ColluSkill splits one malicious intent across several benign-looking skills and beats six scanners 96% of the time.

arXiv 2608.09732 exploits the fact that every current skill scanner inspects skills individually. Decompose the malicious workflow into interdependent sub-payloads packaged as separately-plausible skills, connected through artifact passing and execution handoffs, and nothing is harmful in isolation. Their defense, ChainGuard, analyzes a candidate against already-installed skills and cuts attack success to 22.5% while passing 99.5% of benign workflows. Companion result from ElasticBack: a dormant rule in skill documentation plus a benign trigger phrase in the user query, neither malicious alone. Per-file skill review is structurally insufficient. The unit of review is the installed set.