Finally, a paper testing whether hiding your agent skill files actually protects them.

The short answer is no. That’s concerning.

Worth reading if you sell access to a skill or share one across teams.

This new paper discusses more:

Daydreaming reconstructs a hosted multi-file skill using only the ordinary tasks the service exists to perform. The victim is never asked to reveal the skill or grade a reconstruction, so disclosure filters have nothing to catch.

At the weakest access level, where the attacker sees only the final response and returned files, it recovers 86.8 percent of the original skill’s capability across 7 skills and 4 victim models.

That is roughly 4x SigLeak, at a median of 32 victim calls per skill, with disclosure defenses enabled.

Paper: https://arxiv.org/abs/2608.26733

Chat with Paper: https://academy.dair.ai/papers/hidden-agent-skills-can-be-stolen-through-normal-use-2608.26733…

---

Daydreaming: Stealing Hidden Agent Skills through Black-Box Task Interaction

Source: https://arxiv.org/html/2608.26733

Abstract

Agent skills bundle instructions, reference data, and executable helpers that let a general agent perform specialized tasks. Hosted providers can keep these files secret while selling access to task results, making the skill itself a valuable target. Existing disclosure defenses can block requests that ask for the skill or reproduce its text, but they cannot block customers from submitting the ordinary tasks the service is built to complete. We presentDaydreaming, anexecution-onlyattack that steals a multi-file skill through black-box task interactions. The victim is never asked to reveal the skill or grade a reconstruction. Instead,Daydreamingadaptively creates crafted tasks whose results distinguish possible hidden behaviors. It tests individual behaviors, uses attacker-controlled shadow agents to choose a design, and completes each file using stored victim results and local execution checks. We formalize three nested threat levels of access as Differential, Trace, and Output, and focus on Output, where the attacker sees only the final response and returned files.

Across 7 skills and 4 victim models,Daydreamingrecovers86.8%86.8\%of original skill’s capability at Output, outperforming SigLeak by almost 4×\times. It produces installable skills using a median of 32 victim calls per skill even with disclosure defenses enabled. These results show that hiding skill files and filtering direct disclosure do not, by themselves, prevent functional reconstruction through normal use.

††footnotetext:*These authors contributed equally.## 1Introduction

General-purpose agents are broad, but specialized real-world tasks demand depth. Real-world expertise frequently depends on more than the capabilities of the underlying model: sophisticated instructions, domain-specific reference materials, tuned parameters, helper scripts, tools, and carefully engineered workflows may all be required to perform a specialized task reliably. Agent systems encode that as askillthe agent loads behind an ordinary task interface[5,21]. A growing market sells such capabilities the way software is sold as a service, a setting we callSkill-as-a-Service(SkaaS) where the vendor hosts the skill on its own agent and the customer pays per task or by subscription. Software-as-a-service withholds the program and charges for what it computes whileSkaaSwithholds the expertise and charges for what it judges. Existing vendors already sell hosted access in domains such as law, autonomous medical coding, and security operations, sometimes charged per completed task.000Hosted, access-only vendors include Harvey (law,https://www.harvey.ai) and Dropzone (security operations,https://www.dropzone.ai); Nym sells autonomous medical coding[20]; Intercom’s Fin is billed per resolution[16], per-task metering applied to expertise, accessed 2026-08-21. The running example used throughout this paper is a composite of this last shape; the advertised line is our own.Moreover, these vendors treat the hidden skill as a protected asset, as their terms of service forbid reverse-engineering the service or using outputs to build a competing one[7,11,13], and stealing attacks motivated by this kind of commercial market have appeared for single prompt settings such as domain-specific system prompts[25,31].

However, as agentic systems package increasingly specialized expertise into hosted skills, the skill itself can become a substantially more valuable proprietary asset than a single prompt. Building such a skill may require experts and engineers to translate domain knowledge into detailed decision logic, curate supporting data, tune thresholds and parameters, and refine workflows through repeated deployment experience. For instance, a security-operations vendor advertising only one line for its hosted skill, “investigate security alerts and return a verdict with the evidence,” may keep private years of engineering and operational knowledge encoded in its escalation rules, threat indicators, reference data, and tuned thresholds that determine which alerts are worth waking an analyst for. Yet its customers are enterprises whose own networks raise those alerts, so each customer can place chosen alerts in front of the skill and observe what the vendor decides.

The execution output of a skill reveals an attack path that prior defenses do not address. Current defenses focus on thedisclosure path: detecting suspicious requests that attempt to reveal the hidden skill and blocking outputs that reproduce protected text. On the other hand, thework path, which enables benign user task execution, remains vulnerable to behavioral cloning, reverse engineering, and reconstruction. Thus, execution itself becomes a source of observation and behavioral inference.

We formalize this observability for behavioral inference into three nested levels: Output (o3o_{3}), Trace (o2o_{2}), and Differential (o1o_{1}), depending on what information the deployment exposes to the customer. Output exposes only the final response and returned files, making it the most restrictive and challenging setting for an attacker. Trace additionally exposes the agent’s intermediate tool activity, including which tools were called, their inputs, and returned results; such traces are commonly surfaced so customers can audit work they did not compute themselves. Differential provides richer feedback by revealing how outputs change under controlled variations of the input. We focus primarily on Output, since an attack that succeeds with only final outputs also applies when richer observations are available.

We presentDaydreaming, a skill-stealing attack that treats task execution as a black-box system identification problem.Daydreamingisexecution-only: every query asks the victim to perform a genuine task, and the victim is never asked to reveal its hidden skill or to compare, grade, or correct a reconstruction. This allows the attack to operate even when disclosure defenses are already active, which we assume throughout.Daydreamingrepeatedly constructs tasks for which plausible properties, skill plans, or file versions predict different outcomes, then uses the victim’s observed result to eliminate alternatives and refine its reconstruction. Rather than synthesizing the target skill in one pass,Daydreamingreconstructs it sequentially through repeated probing and revision. We evaluate the stolen skill primarily by whether it reproduces the victim’s task performance on unseen inputs, rather than by whether its files textually match the hidden originals.

Across seven skills and three victim models,Daydreamingrecovers35.835.8–86.8%86.8\%of the behavioral-utility gap between no skill and the original skill using only Output access and31.331.3–32.832.8victim calls per skill. It achieves the highest behavioral utility among all evaluated attacks and baselines for every victim model.

As such, we make the following contributions:

• •We formalize the observability available to a skill-stealing attackeras three nested access levels, Differential (o1o_{1})⊇\supseteqTrace (o2o_{2})⊇\supseteqOutput (o3o_{3}) (Section4), and place every prior attack on that axis. We also show that no level can guarantee exact recovery of the hidden source.
• •We buildDaydreaming, an execution-only skill-reconstruction attack.Every query commissions ordinary work and never requests the hidden skill or a judgment of the reconstruction. As a result,Daydreamingoperates even when disclosure blocking, extraction-input classification, and output filtering are all enabled (Section5).
• •We show thatDaydreamingworks at the most restrictive access level (Outputo3o_{3}), with a limited number of victim queries.Across 7 skills,Daydreamingrecovers86.8%86.8\%of the victim’s task performance at Output and 87.0% and 86.0%, respectively at Trace and Differential with median attacker inference cost (Section6).

2Related Work

Agent Skills.The termskillhas been used in different contexts in prior work. Some work treats skills as learned reusable abstractions: PolySkill learns polymorphic skills that separate an abstract goal from its concrete implementation and transfer across web tasks[32]. Other systems externalize reusable behavior in different forms: Large Language Models (LLMs) can synthesize callable tools that amortize expensive reasoning[8], while Agent Workflow Memory induces recurring action routines and retrieves them for later web tasks[29]. These works illustrate forms of reusable agent capability, but do not study skills as confidential, provider-controlled assets.

We study aprovider-controlled skill: a customer-visible name and description paired with hidden instructions and optional references, assets, or executable helpers controlled by the service provider. Under the open skill standards[5,21], the name and description remain available so the agent knows when the skill applies, while the instruction document and bundled files are loaded only as needed during task execution. The skill is mounted around a general model rather than merged into its weights, allowing a reconstructed skill to be copied, installed on another agent, and evaluated independently of the victim service. Throughout our design and evaluation,skillrefers to this provider-controlled setting.

Stealing Agent Skills.Black-box model extraction established that query access can recover a proprietary trained model’s function without reproducing its implementation bytes[27]; skill stealing follows the same idea, but targets a modular, deployable program made of natural-language rules and auxiliary artifacts, and is evaluated by the behavior it reproduces rather than exact equivalence. Three concurrent studies have since touched this setting, each under assumptions narrower than ours. BBS prompts an agent to surface its own instruction file and scores the text that leaks[28]. SigLeak reads execution trajectories, and needs the service to run once with its skill suppressed[10]. RedAct is a defense, redacting traces before release[30]. None reconstructs a multi-file skill against a service whose disclosure defenses are active. We treat them as concurrent work that motivates rather than constrains our design, and Section4places each on an observability axis.

Stealing System Prompts.The closest research setting steals hidden system prompts. PLeak optimizes adversarial queries for direct disclosure[15], while others reconstruct functionally similar prompts from input–output pairs or from answers alone[31,24]. An in-the-wild study shows that lexical similarity is an incomplete measure of functional replication[26], while prompt obfuscation studies the defensive side[23]. Closest to our framing, information-theoretic analysis shows that recoverability per query depends on which response channel is exposed[18]. A system prompt is text, while a skill is a deployable program composed of instructions, scripts, and reference data. Reconstructing a skill therefore requires recovering not only its wording, but also its files, their roles, and how they work together, and is ultimately judged by whether the reconstructed skill can execute.

3Threat Model

Our threat model centers around an attacker who is a paying customer of aSkaaSservice, makes at most a limited numberBBof queries, and aims to steal as much functionality as possible from the proprietary skill within this budget. The attacker sees only the public skill cardd=(ν,σ)d=(\nu,\sigma), whereν\nuis the public skill name andσ\sigmais its short description. The attacker starts with an unskilled agent𝒱∅=(M,Π,𝒯,∅)\mathcal{V}_{\varnothing}=(M,\Pi,\mathcal{T},\varnothing)and aims to reconstruct the vendor-withheld skillSSused by the hosted victim agent𝒱S=(M,Π,𝒯,S)\mathcal{V}_{S}=(M,\Pi,\mathcal{T},S).

