Capability-Composition / Lethal-Trifecta Lab

Every call was benign and authorized. The chain still exfiltrated your secrets.

Every other surface flags a SINGLE offending call, an adjacent pair, or the flow of one specific sensitive value. This lab grades the failure mode none of them do: when every individual tool call is benign AND authorized but the SEQUENCE composes into a dangerous capability. AgentSmack grades the recognized lethal trifecta — the agent simultaneously holds access to read_private_data + exposure to ingest_untrusted_content + an external_communication exit — and the confused-deputy tool-chaining problem (read-secret → encode → write-public; list-tenants → export → email-self). The headline findings are a lethal-trifecta co-presence and an untrusted-content-then-external-send (two critical hard blockers). Ground-truth wins: a terminal send recorded authorized:true clears the realized-path findings — we measure useful, authorized composition, not blanket suppression. Findings map to OWASP LLM / NIST AI RMF coverage with paste-able remediation, a synthetic-attacker gauntlet, and audience report variants. Load a sample to watch the gauge swing with no live infra.