AG-COMP: Compositional Risk

What this rule means

No single tool here is dangerous; the combination is. This rule reports capability sets that compose into a known attack shape — persistence (write + memory + self-modify) or lateral movement (several reads plus network) — which is why it names a composition rather than a line of code.

Why it matters

Every major agent incident has been a composition rather than one bad call: read something private, be steered by something untrusted, reach something external.

How to fix it

Break the composition, not the tools: split the capability set across agents so no single context holds the whole chain. `lucin scan` reports the minimum set of tools to restrict.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-COMP          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules