213 validated test cases show that malicious behavior can be split across multiple “benign” agent skills and reliably emerge only when the skills execute together, bypassing per-skill scanners and runtime monitors on systems including OpenClaw, Claude Code, and Codex. If you ship agents that load third-party or modular skills, component review is insufficient: you need policy and testing that model cross-skill data flow, ordering, and combined effects before allowing skills to compose in production.