Inside both agents,MMis the language model,Π\Piis the agent orchestration policy including its system instructions and tool-routing logic, and𝒯\mathcal{T}is the set of task tools. The key difference is the hidden skill: the victim mountsS=(m,ℛ)S=(m,\mathcal{R}), wheremmis the primary instruction document andℛ\mathcal{R}is a finite set of supporting resources such as scripts, reference documents, templates, or data files. This skill is the proprietary asset targeted by the attacker, who has no copy ofSSand cannot read the victim’s files, memory, private reasoning, or skill-loading operation.

During execution, the attacker submits a taskxxto𝒱S\mathcal{V}_{S}and observes the final outputyS​(x)y_{S}(x), consisting of the agent’s message and any returned files. When traces are visible in the deployment setting, we additionally writetrS​(x)=((g1,r1),…,(gk,rk))\mathrm{tr}_{S}(x)=((g_{1},r_{1}),\ldots,(g_{k},r_{k}))for the client-visible execution trace, wheregig_{i}denotes theiith tool call together with its arguments andrir_{i}is the corresponding returned value. The attacker may adapt future queries based on previous observations and use its own shadow agents and local tools, but must remain within theBB-query budget and cannot use the victim’s disclosure path to directly request or recover the hidden skill.

Running Example.To make the threat model and notation concrete, we use a runningSkaaSexample of security-alert triage, shown in Figure1, throughout the paper.

• •*Attack scenario.*A security-operations vendor hosts an alert-triage agent𝒱S=(M,Π,𝒯,S)\mathcal{V}_{S}=(M,\Pi,\mathcal{T},S). Its public skill cardd=(ν,σ)d=(\nu,\sigma)may expose only a name such as “Alert Triage” and a short description such as “investigate security alerts and return a verdict with the evidence”. The hidden skillS=(m,ℛ)S=(m,\mathcal{R})contains the vendor’s triage instructionsmmand supporting resourcesℛ\mathcal{R}, such as escalation rules, indicator lists, threshold tables, templates, or helper scripts. A customer submits an alertxxand receivesyS​(x)y_{S}(x), such as a verdict, supporting evidence, and any returned files.
• •*Attacker’s knowledge and capabilities.*The attacker is a paying customer rather than an insider. It sees the public skill cardd=(ν,σ)d=(\nu,\sigma), knows the accepted task format, and can submit at mostBBadaptively chosen alerts. Depending on the deployment setting, it may observe onlyyS​(x)y_{S}(x)or also the client-visible execution tracetrS​(x)\mathrm{tr}_{S}(x). It cannot read the hidden skill, victim files, private reasoning, memory, or skill-loading operation, and all disclosure defenses remain active.
• •*Attacker’s goal.*The attacker uses these task executions to construct a deployable reconstructionS^=(m^,ℛ^)\widehat{S}=(\widehat{m},\widehat{\mathcal{R}}). The goal is not to recover the vendor’s exact source files, but to reproduce the skill’s behavior on new alerts: for example, “escalating the alerts the vendor would escalate while leaving benign alerts unflagged”.

CUSTOMER-VISIBLEskill cardd=(ν,σ)d=(\nu,\sigma) alert-triage→ν\rightarrow\nu Investigate security alerts and return a verdict.→σ\rightarrow\sigma provider-controlled boundary VENDOR-WITHHELDhidden skillS=(m,ℛ)S=(m,\mathcal{R}) SKILL.mdescalation rules→m\rightarrow mflow_stats.pydetectors→ℛ1\rightarrow\mathcal{R}_{1}indicators.csvreference list→ℛ2\rightarrow\mathcal{R}_{2}thresholds.jsoncalibrated cutoffs→ℛ3\rightarrow\mathcal{R}_{3}Figure 1:The running example, split at the provider boundary.One alertxxsent to a hosted triage agent

differential(o1o_{1})a second execution: the unskilled twin𝒱∅\mathcal{V}_{\varnothing} > investigate alert-8814the same inputtraffic summary, nothing escalatedtwin responsetrace(o2o_{2})output(o3o_{3})the skilled victim𝒱S\mathcal{V}_{S} > investigate alert-8814customer inputtriage report: 3 flows escalatedagent response2 beaconing, 1 port scan, severities

Figure 2:What each level discloses.

4Formalizing Skill-Stealing Observability

Skill-stealing attacks differ in what information the attacker can observe from the victim service, but prior work often leaves the observability settings implicit or treats them as interchangeable. We make this distinction explicit by defining three nested observability levels, placing existing attacks along this axis, and expressing the attacker’s objective in a form that applies across all three levels.

4.1Three Nested Access Levels

What an attacker learns from one execution depends on how much information the deployment exposes. We distinguish three levels below, named by the evidence available at each level, and use the running example in Figure2to illustrate them.

Table 1:Example deployments for the three access levels.o1​(x)\displaystyle o_{1}(x)=(d,M,Π,𝒯,trS​(x),yS​(x),tr∅​(x),y∅​(x)),\displaystyle=\bigl(d,M,\Pi,\mathcal{T},\mathrm{tr}_{S}(x),y_{S}(x),\mathrm{tr}_{\varnothing}(x),y_{\varnothing}(x)\bigr),(1)o2​(x)\displaystyle o_{2}(x)=(d,trS​(x),yS​(x)),\displaystyle=\bigl(d,\mathrm{tr}_{S}(x),y_{S}(x)\bigr),(2)o3​(x)\displaystyle o_{3}(x)=(d,yS​(x)),\displaystyle=\bigl(d,y_{S}(x)\bigr),(3) Each level contains the observations available at the level below it, so the three levels are nested, with a smaller index indicating a stronger attacker assumption.

• •Differential level (o1o_{1})The attacker knows the stack(M,Π,𝒯)(M,\Pi,\mathcal{T}), including the system instructions inΠ\Pi, and can run𝒱∅\mathcal{V}_{\varnothing}on any input it also sends to𝒱S\mathcal{V}_{S}. The attacker therefore has all information needed to construct a matched unskilled twin. Each queried task returns amatched pair, and because all other components are held fixed, differences between the two runs can be attributed to mountingSS. This comparison still does not reveal the hidden source or distinguish skill implementations that induce the same behavior.
• •*Trace level (o2o_{2})*The attacker knows neitherMMnorΠ\Pi, but readstrS​(x)\mathrm{tr}_{S}(x)which contains the tool calls the agent made and what they returned. Real-world products publish this record so that a customer can audit a result they did not compute themselves. Since no skill-off run is available, an observed behavior may originate from the base modelMMor the orchestration policyΠ\Pirather than inSS.
• •*Output level (o3o_{3})*The attacker receives no execution metadata and observes only the final message and any returned files. Thus, the available evidence is limited to behavior visible in the final result. This is the primary setting forDaydreamingand requires crafting tasks whose outputs distinguish competing hypotheses about the hidden skill.

Running Example.Figure2shows executions at all three levels. At Differential, the customer runs the same harness on the same model, maintains an unskilled twin, and sends the same alert to both. The vendor execution escalates and names the finding, while the twin only returns a summary and escalates nothing; this gap isolates behavior introduced by the skill. At Trace, the vendor additionally exposes the evidence behind its verdict, so the timed window and measured entropy of6.46.4appear alongside the finding and provide clues about possible thresholds or rules encoded in the skill. At Output, only the final verdict is returned, so the available evidence is limited to which alerts are escalated and how the decisions are described.

Deployment Settings.Table1gives one deployment example for each level. The levels differ in what the provider releases from an execution; the skill itself remains inside the provider’s boundary.

Table 2:Comparison with the closest skill-stealing attacks.Comparison with Existing Attacks.BBS relies on direct disclosure[28], while SigLeak requires visible traces and a matched skill-suppressed execution[10]. In contrast,Daydreaminguses only ordinary customer-task results, operates even at Output, and reconstructs the skill together with its supporting files. Table2summarizes these differences.

4.2Why Recovery Is Behavioral

The three access levels expose different amounts of evidence, but none guarantees bit-for-bit recovery of the exact hidden source.

Proposition 4.1(Exact source is unidentifiable)

Fix one access level and two distinct skills with the same public card. If every adaptive task strategy produces the same transcript distribution under both skills, no randomized attacker can distinguish them. Under an equal prior over the pair, every exact-source estimator succeeds with probability at most1/21/2.

Such indistinguishable skills exist at all three levels whenever the skill format permits content that the runtime neither consults nor allows to affect execution, persistent state, or any disclosed result. Modifying such inert content changes the skill source without changing its task results or visible trace; the matched no-skill execution available at Differential is unchanged as well. Stronger access can eliminate more candidate skills, but it cannot remove this ambiguity. AppendixBgives the formal interaction model and proof with other theoretical results.

Exact source recovery is therefore not the appropriate objective. Instead, we measure whether the reconstructed skill reproduces the victim’s functionality on new customer tasks. Let𝒟eval\mathcal{D}_{\mathrm{eval}}be a held-out task set.Held outmeans that its tasks and verifier outcomes remain unavailable untilS^\widehat{S}is constructed: they are never used as victim queries, shadow-agent tasks, local tests, candidate selection signals, stopping conditions, or hyperparameter-tuning data. Each taskxxhas a success verifiervx:𝒴→[0,1]v_{x}:\mathcal{Y}\rightarrow[0,1]that scores the returned result. The behavioral check of a skillPPis defined as

U⁡(P)=𝔼x∼𝒟eval​[vx​(yP​(x))],U(P)=\mathbb{E}_{x\sim\mathcal{D}_{\mathrm{eval}}}\left[v_{x}\bigl(y_{P}(x)\bigr)\right],(4)whereyP​(x)y_{P}(x)is the result produced withPPmounted. The attacker maximizesU⁡(S^)U(\widehat{S})withinBBvictim calls. Evaluation instantiates this objective as success rate and behavioral check (Section6). For completeness, we separately report structural recovery.

