CoSA studies reusable agent skills: packages of instructions, optionally with code. Passing an individual package check can still leave unsafe interactions when one skill reuses another’s output.
A recommendation can become apparent permission to change a record. An internal report can become a convenient external attachment while losing its release restrictions.
- Across 288 controlled tasks, five models and three runtimes, violations rise from 1,513/4,320 original runs to 2,525/4,320 augmented runs: 35.02% versus 58.45%.
- Added skills are capped at 5% of each original pool. Existing skills, tools and runtime permissions stay fixed.
- Random benign additions do not reproduce the increase in the sampled control. Candidate content and informed selection matter, beyond simply enlarging the pool.
- A pre-action check cuts violations from 235 to 24 in 360 OpenClaw recruiting runs. The defended outcomes include 115 valid blocks and 221 runs with no effective risky action.
- Matched benign completion changes from 66.67% to 65.00%, with twelve false blocks. Aggregate utility conceals different effects across models.
The defense checks information flow and authorization before disclosure, persistent changes or execution. Some checks use rules; ambiguous evidence uses model judgment. A lower violation rate is not the same as successfully intercepting every risky action.
Caveat: Installation is assumed, each condition runs once per setting, and the defense covers only one runtime and domain.
The project page documents the controlled evaluation. Its design lesson is to preserve restrictions through handoffs and check permission for the exact action and recipient.