwrite resource impacts (security bonds, escrow).
• Marketplace governance and regulatory considerations
  • Platforms should strengthen provenance, metadata vetting, and runtime monitoring to detect coordinated detours. Economically, this could mean higher onboarding costs, certification fees, or specialized review tiers for high-impact skill categories.
  • Regulators and platform operators may need to treat such supply-chain semantic manipulations as a distinct risk class with disclosure or auditing requirements—especially in high-stakes enterprise use where hidden amplification can produce significant cost and availability impacts.
• Defense and mitigation as economic mechanisms
  • Preventive measures (stricter description-body consistency checks, attestation of non-amplifying behaviors) and detection tools (trajectory baselining, anomaly scoring) impose engineering costs but can be economically justified by reduced unexpected compute/latency load and improved marketplace trust.
  • Incentivize benign behavior via rewards (preferred placement, lower fees) for publishers who pass audits or provide compact, non-amplifying metadata; penalize or delist publishers whose skills consistently cause excessive detours.
• Research and market implications
  • Platforms and researchers should quantify the aggregate economic impact: expected increase in compute/token costs under various adoption scenarios, the equilibrium response of publishers, and optimal design of marketplace fees/penalties.
  • Future marketplaces may need richer contracts (SLAs, insurance, liability rules) that internalize the cost of semantic supply-chain attacks rather than leaving them as externalities.

If you want, I can: - Extract the precise experimental setup (LLM backends evaluated, ablation results, or the full runbook templates) from the supplementary material and add them to the Data & Methods section, or - Produce a short checklist of actionable marketplace mitigations prioritized by cost-effectiveness.