Agent Skills Matter: Inferring Proprietary Skills from Execution Trajectories

2026-07-28

AI Summary

This study addresses the vulnerability of proprietary skills in cloud-hosted agents, which can be reverse-engineered through behavioral traces even when internal implementations are concealed. The work introduces and empirically validates the phenomenon of “skill leakage,” proposing SigLeak—a black-box skill reconstruction framework that operates without supervised labels. SigLeak identifies skill-related behavioral signatures by contrasting execution trajectories with and without the target skill enabled, integrating trajectory diagnosis, task generation, and iterative pattern distillation. Skill reconstruction is achieved through semantic similarity evaluation using a novel metric, SkillSim. Extensive experiments across five scenarios, three model types, and three agent frameworks demonstrate that SigLeak improves average success rates by 6.88 percentage points over baseline methods, with SkillSim consistently achieving the highest performance.

Abstract

Agent skills package reusable procedures that improve downstream performance. Their lightweight, portable form enables marketplace monetization and private deployment behind cloud-hosted agent interfaces, giving providers incentives to keep high-value skills proprietary. Yet hiding the artifacts does not conceal their behavioral effects, which remain observable in execution trajectories and form a behavioral side channel. We define this exposure as Skill Leakage: reconstructing proprietary skills from trajectories elicited by benign queries, without reference answers or success labels. We introduce SigLeak, a black-box framework that exploits recurring skill signatures in agent behavior. It constructs diverse, decision-rich diagnostic tasks, contrasts matched skill-enabled and skill-disabled trajectories, and iteratively refines a reconstructed skill from the isolated patterns. Across five scenarios, three model families, and three agent frameworks, SigLeak outperforms or matches three baselines in nearly every setting. It raises the success rate by 6.88 percentage points over the skill-disabled reference on average and achieves the highest overall SkillSim, our metric for coarse- and fine-grained semantic similarity. These results show that benign execution trajectories can expose proprietary procedural knowledge. The code is available at https://anonymous.4open.science/r/SigLeak-D1DB.

Problem

• Skill Leakage
• execution trajectories
• proprietary skills
• behavioral side channel
• agent skills

Innovation

• Skill Leakage
• execution trajectories
• black-box reconstruction
• agent skills
• behavioral side channel