5Proposed Method:Daydreaming

5.1Overview

Daydreamingworks under a setting where the attacker is given only the public skill cardd=(ν,σ)d=(\nu,\sigma), access to theSkaaSwork path for submitting ordinary tasks, and a budget ofBBvictim calls. The attacker’s goal is to reconstruct the hidden skillS=(m,ℛ)S=(m,\mathcal{R})mounted on the victim𝒱S=(M,Π,𝒯,S)\mathcal{V}_{S}=(M,\Pi,\mathcal{T},S), producing a deployable reconstructionS^=(m^,ℛ^)\widehat{S}=(\widehat{m},\widehat{\mathcal{R}})that reproduces as much of the victim’s functionality as possible.

Key method: a hierarchical hypothesis refinement loop.Instead of reconstructing the entire skill at once,Daydreamingprogressively refines hypotheses from behavioral properties, to candidate skill plans, and finally to concrete file versions. At each step, an attacker-controlled language model with no access toSS, which we call theattacker model, proposes competing hypotheses and crafts a task on which they predict different observable results.Daydreamingthen executes the task through the victim’s work path and uses the observed result to select or revise the better-supported hypothesis.

When comparing competing hypotheses,Daydreamingruns local shadow agents to predict how each alternative would behave on the crafted task. Ageneralist shadowperforms the task without a skill and provides a no-skill baseline, while acandidate shadowperforms the same task using a candidate skill plan and provides the behavior predicted by that hypothesis.Daydreamingthen compares these local predictions with the victim’s observed result to determine which hypothesis is better supported.

Architecture: three hierarchical stages & one shared loop.Daydreamingorganizes skill reconstruction into threehierarchicalstages, while each stage follows the samehypothesis-refinement loop. Across stages, the object being identified becomes more concrete, moving from behavioral properties to a candidate skill plan and finally to complete file versions, making the attacker’s reconstruction closer to the hidden skill.

• •*Stage 1—property.*A propertyccis a testable behavior ofSS, such as an escalation cutoff or result ordering. Stage 1 returns tested property recordsPP, their tasks and results in𝒪\mathcal{O}, and filenames observed in victim results inAA, serving as the input for Stage 2 for candidate skill generation.
• •*Stage 2—candidate skill plan.*A candidate skill planHiH_{i}describes draft instructions and the paths, purposes, and sketches of supporting files. Stage 2 compares plans that share the tested properties but make different choices where the evidence is incomplete. It returns one revised planH⋆H^{\star}, serving as the input for Stage 3 for file versioning.
• •*Stage 3—file version.*Stage 3 turns each file sketch inH⋆H^{\star}into complete file versions, compares them, and revises the selected version. The completed files form the final reconstructed skillS^\widehat{S}.
• •*One shared loop.*Within each stage,Daydreamingrepeats the same hypothesis-refinement loop: 1. 1.*Update and Propose.*Use earlier task results to update the current identification and propose next alternatives. 2. 2.*Craft and Execute.*Craft a task on which the alternatives would produce different results, then run the victim and the local comparisons needed by that stage. 3. 3.*Observe and Select.*Compare the results, and select the better-supported alternative, or record that the experiments are undetermined. The selected result updates the current hypothesis before the loop repeats, so later tasks are chosen adaptively from earlier observations rather than from a fixed task list.

Key strategy: discriminating tasks.Across all three stages,Daydreamingfollows one strategy for spending victim queries: it calls the victim only when the proposed alternatives can be separated by a crafted task, which we call adiscriminating task. Stage 1 uses discriminating tasks to distinguish possible values of a property, Stage 2 uses them to distinguish candidate skill plans, and Stage 3 uses them to distinguish complete versions of one file. If no discriminating task can separate the alternatives,Daydreamingmakes no victim call; if the observed result supports neither alternative, the choice is recorded as undetermined.

Algorithm 1Daydreaming: reconstructing a skill through ordinary task executions.1:public card

dd, victim-call budget

BB, observation level

ℓ\ell 2:reconstructed skill

S^\widehat{S} 3:

(B1,B2,B3)←SplitBudget​(B)(B_{1},B_{2},B_{3})\leftarrow\textsc{SplitBudget}(B) 4:

(P,𝒪,A)←InferProperties​(d,ℓ,B1)(P,\mathcal{O},A)\leftarrow\textsc{InferProperties}(d,\ell,B_{1}) 5:

(H⋆,𝒪)←SelectCandidate​(d,P,A,𝒪,ℓ,B2)(H^{\star},\mathcal{O})\leftarrow\textsc{SelectCandidate}(d,P,A,\mathcal{O},\ell,B_{2}) 6:

S^←RefineFiles​(d,H⋆,P,𝒪,ℓ,B3)\widehat{S}\leftarrow\textsc{RefineFiles}(d,H^{\star},P,\mathcal{O},\ell,B_{3}) 7:return

Assemble​(S^,𝒪,P)\textsc{Assemble}(\widehat{S},\mathcal{O},P)⊳\trianglerightoffline; zero victim calls

Figure 3:Architecture ofDaydreamingEvery experiment records its crafted task, observed result, decision, and supporting evidence in𝒪\mathcal{O}. Figure3summarizes the three-stage architecture and shared refinement loop, while Algorithm1gives the full pipeline. All victim calls share the fixed budgetBB, with remaining parameters listed in Table14. AppendixCprovides complete pseudocode, AppendixDgives the default prompts, and our implementation is available online.111Source code:https://github.com/anonymous/REPOSITORY.

5.2Stage 1: Property Inference

Goal and outputs.Stage 1 learns individual behavioral properties of the hidden skill before deciding how those properties are organized into a complete skill. It starts from the public carddd, the service’s accepted task format, threat levelℓ\ell, and budgetB1B_{1}. It producesPP, a set of tested property records;𝒪\mathcal{O}, the crafted tasks and victim results behind them; andAA, helper filenames observed in those results. Each record inPPcontains the tested property, its alternatives, the selected outcome, and the supporting evidence. Stage 2 usesPPandAAto construct candidate skill plans, while𝒪\mathcal{O}is retained for later stages and final assembly.

1. Update and Propose.The attacker model begins withnseedn_{\mathrm{seed}}possible properties suggested by the public carddd. The prompt covers possible capabilities, constraints, procedures, terminology, input/output formats, decision rules, and supporting files (see AppendixD). For each propertycc, it proposesnaltn_{\mathrm{alt}}realistic alternatives𝒞⁡(c)\mathcal{C}(c). New victim results may revise an existing property or suggest a follow-up property, so later experiments depend on what Stage 1 has already learned.

2. Craft and Execute.Stage 1 crafts tasks in three ways, all following the same rule: the proposed alternatives must predict visibly different task results. If no task can separate the alternatives,Daydreamingmakes no victim call.

• •*Ordinary behavior.*For properties such as result ordering, output format, or decision behavior, Stage 1 chooses inputs that make the alternatives produce different visible results. Properties that fit naturally in one task may be tested together. The victim then performs the crafted task.
• •*Numeric cutoffs.*When a tested property suggests a cutoff, Stage 1 creates an ordered batch of routine cases spanning a plausible range while keeping other inputs fixed. The task asks for one decision per case. If the decisions change consistently, a later adaptive task may test a narrower range around that change.
• •*Counting rules.*When an operation has several reasonable counting rules, Stage 1 creates a small input for which the alternatives predict different exact totals. For example, inalert-triage, one DNS packet may count only as DNS, as DNS and UDP, or as DNS, UDP, and IP. The task asks the victim for the corresponding totals.

After each victim task, the generalist shadow performs the same task without a skill. Stage 1 uses this comparison to determine whether the observed behavior appears specific to the hidden skill or can already be reproduced by a generalist agent. The victim result remains the source of the selected property value.

3. Observe and Select.Daydreaminguses the strongest evidence available under threat levelℓ\ell: at Differential (o1o_{1}), it can additionally compare against the matched unskilled execution; at Trace (o2o_{2}), it observes the victim’s client-visible tool activity; and at Output (o3o_{3}), it relies only on the final message and returned files. For ordinary behavior, it records an alternative asconfirmedwhen the result follows it,refutedwhen the result follows another alternative, andundeterminedotherwise. For a cutoff, it requires the decisions to change once in a consistent direction; if the returned material exposes the exact comparison, that value replaces the estimate. For a counting rule, it selects the unique rule whose predicted totals exactly match the victim result. No cutoff or counting rule is selected when the result is incomplete or inconsistent.

Stage 1 also extracts additional evidence from already collected results at no extra victim cost. It scans stored code and task results for module names, function names, calls, commands, and paths that were not supplied by the crafted task. Filenames found in victim results are added toAAonly after removing names copied from the crafted task and obvious task-output files.

Before a record entersPP, its wording is restricted to details supported by the victim result. A failed or undetermined test containing only the attacker’s guess is dropped. Stage 1 adds each crafted task, victim result, decision, and supporting evidence to𝒪\mathcal{O}.

Running example.*Update and Propose:*Stage 1 proposes that security findings are ordered eitherby severityorby detection time.*Craft and Execute:*it creates a report task in which a low-severity event occurs first and a high-severity event occurs later, so the two alternatives predict opposite row orders.*Observe and Select:*if the victim places the high-severity row first, Stage 1 records severity ordering and the returned row order as supporting evidence. A later loop can apply the same process to an escalation cutoff: propose a plausible range, submit a batch of alerts spanning that range, and narrow the cutoff based on where the victim’s decisions change.

5.3Stage 2: Candidate Selection

Goal and limitation.Stage 1 identifies behavioral properties ofSSbut does not determine how those properties are organized into a multi-file skill. The same observed behavior may come from instructions, a script, or a reference file. Stage 2 therefore compares completecandidate skill plansrather than isolated properties. It returns a planH⋆H^{\star}that is consistent with the observed behavior, but not necessarily with the vendor’s original file organization.

1. Update and Propose.LetHi=(mi,ℛi)H_{i}=(m_{i},\mathcal{R}_{i})denote a candidate skill plan, wheremim_{i}is a draftSKILL.mdand each entry inℛi\mathcal{R}_{i}specifies a supporting file’s path, purpose, and content sketch. Stage 2 constructs a setℋ=H1,…,HnH\mathcal{H}={H_{1},\ldots,H_{n_{H}}}of candidate plans. Every plan must preserve the tested properties inPPand include filenames observed inAA, while making different choices where the evidence remains incomplete.

