Convergent Detour Hijacking: Hidden Resource Amplification in LLM Agent Skills

A Hidden Detour in Agent Skills

Imagine hiring a capable assistant and giving them a directory of trusted service providers. You assign a task, the assistant selects the right provider, and the work is completed correctly. Now imagine that a new provider called “general coordination services” is added. Its description sounds relevant, but its workflow requires extra providers before it returns to the original task. The result is still correct, yet the bill and completion time increase substantially.

This is the basic idea behind Convergent Detour Hijacking (CDH) in LLM agents. The agent still completes the task, but its execution path is deliberately lengthened, increasing token usage, tool calls, and latency.

Why Progressive Disclosure Creates a Security Gap

Many agent platforms, including OpenClaw, use progressive disclosure to manage large skill libraries:

1. The platform initially exposes only a skill’s description. 2. The agent selects potentially relevant skills based on that metadata. 3. The platform loads the selected skill’s full instruction body. 4. The agent executes the resulting workflow.

This design reduces context-window usage and supports modular extensions, but it creates two attacker-controlled stages. A malicious publisher can control both the short description that attracts selection and the longer instruction body that introduces unnecessary dependencies.

CDH combines these stages:

• Description stage: makes the malicious skill appear relevant.
• Instruction stage: adds plausible coordination rules that invoke other native skills.
• Return stage: restores the original workflow so the task still succeeds.

The final output may remain unchanged, while the execution path becomes more expensive.

How the Attack Works

CDH is not simply malicious code hidden in a skill body. It is a coordinated, cross-stage attack with three main components.

1. Shared Coordination Rationale

The attacker creates a shared specification for a functional group, represented as:

ρ = (T, c, L, q)

• T: the target domain and intended capability
• c: a non-substitution constraint, preventing the coordinator from replacing native operations
• L: bounded prerequisites claimed to require native skills
• q: the rule for returning to the original task path

The specification has two views: one for the description, which attracts selection, and another for the instruction body, which creates dependencies after loading. Semantic alignment makes both stages appear internally consistent.

2. Description Attraction

The attacker optimizes the skill description using black-box feedback from pilot tasks. In the reported evaluation, descriptions were tested on 45 pilot tasks and adjusted to increase selection frequency in the target domain. The descriptions avoid directly replacing native skills, reducing the risk of obvious task failure.

3. Coordination-Rule Body

Once selected, the skill can inject instructions such as:

• Before performing the task, use native skill A to check condition X.
• Use native skill B to validate skill A’s output.
• After validation, continue with the original task steps.

Each rule can appear reasonable in isolation. Together, however, they transform a direct operation into a multi-step detour.

Experimental Results

The evaluation used 53 native skills, 491 held-out tasks, and six major LLM backends on OpenClaw.

| Model | Coordinator hit rate | Token increase | Time increase | Additional calls | |---|---:|---:|---:|---:| | DeepSeek-V4-Pro | 80.02% | +66.91% | +92.45% | +2.20 | | MiniMax-M3 | 96.60% | +80.81% | +26.99% | +1.43 | | Qwen3.7-Plus | 84.32% | +78.84% | +3.43% | +2.02 | | Claude-Haiku-4.5 | 78.00% | +73.77% | +45.30% | +1.66 | | DeepSeek-V4-Flash | 86.35% | +49.60% | -10.53% | +1.65 | | Qwen3.7-Max | 81.43% | +68.38% | +10.22% | +1.43 |

Task completion remained nearly unchanged. The reported difference between clean and attacked execution was at most 1.5 percentage points, while token consumption increased by approximately 50%–107%.

The attack success rate, defined as retaining the original native skill, recruiting extra skills, and completing the task, ranged from 70.82% to 82.81%.

Ablation Findings

| Variant | Hit rate | Token increase | Additional calls | |---|---:|---:|---:| | Full CDH | 78.7% | +57.9% | +2.01 | | Attract-only | 78.7% | +29.1% | +0.22 | | Detour-only | 3.4% | +29.1% | +1.08 |

The results demonstrate that the two stages are jointly necessary:

• Attract-only skills can be selected frequently, but a neutral body creates little resource overhead.
• Detour-only bodies contain effective routing rules but are rarely selected because their descriptions are not attractive.
• Full CDH combines both effects, producing high selection rates and substantial token growth.

The description is the entry point; the instruction body is the resource-amplification mechanism.

Why Path Safety Matters

Traditional agent evaluations often emphasize task completion. CDH shows that a correct final answer does not guarantee a safe or efficient execution path. An attacker can deliberately increase resource consumption without changing the result.

This creates an evaluation gap: systems may appear successful while silently paying a large cost for unnecessary skill transitions. Agent evaluation should therefore measure not only outcomes but also token usage, tool-call counts, execution time, and deviations from a clean baseline.

Defensive Recommendations

Installation-Time Review

Before installing a skill:

• Check whether its description matches the actions performed by its instruction body.
• Identify dependencies on unrelated native skills.
• Review cross-stage consistency between metadata and execution rules.
• Treat skills as untrusted packages, similar to dependencies in npm or PyPI.

Runtime Monitoring

During execution:

• Flag unexplained transitions between unrelated skills.
• Enforce token, time, and tool-call budgets.
• Compare resource usage with a clean-environment baseline.
• Detect harmful behavior even when the final output remains correct.

The paper associates these controls with two layers of agent engineering: the harness should monitor runtime budgets, while the workflow graph should validate cross-skill transitions.

Implications for MCP Ecosystems

OpenClaw represents an ecosystem related to the Model Context Protocol (MCP), whose clients commonly inspect tool descriptions before invoking a tool. This creates a potential analogue to progressive-disclosure attacks: a malicious or overly broad tool description may attract selection, after which its instructions introduce unnecessary operations.

As third-party tool marketplaces expand, developers should avoid descriptions that are broader than the tool’s actual function and should require path-integrity checks across tool calls.

Practical Guidance

1. Agent platform builders: add description-to-body consistency checks and runtime cross-skill monitoring. 2. Third-party skill users: compare token and time usage against a clean baseline for high-cost tasks. 3. Agent evaluators: measure path efficiency alongside task completion. 4. MCP tool designers: avoid broad, over-promising descriptions that can become attack entry points.

Conclusion

CDH is especially concerning because it does not necessarily change the task result. The agent appears successful, but its workflow has been deliberately extended. In multi-skill agent systems, security must expand from asking whether an agent produced the right result to asking whether it followed an appropriate and efficient path.

Paper: Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents Authors: Junliang Liu, Ruoyu Li, Wenxin Tang, Jingyu Xiao, Zhenyu Liu Platform: OpenClaw, with 53 native skills, 491 held-out tasks, and six LLM backends Key figures: approximately 80% hit rate, 67% higher token usage, 92% higher time usage, and nearly unchanged task completion