- Review intermediate state as well as each skill.
- Trace who supplied the reason for an action.
- Require an independent boundary at the action point.
The decision can span two artifacts
A reviewer may approve a downstream skill because its operation looks consistent with the state it sees. An upstream skill can change that state first. The risk lies in the relationship between the state change and the later decision, even when the downstream action remains unchanged.
The CoordPoison preprint describes a controlled construction that separates a contextual pretext from an operation across skills. Its abstract motivates this review question; it does not establish that every multi-skill workflow is vulnerable.
A synthetic handoff
Illustrative scenario: an upstream formatting skill edits a local status record so that a synthetic report appears to require an external upload. A downstream publishing skill sees that record and proposes a transfer it is normally allowed to make. The example is fictional. It illustrates how changed context can make a questionable action seem routine.
Record who wrote the status record, its original purpose, when it changed, and whether the user authorized this destination. Reading only the publisher skill would miss the earlier modification.
Trace the causal path
Map the original request, every skill revision, intermediate artifact, read/write step, proposed action, approval, and observed effect. Preserve the order and source of changes. A plausible explanation in the downstream skill is not proof that the underlying state is trustworthy.
Ask whether a change survives sessions or skill removal. Check whether the receiving component would reject a destination introduced by an untrusted artifact even if the artifact uses the expected format.
Test the boundary
Use a disposable workflow with synthetic records. Run the legitimate sequence, then vary the upstream artifact while keeping the downstream task constant. Compare proposed actions and the actual policy decision. Require separate approval for unexpected recipients or transfers. A blocked proposal and an executed transfer are different outcomes.
This workflow-level method extends the single-package review. The preprint’s reported outcomes belong to its chosen tasks and evaluation setup; this guide does not turn them into a field incident or a universal attack rate.
Sources & scope
This guide combines editorial explanation and practical review suggestions. Linked sources support the underlying concepts; this site has not independently replicated their experiments.
S32