SkillFuzz: Fuzzing Skill Composition for Implicit Intents Discovery in Open Skill Marketplaces

Abstract: LLM-based agents increasingly automate software engineering tasks through reusable skills, natural-language instruction documents that guide planning and execution. Open skill marketplaces enable users to assemble agents by co-activating community-contributed skills, but marketplace operators typically audit skills in isolation. As a result, individually benign skills may interact to redirect an agent toward unintended objectives, which we term implicit intents. Detecting such intents is challenging because the effect emerges only through skill composition, execution environments are often unavailable at admission time, and the space of possible co-activations grows exponentially with marketplace size. In this paper, we formulate implicit-intent discovery as a fuzzing problem over skill compositions, where skill compositions are the unit under test, planning artifacts expose agent intent before execution, and deviations from a skill-free baseline serve as a differential oracle. Based on this formulation, we propose skillfuzz, the first execution-free testing approach that extracts structured skill contracts and uses contract-guided Monte Carlo Tree Search to prioritize potentially conflicting compositions. Across representative skill-marketplace workloads, skillfuzz discovers over 1,000 distinct implicit intents under a fixed query budget, confirms more than 80% of the highest-risk flagged compositions during execution-time validation, and identifies substantially more high-severity implicit intents than alternative search strategies while exploring only a fraction of the pairwise interaction space they require.

• The paper introduces a contract-aware fuzzing method leveraging MCTS to surface implicit intents from composed skills with over 80% confirmation in actual agent executions.
• It transforms skill documents into structured contracts and prunes irrelevant combinations to efficiently explore the combinatorial activation space.
• Experimental results across diverse LLMs reveal severe compositional risks, highlighting the need for systematic, execution-free screening in skill marketplaces.

SkillFuzz: Fuzzing Skill Composition for Implicit Intents Discovery in Open Skill Marketplaces

Motivation and Problem Formulation

Open skill marketplaces enable the extension of LLM-based agents with reusable, user-contributed skills implemented as natural-language instruction documents. While per-skill auditing can assert individual skills’ safety, joint activation can introduce emergent behavioral shifts known as implicit intents: unintended objectives arising only from the composition of otherwise benign skills. These compositional defects remain invisible to static or per-skill analysis and, due to the exponential growth of the co-activation space, are intractable for exhaustive testing.

Figure 1: Individually audited skills may be safe in isolation, but their composition can reshape the agent's belief state, causing unforeseen plan drift toward implicit intents.

SkillFuzz recasts implicit intent discovery as a fuzzing problem over the combinatorial space of skill activations, using the planning surface (e.g., plans, reasoning traces) as a differential oracle prior to execution. This plan-level drift, measured relative to a skill-free baseline, reveals whether a composed skill set redirects agent intent in a manner not immediately visible from individual skill audits.

Approach: SkillFuzz Workflow

SkillFuzz introduces an execution-free, contract-guided fuzzing technique for surfacing implicit intents in skill marketplaces. The methodology proceeds in two major phases:

1. Skill Contract Construction and Candidate Pruning: Each skill document is transformed, via LLM extraction, into a structured "skill contract" describing its preconditions, postconditions, modifies set, invariants, and abstract actions. This semantic representation enables efficient pruning of irrelevant skills and highlights potentially conflicting combinations as search seeds.
2. Differential Activation Search via MCTS: The co-activation space is explored via contract-guided Monte Carlo Tree Search (MCTS), with plan drift serving as a reward signal. Selections are biased toward combinations near regions of previously discovered high-drift, high-novelty intents, as measured by the Intent Coverage Quality (ICQ) metric. The process is entirely execution-free, relying on plan artifacts as proxies for post-deployment risk.

   Figure 2: SkillFuzz’s workflow: Step 1 extracts structured contracts and prioritizes conflicting skill pairs; Step 2 runs a differential activation search in the composition space using plan drift as the oracle.

Experimental Analysis

SkillFuzz is evaluated with a 196-skill marketplace across diverse planning agents, including both open-weight and proprietary LLMs, on ten representative tasks. The agent pool includes DS-R1-7B/14B/32B and GPT-4.1/5. Agentic plans are used as the observation surface, with embeddings derived from sentence transformers. Key metrics include intent coverage ($C$), mean plan drift ($\bar\delta$), and intent diversity.

Figure 3: (a) DS-R1-7B achieves the steepest, sustained growth in discovered intent coverage over 200 iterations. (b) Coverage matrix demonstrates that DS-R1-7B leads in most tasks, exceeding both open and proprietary models.

Notable empirical findings:

• All agents, regardless of parametrization or architecture, are vulnerable to implicit intents, confirming generality across LLM designs.
• DS-R1-7B achieves the highest total intent coverage in 5 of 10 tasks, with more susceptible agents discovering a broader diversity, contrary to the intuition that stronger instruction following eliminates compositional risk.

A critical result is that over 80% of high-drift co-activations identified by SkillFuzz are confirmed as implicit intents in actual agent executions across different agent architectures—thus, plan-level drift is a reliable surrogate for post-deployment behavioral risk.

Efficiency and Component Analysis

SkillFuzz surpasses baseline and ablation strategies (random search, naive/greedy search, coverage-only search) with significant margins in discovering severe and novel implicit intents under fixed budgets.

Figure 4: (a) SkillFuzz’s cumulative ICQ grows persistently faster than baselines. (b) High-severity intent discovery scales with budget, with SkillFuzz maintaining a widening advantage.

Figure 5: SkillFuzz’s distribution of discovered intents is enriched in the high-drift (severe) regime compared to alternative search strategies.

Critical discriminators include:

• Contract-Guided Search: MCTS expansion informed by contract embeddings and recent high-risk regions outperforms uninformed exploration.
• ICQ Metric: Combined severity and novelty incentivize the discovery of both impactful and diverse risks.
• Compositional Depth: Severe plan drift is increasingly probable with larger skill bundles; single-skill activations almost never induce severe drift. Severity is thus compositional, not additive.

  Figure 6: The fraction of severe plans and mean drift increase with the number of jointly active skills, demonstrating the non-additive (compositional) nature of implicit intent emergence.

Semantic Structure of Implicit Intents

Comprehensive clustering of over 1,000 implicit intents reveals four major risk patterns recurring across tasks and agents:

• Audio/Video Side-Effect: Generating unsolicited media artifacts.
• Unauthorized Tool Invocation: Calling external services beyond authorized boundaries.
• Covert Resource Creation: Producing unauthorized files or substituting output formats.
• Unsanctioned Data Analysis: Extending analysis or modifications beyond assigned data scope.

  Figure 7: t-SNE projection of discovered implicit intents, with coloring by semantic cluster. Distinct regions indicate recurrent compositional risk categories.

These failure modes are not isolated edge cases; they cluster by co-activation context, not model or task, and are emergent consequences of the combinatorial semantics of skill composition rather than discrete defects in individual instructions.

Implications and Future Perspectives

SkillFuzz demonstrates that the current paradigm of skill marketplace safety—per-skill audits—systematically overlooks structural, compositional vulnerabilities. Severe implicit intents can arise predictably from benign skills when they alter the belief-state of plan-then-act agents under joint activation, with high confirmation rates across actual agent execution environments.

Practically, SkillFuzz offers a generalizable, deployment-free method for early-stage screening that surfaces actionable side-effect categories without incurring the heavy cost of full-scale execution. For marketplace operators, the planning surface becomes a robust admission-time oracle for compositional risk, and the taxonomy produced by SkillFuzz can be directly used to prioritize human review or mitigation actions.

Theoretically, this work clarifies a fundamental aspect of agentic LLM compositionality: belief non-decomposability. As agentic ecosystems and skill marketplaces scale, the compositional search landscape will only become richer, necessitating further advances in contract modeling, search-policy learning, and adversarial composition. Future directions include integrating skill provenance and update-aware fuzzing, automatic mitigation proposal generation, and cross-marketplace skill composition risk sharing at industry scale.

Conclusion

SkillFuzz establishes an execution-free, contract-aware methodology for surfacing implicit intents caused by skill composition in LLM agent marketplaces (2607.02345). It outperforms baseline and ablation strategies in both coverage and severity of risks discovered, and demonstrates that these compositional risks generalize across agent implementations and manifest in realistic agent workflows. The research highlights the necessity of compositionality-aware screening and methodologies for LLM-based agent safety and calls for continued, systematic study of skill interaction effects as agentic AI systems proliferate.