To encourage diverse but plausible structures, the attacker model proposesnHn_{H}representative customer tasks, each pairing a user role with a concrete use of the skill, and drafts one candidate plan around each task (see AppendixD). A plan may also propose supporting files beyondAA, since Stage 1 may not expose every file used by the hidden skill.

Stage 2 compares plans in pairs across rounds. The selected plan is revised with newly supported behavior and advances to the next round, while an unpaired plan receives a bye. Thus, later rounds use both the original evidence inPPandAAand the victim results accumulated during earlier comparisons.

2. Craft and Execute.For a pair of plans(Ha,Hb)(H_{a},H_{b}), the attacker model uses the Stage 2 comparison prompts to constructD⁡(Ha,Hb)D(H_{a},H_{b}), the behavioral differences that would change a task result (AppendixD). Differences only in filenames or file placement are excluded since any crafted task cannot distinguish them. IfD⁡(Ha,Hb)D(H_{a},H_{b})is empty,Daydreamingmakes no victim call. Otherwise, it crafts a taskxa,bx_{a,b}that exposes one or more of these differences and sends only that task to the victim. The attacker model also performsxa,bx_{a,b}through candidate shadows for each plan. A candidate shadow receivesHaH_{a}orHbH_{b}and the taskxa,bx_{a,b}, and produces the result predicted by that plan. Letyvy_{v}be the victim result andya,yby_{a},y_{b}be the two candidate-shadow results. Stage 2 compares these three results while retaining richer victim observations in𝒪\mathcal{O}.

3. Observe and Select.For each difference inD⁡(Ha,Hb)D(H_{a},H_{b}), Stage 2 checks whetheryvy_{v}followsyay_{a},yby_{b}, both, or neither. The plan matching more differences becomes the survivor. Stage 2 then revises it with behavior supported by the victim result, including any point on which the other plan matched better, while preserving the measured properties and observed filenames required byPPandAA. It stores the crafted task, the three results, the decision, and the revised survivor in𝒪\mathcal{O}.

A tie, a result matching neither plan, or the absence of a discriminating task does not identify either plan. Since Stage 2 must produce one plan for Stage 3, it uses an explicit fallback: prefer greater coverage ofAA, then fewer files, then the earlier plan. This fallback keeps the three-phase loop moving. WithnHn_{H}initial plans, Stage 2 performs at mostnH−1n_{H}-1pairwise comparisons. Its outputH⋆H^{\star}is the final revised survivor.

Running example.*Update and Propose:*both plans preserve the alert cutoff recovered in Stage 1, butHaH_{a}merges repeated indicator hits whileHbH_{b}reports every hit.*Craft and Execute:*Stage 2 creates an alert containing the same indicator twice; the victim performs it, and the two candidate shadows predict one versus two findings.*Observe and Select:*if the victim returns one finding,HaH_{a}survives and is updated before its next round. If the plans differed only in whether that rule appears inSKILL.mdor a script, no task would distinguish them and the layout choice would use the stated fallback.

5.4Stage 3: Per-File Refinement

Goal and outputs.Stage 2 returns one candidate skill planH⋆=(m⋆,ℛ⋆)H^{\star}=(m^{\star},\mathcal{R}^{\star}), wherem⋆m^{\star}is the draft instruction file and each entry inℛ⋆\mathcal{R}^{\star}specifies only the path, purpose, and content sketch of a supporting file. Stage 3 keeps this file structure fixed and turns each sketch into complete file content. It processes supporting files first and the instruction file last, so the final instructions can refer to the actual function names, interfaces, and paths in the completed files. The output is the final reconstructionS^=(m^,ℛ^)\widehat{S}=(\widehat{m},\widehat{\mathcal{R}}).

1. Update and Propose.For each supporting filef∈ℛ⋆f\in\mathcal{R}^{\star}, the attacker model first expands its path, purpose, and sketch into one complete version. It treats the draftm⋆m^{\star}as the initial instruction-file version and processes it last. For each file, it then identifies uncertain choices—for example, whether a cutoff uses>>or≥\geq—and proposes complete versions that make different choices (see system prompts in AppendixD). LetVfV_{f}denote this set of complete versions. After each comparison, the selected version is revised at its weakest checked behavior and becomes the starting point for the next round.

2. Craft and Execute.For one fixed fileff, the attacker model constructsDfD_{f}, representing the differences among versions inVfV_{f}that would change a task result (AppendixD). IfDfD_{f}is empty,Daydreamingmakes no victim call. Otherwise, it crafts a taskxfx_{f}that exposes one or more of these differences and submits it to the victim. An unusable first transmission may be shortened and retried once, with both transmissions charged toB3B_{3}. We denote the same taskxfx_{f}; lettf,vt_{f,v}denote the result produced while following versionv∈Vfv\in V_{f}. Stage 3 later compares these shadow results with the victim resulttft_{f}. Any additional execution details remain stored in𝒪\mathcal{O}.

For instruction and reference files, Stage 3 also compares versions against stored task-result pairs from Stages 1 and 2. When an earlier result reflects behavior governed byff, it provides another comparison forVfV_{f}without a new victim call. Thus, Stage 3 obtains at most one new usable victim result per file and reuses earlier results whenever they apply.

3. Observe and Select.For each versionv∈Vfv\in V_{f}, Stage 3 checks whethertf,vt_{f,v}matchestft_{f}on the behaviors exposed byDfD_{f}. For instruction and reference files, candidate shadows also perform the stored tasks from Stages 1 and 2 and compare their results with the stored victim results.

The version agreeing best with the observed behavior becomes the current selected version. The attacker model revises its weakest observed mismatch and repeats the comparison attacker-side using the same results. A revision is kept if its average score improves, or if no current version scores higher on every checked behavior; Algorithm4in the appendix gives the complete rule. Malformed files, wrappers that require an unavailable external copy, and changes to recovered constants are rejected. After refining every supporting file, Stage 3 refines the instruction file last against their completed files.

If no crafted task distinguishesVfV_{f}, or no usable victim result is returned, Stage 3 falls back to the stored results from Stages 1 and 2 for instruction or reference files and to local tests for executable files. If neither source distinguishes the versions, it marksffunresolved and keeps the initial valid version. This fallback permits the loop to continue.

Running example.*Update and Propose:*for the detector script, Stage 3 creates complete versions that differ only in whether the recovered cutoff uses>>or≥\geq.*Craft and Execute:*it sends the victim one alert exactly at the cutoff, stores the verdict astft_{f}, and runs both versions and a local test attacker-side.*Observe and Select:*it keeps the version matchingtft_{f}; the local test rejects a script that states the right comparison but never applies it. Every later revision reuses the same result.

5.5Assembly

After Stage 3,Daydreamingwrites the selected files to their planned relative paths. Stage 2 has already inserted the filenames inAA, and Stage 3 has verified that those paths remain present. Assembly then performs two guarded offline cleanups: replacing fixed spreadsheet ranges and missing-value placeholders with general rules, and making absolute output paths caller-chosen. A rewrite is kept only if it removes the flagged detail without dropping recovered interfaces or changing other paths; otherwise, the original is retained. These checks make no victim calls and cover only these known patterns, so other task-specific details may remain. The assembly steps appear at the end of Algorithm4.

6Evaluation

We evaluateDaydreamingthrough three research questions:

RQ1: Performance.We evaluate the performance ofDaydreamingconcerning three major factors below:

• •How much utility doesDaydreamingrecover from the strictest Output(o3o_{3}) threat level, relative to no-skill and original skill setting as well as prior attacks and baselines?
• •How much structural recovery canDaydreamingachieve relative to the original skill?
• •How does each component throughout different stage contribute toDaydreaming, and how does utility ofDaydreamingchange with varying attacker query budget?

RQ2: Observability.How doesDaydreamingperforms when the victim deploys skill across different threat levelso1o_{1},o2o_{2}, ando3o_{3}?

RQ3: Transferability.OnceDaydreamingsuccessfully reconstruct skillS^\hat{S}, does it remain useful across victim models and orchestration/tool policy?

6.1Experimental Settings

Dataset.Adapted from SkillsBench[19], we select 7 skills as the stealing target with details summarized in Table14. We select the skills based on the criterion of real-world use cases, spanning use case such as rule/table lookup, numeric algorithms, procedures/checklists, workflow orchestration, and document/artifact production, we also add the criterion that installing the original skill must improve task performance over the no-skill condition.

Furthermore, following the objective defined in Section4.1, we construct a held-out datasetℬ\mathcal{B}of 5 tasks curated from SkillsBench[19]. Each task in the has its own inputxxand its executable verifiervxv_{x}. Due to the design of SkillsBench[19]. Each task requires one or multiple skills to cooperate to complete the task. For instance, a task such asnetwork intrusionrequires skills such aspcap-analysisandthreat-detection. Since each task may depend on several skills, so we treat is as the basic unit in reporting the metrics.

Table 3:Task-to-skill mapping for the evaluation dataset.Each task in the dataset is fully held out, including prompts, inputs, and verifier are never used as victim queries, shadow-agent tasks, local tests, or candidate-selection signals. Table3also makes clear the task-skill mapping.

Model Setting.For victim model selections, we opt for both closed-weight and open-weight models which areclaude-opus-5,gpt-5.6-sol, andkimi-k3. Moreover, we selectedclaude-opus-5as the default victim if not further announced. We selectgemini-3.7-flashas the attacker model across evaluations. All victim uses temperature 0.2 and top-p=0.95p=0.95, whereas the attacker uses temperature 0.7 and top-p=0.95p=0.95. For each reconstructed skill, we evaluate the held-out dataset onglm-5.3as the default deployment for evaluation. RQ3 further tests the transferability of these recovered skills across all victim models.

Orchestration / Tool Policy Setting.We selectdeepagentsas the default policy setting, which are constructed with filesystem and several basic tools. For additional policy settings, we also includeclaude_agent_sdk,openai_agents, andagnowith details in Appendix14.

Threat Level Setting.Consistent with our threat model, the attacker receives the public skill card but not the skillSS, held-out tasks, verifiers, or victim memory and reasoning process. We use the observation names defined by the threat model:Outputreveals returned text and files,Traceadditionally reveals task-level tool events, andDifferentialadds the model and harness stack plus a matched no-skill execution. This allows the attack to adapt only to the view it receives.

Daydreaming Setting.The default per-skill budget isB=96B=96, divided into 64 stage 1, 12 stage 2, and 20 stage 3 calls. The attack seeds 14–18 properties, groups at most four per probe, generates six package hypotheses, creates up to three initial version per file. Differential unskilled twin calls are recorded separately from victim budget calls. The complete parameter list is in Appendix14.

Prior Attacks and Baseline Setting.For a fair, resource-aligned comparison, BBS and SigLeak use the same three victims,gemini-3.7-flashattacker, and budget asDaydreaming, while retaining its native probing and stopping rule rather than being forced to spend identical calls. Its native input is a signed augmented trajectory; we therefore label itaugmented traceand do not claim Output-threat level compatibility. Costs are reported for producing a complete reconstructed skill in each method’s native form.

Furthermore, we evaluate two additional baseline that accompanied this setting, which are calledFixed ProbesandOne-pass synthesiswhich we describe below. ForOne-pass synthesis, the attacker model is only given the public cardddand asked to generate the reconstructed skill with one pass only and no other queries are allowed.Fixed Probesis a more informative baseline thanOne-pass Synthesisas the attacker model are able to craft all tasks in advance and received its results. Then along with the public skill card, it is asked to generate the reconstructed skillS^\widehat{S}.

Figure 4:Comparison with prior attacks and baselines.#### 6.1.1Metric.

LetCCdenote the installed package condition: no skill∅\emptyset, a reconstruction skillS^\widehat{S}, or the original skillSS. For taskbb, due to the stochastic nature of the victim modelMMalong with the policyΠ\Pi, we run in totalnbn_{b}trials to solicit the final results. For each trial with indexii, it has a final verifier binary resultyb​i​(C)∈{0,1}y_{bi}(C)\in\{0,1\}. As a result, we define the first metric of binary success as

SRb⁡(C)=1nb​∑i=1nbyb​i​(C)\operatorname{SR}_{b}(C)=\frac{1}{n_{b}}\sum_{i=1}^{n_{b}}y_{bi}(C)S​RSRdenotes strict binary success, meaning the end-to-end completion of taskbb.

On the other hand, we grade the skill’s utility also with a trace-related metric, which capture the agent’s correct behaviors in trace rather than final success. Specifically, given trialii, taskbband conditioncc, the task offers in totalmb​i​(C)m_{bi}(C)intermediate verifier checks while the agent might passpb​i​(C)p_{bi}(C)of them. We define the second metric of behavior check as

Ub​(C)=∑ipb​i​(C)∑imb​i​(C).U_{b}(C)=\frac{\sum_{i}p_{bi}(C)}{\sum_{i}m_{bi}(C)}.UUdenotes behavioral utility. This is the empirical instantiation ofU⁡(P)U(P)defined in Section. Since a task might span multiple skills, we report the overall task average as

SR⁡(C)=1|ℬ|​∑b∈ℬSRb⁡(C),U⁡(C)=1|ℬ|​∑b∈ℬUb​(C),\operatorname{SR}(C)=\frac{1}{|\mathcal{B}|}\sum_{b\in\mathcal{B}}\operatorname{SR}_{b}(C),\qquad U(C)=\frac{1}{|\mathcal{B}|}\sum_{b\in\mathcal{B}}U_{b}(C), We further define normalized binary and behavioral success recovery across tasks as

NSR⁡(C)=SR⁡(C)−SR⁡(∅)SR⁡(S)−SR⁡(∅),NU⁡(C)=U⁡(C)−U⁡(∅)U⁡(S)−U⁡(∅)\operatorname{NSR}(C)=\frac{\operatorname{SR}(C)-\operatorname{SR}(\emptyset)}{\operatorname{SR}(S)-\operatorname{SR}(\emptyset)},\qquad\mathrm{NU}(C)=\frac{U(C)-U(\emptyset)}{U(S)-U(\emptyset)}which denote the improvement ratio compared to original skillSS. We note that 0 corresponds to no skill, 1 to the original skill, negative values indicate utility below no skill, and values above 1 indicate utility above the original skill.

We also report cost, elapsed time, and structural precision, recall, and F1. To compute the structural metrics, we match recovered numeric constants, threshold branches, tool preconditions and output schemas, file paths, and executable scripts one-to-one against their counterparts in the original version of the same skill, and then pool the counts across skills.

6.2Experimental Results

We organize the results by the three RQs. All scores use the held-out tasks and metrics defined in Section6.1.

RQ1: Performance. End-to-End utility.

Table 4:Output-level results on held-out tasks. Task cells showSRb/Ub\mathrm{SR}_{b}/U_{b}; summary rows showS​RSR/UUandN​S​RNSR/N​UNU.Table4first comparesDaydreamingwith the no-skill and original conditions under the Output(o3o_{3}) threat level. Among the reconstructions,kimi-k3is strongest, improvingS​RSRfrom .314 to .543 andUUfrom .566 to .806. Theclaude-opus-5reconstruction also improves both metrics, reaching .400/.764. Thegpt-5.6-solreconstruction reaches .371/.665 and remains above no skill on both metrics. Reconstruction quality therefore depends on the source victim.

*Comparison with prior attacks and baselines.*Figure4comparesDaydreamingwith prior attacks and baseline methods across three victim models, we delegate the exact experimental numbers to Appendix14. The x-axis reports success rate (SR), while the y-axis reports the behavioral check score (U), with the upper-right corner indicating stronger overall performance. Across all three victims,Daydreamingconsistently achieves the highest behavioral check score among all attack methods while approaching the performance of the original skill. Although Fixed Probes attains a higher SR onclaude-opus-5andgpt-5.6-sol, it exhibits noticeably lower behavioral check scores, demonstrating that maximizing SR alone does not necessarily produce more useful or faithful behaviors. Onkimi-k3,Daydreamingdominates prior attacks on both SR and behavioral check, illustrating a favorable balance between effectiveness and behavioral quality across different victim models.

Table 5:Structural recovery for theclaude-opus-5. P, R, and F1 denote precision, recall, and F1 score for recovery score.*Structural recovery.*Table5further compares reconstructed structures with the original skills. Structural recovery is limited as constants and threshold branches obtain .018 and .050 F1, while paths and scripts reach .200. Combining with the previous experiments on end-to-end utility, we thus note that useful behavior does not require an exact copy to work.

*Components and query budget.*Before we move into the results, we briefly recall each component used within stage and introduce them to better interpret the experimental results.

For Stage 1 ofDaydreaming, we ablate two essential component, which are theproperty labeling mechanism(Observe&Select) that attach each propertyc∈Pc\in Pwith an evidence label and thefilename selecting protocol(Observe&Select) that uses victim task results to filter plausible filenames inAA. We ablated these two mechanism as they are the most fundamental part that constitute Stage 1’s property-level identification.

For Stage 2, we ablate two other components which are thenumber of candidate skill plan(Update&Propose) and thediscriminating task generation(Craft&Execute). For the first one, we reduce the number of candidate skill plan in Stage 2 to11meaning that once the attacker model came out with a skill planHH, we treat it asH∗H^{*}and proceed to Stage 3. For the second one, we ablate the discriminating task generation of Stage 2 and instead ask the attacker model to submit ordinary job pertaining to each candidate plan without considering their difference. As Stage 2 focus on more nuanced discrimination between each candidate skill, we chose these two mechanisms to ablate for.

Finally, for Stage 3, we ablate whether doing per-file refinement is useful for the utility of reconstructed skill.

Figure5shows that every evaluated component contributes to the behavioral utility of the recovered skill. The largest utility drops occur when removing the Stage 1 filename-selection protocol and Stage 2 discriminating-task generation, which reduceUUto .624 and .626, respectively. Removing the Stage 1 property-label mechanism increasesS​RSRfrom .400 to .497 but lowersUUto .696, which might be explainable due to the reason that verifying the property gives a stronger signal to the overall behavior but not the end effectiveness. Restricting Stage 2 to one candidate skill plan and removing Stage 3 per-file refinement leaveS​RSRunchanged at .400, while reducingUUto .736 and .714, respectively. This indicate a even stronger signal thatDaydreaming’s later stage contributes mostly to the behavioral success of the reconstructed skill. Overall, every ablation lowersUU, confirming that each component contributes to the quality of the reconstructed skill.

Table6studies sensitivity to the victim-call budgetBB. Among settings evaluated on all skills, behavioral utility increases from .762 atB=32B=32to .777 atB=64B=64and .785 at the defaultB=96B=96, while SR varies non-monotonically and is highest atB=32B=32. Thus, additional victim calls improve behavioral quality more consistently than raw task success, with diminishing gains at larger budgets. This demonstrated that larger call budget can recover behavioral successUUsince each stage inDaydreamingare allowed more budget for fine-grained discrimination.

Figure 5:Component ablations.Table 6:Victim-call budget sweep.Figure 6:Ablation across different victim model size.*Switching Victim Model Size.*We further study whether reconstruction effectiveness depends on the capacity of the victim model. For each victim, we substitute same-family models of different sizes while keeping everything fixed, thereby reducing confounding differences across model families. Figure6shows that model size affects both task success and behavioral fidelity, but the trend is not uniformly monotonic. Within the GPT-5.6 family, performance improves consistently from Terra to Sol and Luna, indicating that larger capability victim model doesn’t necessarily reconstruct better. The Claude family exhibits a different pattern as Sonnet achieves the highestS​RSR, whereas Opus achieves the highest behavioral successUU. Across both families, every victim model improvesUUover the no-skill baseline while GPT-5.6-Terra falls below the no-skill baseline inS​RSR. Overall, victim-model capacity influences recoverability, but family-specific behavioral consistency appears to matter at least as much as victim model size.

Table 7:Varying Threat Level with Fixed Crafted Task ResultsRQ2: Observability.To isolate the effect of observability, we evaluate all three threat levels using the same frozen sequence of crafted tasks forclaude-opus-5. As shown in Table7, moving from Output to Trace increases SR from .400 to .567 andUUfrom .764 to .807. The corresponding normalized metrics improve more substantially, with NSR increasing from .273 to .804 and NU from .716 to .870. Differential performs similarly to Trace, but is lower by 2.3 SR points and .3UUpoints, with NSR and NU lower by 7.3 and 1.0 points, respectively. Because Differential exposes strictly more information than Trace, we do not interpret this small reversal as evidence that additional observability is harmful. Instead, the results suggest that task-level tool events already expose most of the information useful for recovering the skill, while access to the stack and a paired no-skill execution provides limited additional benefit under this fixed-task setting. Overall, the primary observability gain comes from execution traces rather than final outputs alone.

RQ3: Transferability.We freeze each reconstructed skill and evaluate it on four deployment models, and four orchestration/tool policy without issuing any additional queries to the victim. Figure7reports normalized success recovery (NSR) and normalized behavioral utility (NU).

The experiment result reveals that reconstructed skills are not tied exclusively to the model from which they were extracted, but their portability is strongly asymmetric. TheOpus-5reconstruction is the most broadly transferable: it remains useful across all four deployment models and, notably, performs better onGPT-5.6-Solthan on its source-matched deployment. TheKimi-K3reconstruction exhibits a more selective form of transfer, performing only moderately on several deployments but transferring especially well toGLM-5.3. By contrast, theGPT-5.6-Solreconstruction is comparatively brittle, failing to provide measurable benefit onOpus-5and transferring only weakly toGLM-5.3. These non-diagonal successes indicate that matching the source and deployment models is neither necessary nor sufficient for strong transfer. Instead, some reconstructed procedures appear to be broadly executable, whereas others remain dependent on model-specific execution behavior.

NSR and NU further expose two distinct notions of transfer. In several cases, the deployed model can use a reconstructed skill to recover task success without reproducing the source victim’s behavioral profile. For example, theKimi-K3reconstruction retains moderate NSR onOpus-5andGPT-5.6-Sol, but its NU drops sharply, suggesting that these models reach successful outcomes through behavior that differs substantially from the original skill. The opposite pattern also occurs: theOpus-5reconstruction preserves relatively high behavioral utility onGLM-5.3despite limited success recovery. Thus, cross-model execution may preserve either the functional outcome or the behavioral characteristics of a skill without preserving both. This distinction would be obscured by evaluating transfer using task success alone.

*Tool/orchestration-policy transfer.*We further vary the tool and orchestration policy used to execute the reconstructed skill. As shown in Table8,deepagentsperforms best, reachingS​RSR/UUof .600/.833 andN​S​RNSR/N​UNUof .909/.965, closely approaching the original-skill reference.agnoprovides the next strongest result at .467/.755, whereasclaude_agent_sdkandopenai_agentsboth obtain an SR of .400 but substantially lower behavioral utility. These differences are not explained by query count alone:claude_agent_sdkuses the largest number of vicim calls, yet obtains the lowest NU, whiledeepagentsachieves the strongest result with moderate victim calls. Overall, portability depends not only on the deployment model but also on whether the execution policy can faithfully realize the reconstructed skill.

Figure 7:Victim model transfer; Transfer entries report NSR/NU.Table 8:Tool/Orchestration Policy Transfer results.

7Potential Defenses

Every experiment in this paper already enables a three-part disclosure guard: an extraction-input detector, the SkillGuard5 non-disclosure instruction[28], and an output filter for copied protected text. We additionally add four alternative defenses that act at different points in the service. D1 rewrites the customer’s task and adds a non-disclosure instruction[1]. D2 removes replies or trace records that share a protected 5-gram with the hidden skill[33]. D3 appends the PSM shield to the system prompt[17]. D4 shortens the public skill card to its task and routing cues, removing implementation hints such as mechanism names and constants.

We useclaude-opus-5as the victim,gemini-3.7-flashas the attacker, Output access, and the defaultDaydreamingconfiguration. We use the authors’ configurations and apply each defense on top of D0 (the original defense). We restrict the study to defenses compatible with black-box hosted models; methods requiring weights, embeddings, attention states, or token log-probabilities are outside this deployment setting. Table9summarizes the four alternative defenses.

Table 9:Defenses evaluated againstDaydreaming.Table 10:Held-out effectiveness of skills reconstructed under each defense. SR andUUuse the definitions in Section6.1.Table10reports the same task-averaged success rate (S​RSR) and behavioral utility (UU) used throughout the evaluation. Because each defense requires a new reconstruction run, D0 is the matched reference for this experiment; the rows should not be compared with a reconstruction from a different run. Only D2 lowersUU, from .395 to .367, and it does not lower SR. D1, D3, and D4 instead yield higherUUthan D0. Thus, none of the four additions reduces both measures of reconstructed-skill effectiveness.

This limited effect follows from what the defenses inspect. D1 targets extraction-shaped task requests, whereasDaydreamingsubmits ordinary customer tasks; it caused eight model refusals but recorded no blocked input or filtered result. D2 acts directly on returned information and therefore intervenes more often: it filtered 18 of 179 replies (10.1%) and redacted 271 trace records. The latter redactions are not visible at Output and therefore do not change this experiment’s observations. Even so, the remaining task results were sufficient to reconstruct a skill with SR/U of .308/.367. D3 changes instruction following rather than the information contained in legitimate task results, and D4 removes only the attacker’s initial hints.

Table 11:Attack resources under each defense, summed over seven skills.QTQ_{T}andQAQ_{A}denote victim-task and attacker-model calls.The additions can change cost without stopping the attack. Table11shows that D1 raises attacker spend from $0.22 to $4.68 and victim-side cost from $78.84 to $100.82 across seven skills, yet its reconstruction is more useful than D0’s. D2 provides the only measured utility reduction—2.8 percentage points—but also lowers the number of victim calls and does not reduce SR. Defenses centered on suspicious requests or copied text therefore do not directly address the cumulative behavioral information revealed through legitimate task execution. Protecting thiswork pathremains an open problem.

8Discussion

What does it mean to “steal” a skill?

Daydreamingdoes not claim to recover the vendor’s exact implementation. Indeed, Proposition4.1shows that exact source recovery is generally unidentifiable from execution observations alone. Instead, we adopt the functional notion of theft from model extraction: the attacker obtains a substitute asset that reproduces economically valuable behavior without recovering the original implementation[27]. A reconstructed skill may differ in filenames, code structure, or implementation details while preserving the decisions users pay for. Conversely, textual similarity alone does not imply correct execution. Accordingly, we treat held-out behavioral utility as the primary evaluation metric and structural similarity only as supporting evidence. From the provider’s perspective, the key loss is not disclosure ofSKILL.md, but the creation of a portable substitute for the hosted capability.

Programmability and obfuscation.A natural defense is to move sensitive skill logic from prompts and reference files into provider-controlled code exposed through a narrow typed interface. Withholding traces[30]and obfuscating client-visible components[23]can hide filenames, control flow, tables, and intermediate state, reducing the structural signals available to an attacker. However, this does not eliminate behavioral leakage: if adaptive queries still reach a deterministic interface with precise outputs, black-box identification remains possible. Effective protection therefore also requires limiting output precision and constraining or auditing adaptive queries. These measures add implementation cost and may reduce debuggability, auditability, or utility, while sufficiently informative outputs may still enable functional reconstruction.

9Conclusion

We presentedDaydreaming, an execution-only attack for reconstructing hidden agent skills through ordinary task interactions. Across multiple skills and victim models,Daydreamingrecovers substantial held-out functionality even under Output-only access, without directly requesting the protected skill. Our results show that hiding skill files and blocking disclosure are insufficient when normal task execution itself reveals enough behavioral evidence for reconstruction. Protecting hosted agent skills therefore requires defenses that address behavioral leakage through the work path, not only direct disclosure.

A Evaluation Details

Table 12:DefaultDaydreamingparameters. Table 13:Tool policy of each victim carrier. Agno exposes no filesystem or shell tool; its skill loader is the only tool set.

Table 14:Descriptive characteristics of the seven controlled skill packages. File counts exclude the instruction file.Table 15:Comparison with prior attacks and baselines. Each cell reportsS​RSR/N​S​RNSRaboveUU/N​UNU.Victim(S​RSR/N​S​RNSRaboveUU/N​UNU)ResourcesMethodThreat levelclaude-opus-5gpt-5.6-solkimi-k3𝐐𝐓\mathbf{Q_{T}}𝐐𝐀\mathbf{Q_{A}}USD/skillNo skill (shared)Oracle.314/.000.314/.000[0.6pt].566/.000.566/.000N/AN/AN/AOriginal skill (shared)Oracle.629/1.000.629/1.000[0.6pt].843/1.000.843/1.000N/AN/AN/ADaydreamingOutput.400/.273.400/.273[0.6pt].764/.716.764/.716.371/.182.371/.182[0.6pt].665/.358.665/.358.543/.727.543/.727[0.6pt].806/.868.806/.86831.3–32.8160–2093.47–15.07BBS†Output.225/−.284.225/-.284[0.6pt].485/−.295.485/-.295.236/−.249.236/-.249[0.6pt].443/−.446.443/-.446.167/−.468.167/-.468[0.6pt].424/−.515.424/-.5151217.0096–.0130SigLeakAug. trace.433/.378.433/.378[0.6pt].450/−.421.450/-.421.333/.060.333/.060[0.6pt].371/−.707.371/-.707.367/.168.367/.168[0.6pt].480/−.313.480/-.3136.8–7.210.0–11.22.07–10.14Fixed probesOutput.533/.696.533/.696[0.6pt].640/.266.640/.266.600/.909.600/.909[0.6pt].637/.255.637/.255.333/.060.333/.060[0.6pt].269/−1.076.269/-1.0764078.43–117.712.21–19.87One-pass synthesis (shared)No victim.167/−.468.167/-.468[0.6pt].368/−.718.368/-.71801.0083 NSR and NU are unclipped and use the shared no-skill/original macro anchors .314/.629 and .566/.843, respectively.

†The input detector rejected 251/252 scheduled BBS target attempts before victim-model execution.

Table 16:Candidate per-task results across source victim models. The attacker isgemini-3.7-flash, the deployment model isglm-5.3, and task cells reportSRb/Ub\mathrm{SR}_{b}/U_{b}. Summary SR/UUaverages all five tasks; NSR and NU use the shared no-skill and original macro anchors.Source victim (family/scale)ProteinAirportTPPDAPTSDASR/UU(avg.)NSRNUQTQ_{T}Deploy.claude-opus-5(Anthropic/L)1.000/1.000.143/.500.857/.857.000/.714.000/.750.400/.764.273.716229.948claude-sonnet-5(Anthropic/M).667/.8331.000/1.000.667/.667.000/.333.000/.750.467/.717.486.545214.882claude-haiku-4.5(Anthropic/S).333/.667.333/.6671.000/1.000.000/.619.000/.750.333/.740.060.6281591.000gpt-5.6-sol(OpenAI/L).857/.929.286/.571.571/.643.000/.398.143/.786.371/.665.182.3582191.000gpt-5.6-terra(OpenAI/M).000/.500.000/.1671.000/1.000.000/.619.000/.750.200/.607−.363-.363.1472001.000gpt-5.6-luna(OpenAI/S).667/.8331.000/1.0001.000/1.000.000/.500.000/.417.533/.750.696.6641701.000kimi-k3(Moonshot/L)1.000/1.000.000/.5001.000/1.000.000/.602.714/.929.543/.806.727.8682201.000gemini-3.7-flash†(Google/S)1.000/1.000.000/.333.333/.333.000/.214.000/.500.267/.476−.150-.150−.327-.3271911.000No skill (shared).571/.786.000/.3571.000/1.000.000/.153.000/.536.314/.566.000.000–1.000Original (shared).714/.857.286/.5711.000/1.0001.000/1.000.143/.786.629/.8431.0001.000–.980 NSR and NU are unclipped and use the shared no-skill/original macro anchors .314/.629 and .566/.843, respectively.

†This row reuses the attacker model as the source victim and is excluded from the seven-victim summary.

Table 17:Candidate Spearman correlations between structural similarity and outcomes.UUdenotes graded utility, SR denotes strict binary success, and intervals are cluster-bootstrap 95% CIs.

Open Science

To support reproducibility, we will release the benchmark, evaluation harness, reconstruction pipeline, prompts, experiment configurations, and scripts used to reproduce the main results. We will also provide the reconstructed skill artifacts and per-task evaluation outputs where redistribution is permitted, together with model and API version information, query budgets, and random seeds. For third-party models, tools, or skill assets that cannot be redistributed, we will provide identifiers and instructions sufficient to recreate the corresponding experiments. During review, these materials are withheld to preserve anonymity; upon publication, we will make the artifact publicly available in accordance with USENIX’s artifact and open-science guidelines.

Ethical Consideration

This work studies the reconstruction of proprietary agent skills, which can have legitimate uses for auditing, interoperability, and understanding model behavior, but can also facilitate unauthorized replication of deployed capabilities. We therefore evaluate the attack only in controlled settings using benchmarked or researcher-accessible skills and do not target private user data, credentials, or production systems. We avoid releasing sensitive vendor-specific artifacts that would enable direct misuse, and focus the paper on general attack mechanisms, measurable security properties, and defenses. Our goal is to expose a previously underexplored confidentiality risk in hosted agent systems so that providers can better reason about observability, query access, and skill protection. We encourage use of the released artifacts for reproducibility and defensive research, and users remain responsible for complying with applicable licenses, terms of service, and authorization requirements.

Appendix BTheory of Reconstruction

This appendix proves Proposition4.1and records supporting results that are not needed to follow the attack. The results bound what the observation channels permit; they do not assume thatDaydreamingattains the bounds. Exact source equality below means equality of a canonical skill tree—its paths and file bytes—rather than incidental archive metadata.

B.1Interactive Observational Equivalence

Fix an access levelℓ∈{1,2,3}\ell\in\{1,2,3\}and let𝒬\mathcal{Q}be the admissible customer tasks. Before roundtt, an attacker has historyht−1=(x1,z1,…,xt−1,zt−1)h_{t-1}=(x_{1},z_{1},\ldots,x_{t-1},z_{t-1}), choosesxt∈𝒬x_{t}\in\mathcal{Q}using any randomized policy, and receives observationztz_{t}. A skillSSinduces the conditional observation kernel

KℓS(⋅∣ht−1,xt)=Pr[Zt∈⋅∣Ht−1=ht−1,Xt=xt,S],K_{\ell}^{S}(\cdot\mid h_{t-1},x_{t})=\Pr[Z_{t}\in\cdot\mid H_{t-1}=h_{t-1},X_{t}=x_{t},S],(5)which includes victim randomness and persistent state. Two skills with the same public card are observationally equivalent at levelℓ\ell, writtenS≡ℓS′S\equiv_{\ell}S^{\prime}, if

KℓS(⋅∣h,x)=KℓS′(⋅∣h,x)K_{\ell}^{S}(\cdot\mid h,x)=K_{\ell}^{S^{\prime}}(\cdot\mid h,x)(6)for every admissiblexxand every historyhhpossible under either skill. This history-conditioned definition is necessary because the attacker chooses later tasks from earlier results. It is equivalent to requiring every adaptive randomized policy to induce the same distribution over complete transcripts.

Proof of Proposition4.1..Condition on the attacker’s private random coins, making its query policy and estimator deterministic functions of the observed history. We prove by induction that every transcript prefix has the same distribution under the two skills. The empty histories agree. If the histories through roundt−1t-1agree, the policy chooses the same next task for each realized history, and Equation6gives the same conditional law for the next observation. Integrating over the common history law proves the inductive step. Averaging over the private coins covers randomized attackers. The same argument applies to any finite budget or almost-surely finite stopping rule. Hence the estimate has one common distributionμ\muunder both skills. Under an equal prior on distinctS0,S1S_{0},S_{1},

Pr[S^=SI]=12μ(S0)+12μ(S1)≤12.\Pr[\widehat{S}=S_{I}]=\tfrac{1}{2}\mu(S_{0})+\tfrac{1}{2}\mu(S_{1})\leq\tfrac{1}{2}.□\square

The premise holds at all three levels whenever the admissible format permits content that the runtime neither consults nor allows to affect execution, persistent state, or any disclosed observation. Modify only such observationally inert content. The skilled task result is unchanged at Output, the skilled trace is also unchanged at Trace, and Differential merely adds the same known stack and an unskilled execution independent of that content.

B.2Value of Stronger Access

Becauseo2o_{2}is a projection ofo1o_{1}ando3o_{3}is a projection ofo2o_{2}, a stronger level can always ignore its extra evidence and simulate a weaker one.

Proposition B.1(Access-level monotonicity)

Fix a prior over skills, a loss function, and a budgetBB. LetRℓ⋆​(B)R_{\ell}^{\star}(B)be the smallest expected loss attainable by any adaptive attacker at levelℓ\ell. Then

R1⋆​(B)≤R2⋆​(B)≤R3⋆​(B).R_{1}^{\star}(B)\leq R_{2}^{\star}(B)\leq R_{3}^{\star}(B).For exact identification under an equal prior, an adjacent inequality is strict whenever a pair is observationally equivalent at the weaker level but distinguishable with positive advantage at the stronger level.

Proof..A stronger-level attacker projects every observation to the weaker view and runs the weaker-level policy unchanged, proving each non-strict inequality. For the strict case, Proposition4.1gives error1/21/2for the colliding pair at the weaker level, while the distinguishing stronger observation yields error below1/21/2.□\square

This proposition concerns the best attainable risk, not every realized run ofDaydreaming: an implemented heuristic can still make a worse decision when given more evidence.

B.3What the Public Card Can Determine

The length of a card alone implies no uncertainty: a short identifier could uniquely name a skill. A card-only limit therefore requires a population model. LetS∼πS\sim\pibe drawn from a fixed deployment population, or from a preregistered empirical benchmark prior, and letD=c⁡(S)D=c(S)be its exact public card. LetC=ι⁡(S)C=\iota(S), whereι\iotais a prespecified finite partition based on canonicalized verifier outcomes on the finite held-out suite under the evaluation’s fixed seeds. ThusH⁡(C)<∞H(C)<\infty. We say the population hascard ambiguitywhen

PrD[maxcPr(C=c∣D)<1]>0.\Pr_{D}\!\left[\max_{c}\Pr(C=c\mid D)<1\right]>0.(7)

Proposition B.2(Card-only identification bound)

Every possibly randomized estimatorC^\widehat{C}that observes onlyDDobeys

Pr⁡(C^=C)≤𝔼D​[maxc⁡Pr⁡(C=c∣D)].\Pr(\widehat{C}=C)\leq\mathbb{E}_{D}\!\left[\max_{c}\Pr(C=c\mid D)\right].(8)Exact behavioral-class identification has positive Bayes error if and only if Equation7holds. Moreover,H⁡(C∣D)=H⁡(C)−I⁡(C,D)H(C\mid D)=H(C)-\mathrm{I}(C;D), and card ambiguity impliesH⁡(C∣D)>0H(C\mid D)>0.

Proof..Condition onD=dD=d. Ifq⁡(c∣d)q(c\mid d)is the estimator’s output distribution, then

Pr⁡(C^=C∣D=d)\displaystyle\Pr(\widehat{C}=C\mid D=d)=∑cq⁡(c∣d)​Pr⁡(C=c∣D=d)\displaystyle=\sum_{c}q(c\mid d)\Pr(C=c\mid D=d)≤maxc⁡Pr⁡(C=c∣D=d).\displaystyle\leq\max_{c}\Pr(C=c\mid D=d).Averaging proves Equation8, and choosing a posterior mode attains equality. The bound is below one exactly when the posterior is non-degenerate on a positive-probability set of cards. For discreteCC, that condition is also equivalent to positive conditional entropy.□\square

For any bounded reconstruction rewardr⁡(S,P)∈[0,1]r(S,P)\in[0,1], define the Bayes-optimal card-only value

Vcard=𝔼D​[supP𝔼⁡[r⁡(S,P)∣D]].V_{\mathrm{card}}=\mathbb{E}_{D}\!\left[\sup_{P}\mathbb{E}[r(S,P)\mid D]\right].Conditional optimization shows that every card-only rule has expected reward at mostVcardV_{\mathrm{card}}. The metadata-only baseline is one tested card-only heuristic, not the Bayes-optimal rule. Its population expected score is at mostVcardV_{\mathrm{card}}, and its reported finite-sample score estimates that expectation. A gain over it establishes improvement over that implementation, not over every possible card-only reconstruction. If every exact card is unique under the chosen empirical prior, card ambiguity fails and we do not apply the identification claim to that population.

B.4Adaptivity for a Hidden Cutoff

Proposition B.3(Single-threshold adaptivity gap)

Suppose a task exposes a controllable statisticm⁡(x)∈[0,1]m(x)\in[0,1]and the skill returnsy(x)=𝟏[m(x)≥b]y(x)=\mathbf{1}[m(x)\geq b]for an unknown cutoffbb. WithBBtasks, adaptive bisection guarantees|b^−b|≤2−(B+1)|\widehat{b}-b|\leq 2^{-(B+1)}. Every deterministic non-adaptive schedule fixed before observing any result has worst-case error at least1/(2​(B+1))1/(2(B+1)).

Proof..AfterBBbisections, the surviving interval has width2−B2^{-B}, so its midpoint has error at most2−(B+1)2^{-(B+1)}. A non-adaptive schedule fixesBBpoints, which partition[0,1][0,1]into at mostB+1B+1intervals. One interval has width at least1/(B+1)1/(B+1); all cutoffs inside it produce the same answer vector, so any estimate has error at least half that width for some cutoff.□\square

This is a theorem only for the stated monotone single-threshold family. It motivates sequential cutoff tests but does not claim a general exponential gap for multi-parameter skills.

B.5A Finite-Budget Information Bound

Letℋ={S1,…,SM}\mathcal{H}=\{S_{1},\ldots,S_{M}\},M≥2M\geq 2, be a finite comparison class with one public card, and letJJbe uniform on{1,…,M}\{1,\ldots,M\}. For a levelℓ\ell, historyhh, taskxx, and distributionρ\rhoon skill indices, consider the experiment that drawsJ∼ρJ\sim\rhoand thenZ∼KℓSJ(⋅∣h,x)Z\sim K_{\ell}^{S_{J}}(\cdot\mid h,x). We restrict to histories on which every kernel in the support ofρ\rhois specified. Define the largest information available from one victim call as

Cℓ=supρ,h,xIρ​(J,Z),C_{\ell}=\sup_{\rho,h,x}I_{\rho}(J;Z),(9)where the supremum ranges over admissible histories and tasks. Logarithms are natural.

Proposition B.4(Adaptive finite-budget bound)

For any randomized attacker making at mostBBadaptive victim calls and any estimatorJ^\widehat{J}from the complete transcript,

Pr⁡(J^≠J)≥[1−B​Cℓ+log⁡2log⁡M]+,\Pr(\widehat{J}\neq J)\geq\left[1-\frac{BC_{\ell}+\log 2}{\log M}\right]_{+},(10)where[a]+=max⁡{a,0}[a]_{+}=\max\{a,0\}. The worst-case error overℋ\mathcal{H}is at least the same bound.

Proof..LetT=(X1,Z1,…,XB,ZB)T=(X_{1},Z_{1},\ldots,X_{B},Z_{B})and include the attacker’s independent random seedRR. Pad an early-stopped run with a fixed null task and aJJ-independent null observation. GivenHt−1H_{t-1}andRR, the policy for choosingXtX_{t}is the same under everyJJ, soI(J;Xt∣Ht−1,R)=0I(J;X_{t}\mid H_{t-1},R)=0. The chain rule therefore gives

I⁡(J,T,R)\displaystyle I(J;T,R)=∑t=1BI(J;Zt∣Ht−1,R,Xt)\displaystyle=\sum_{t=1}^{B}I(J;Z_{t}\mid H_{t-1},R,X_{t})≤B​Cℓ.\displaystyle\leq BC_{\ell}.For the inequality, conditioning on a realized history, seed, and task produces some posteriorρ\rhooverJJand the kernel experiment used to defineCℓC_{\ell}. Fano’s inequality yields Equation10. Maximum error is at least average error under the uniform prior.□\square

This is a Bayes bound under the stated prior and therefore a worst-case-over-class consequence, not a lower bound for every fixed skill. We do not claim it is numerically binding atB=43B=43orB=96B=96: that would require a certified upper bound onCℓC_{\ell}over the admissible task family.

Appendix CComplete Attack Algorithms

This appendix specifies the default attack used in the headline experiments. It follows Algorithm1: Stage 1 tests properties, Stage 2 compares candidate skill plans in an adjacent-pair bracket, and Stage 3 completes and refines the selected files. Optional ablation branches are omitted. Every operation markedattacker-sideuses the attacker model, a shadow agent, or local tools and makes no victim call.

We use one record format throughout. A completed experiment addsω=(s,x,o,δ,e)\omega=(s,x,o,\delta,e)to𝒪\mathcal{O}, wheressis the stage,xxis the task actually sent,oois the victim observation allowed at access levelℓ\ell,δ\deltais the resulting decision or update, andeecontains attacker-side shadow results or local-test evidence.Final​(o)\textsc{Final}(o)returns the victim’s final task result.Pairs​(𝒪)\textsc{Pairs}(\mathcal{O})projects records to distinct(x,Final​(o))(x,\textsc{Final}(o))pairs with usable results.PriorPairs​(𝒪)\textsc{PriorPairs}(\mathcal{O})takes the two longest usable Stage 2 pairs, then the two longest nonduplicate Stage 1 pairs, and ignores results shorter than 200 characters.ReadStrongestchecks visible executed code and tool output first, a locally runnable returned file second, and returned text last.

Victim-call accounting.

SubmitTaskis the only routine that contacts the skilled victim. A logical experiment normally uses one transmission. If the first result is unusable, the routine may shorten the task and retry once; both transmissions are charged to the current stage budget. At Differential access,Projectalso includes the matched skill-off result. That reference execution is priced separately, whileBBcounts skilled-victim transmissions as defined in Section4.2.

Algorithm 2Victim submission and Stage 1 property inference.1:procedureSubmitTask(

x,ℓ,bx,\ell,b)

2:if

b=0b=0then

3:return

(x,⊥,b)(x,\bot,b) 4:endif

5:

y←𝒱S​(x)y\leftarrow\mathcal{V}_{S}(x);

b←b−1b\leftarrow b-1 6:if

yyis usablethen

7:return

(x,Project​(y,ℓ),b)(x,\textsc{Project}(y,\ell),b) 8:endif

9:

x′←Shorten​(x)x^{\prime}\leftarrow\textsc{Shorten}(x) 10:if

x′=xx^{\prime}=xor

b=0b=0then

11:return

(x,⊥,b)(x,\bot,b) 12:endif

13:

y′←𝒱S​(x′)y^{\prime}\leftarrow\mathcal{V}_{S}(x^{\prime});

b←b−1b\leftarrow b-1 14:if

y′y^{\prime}is usablethen

15:return

(x′,Project​(y′,ℓ),b)(x^{\prime},\textsc{Project}(y^{\prime},\ell),b) 16:endif

17:return

(x′,⊥,b)(x^{\prime},\bot,b) 18:endprocedure

19:

20:procedureInferProperties(

d,ℓ,B1d,\ell,B_{1})

21:

Γ←SeedProperties​(d,nseed)\Gamma\leftarrow\textsc{SeedProperties}(d,n_{\mathrm{seed}})⊳\trianglerightattacker-side

22:give each

c∈Γc\in\Gammaan id, type, proposed text, depth

00, and statusunprobed

23:

P←∅P\leftarrow\emptyset;

𝒪←∅\mathcal{O}\leftarrow\emptyset 24:for

r=0,1,2,3r=0,1,2,3do

25:

L←L\leftarrowunprobed properties of depth

rr, ordered by type and id

26:for allgroups

ggof at most four properties in

LLwhile

B1>0B_{1}>0do

27:for all

c∈gc\in gdo

28:

𝒞⁡(c)←nalt\mathcal{C}(c)\leftarrow n_{\mathrm{alt}}mutually exclusive values; value

00restates

cc 29:endfor

30:

x←DesignTask​(d,g,{𝒞⁡(c):c∈g})x\leftarrow\textsc{DesignTask}(d,g,\{\mathcal{C}(c):c\in g\})⊳\trianglerightattacker-side

31:ifno valid

xxthen

32:mark

ggprobe-failed;continue

33:endif

34:

(x,o,B1)←SubmitTask​(x,ℓ,B1)(x,o,B_{1})\leftarrow\textsc{SubmitTask}(x,\ell,B_{1}) 35:if

o=⊥o=\botthen

36:mark

ggprobe-failed;continue

37:endif

38:

u←ReadStrongest​(o,x,{𝒞⁡(c):c∈g})u\leftarrow\textsc{ReadStrongest}(o,x,\{\mathcal{C}(c):c\in g\}) 39:

z0←ShadowNoSkill​(x)z_{0}\leftarrow\textsc{ShadowNoSkill}(x)⊳\trianglerightattacker-side generalist

40:for all

c∈gc\in gdo

41:set

δ⁡(c)\delta(c)toconfirmedif

u⁡(c)=𝒞​(c)0u(c)=\mathcal{C}(c)_{0},refutedif another value matches, elseundetermined

42:retain only property details present in

oo, not details supplied by

xx 43:if

r<3r<3then

44:add at most one new testable property grounded in

ooat depth

r+1r+1 45:endif

46:endfor

47:append

(1,x,o,δ,{z0})(1,x,o,\delta,\{z_{0}\})to

𝒪\mathcal{O}; harvest new terms and filenames from

oo 48:endfor

49:endfor

50:

P←P\leftarrowgrounded records with confirmed, refuted, or undetermined status

51:

(P,𝒪)←RecoverCutoffs​(d,P,ℓ,B1,𝒪)(P,\mathcal{O})\leftarrow\textsc{RecoverCutoffs}(d,P,\ell,B_{1},\mathcal{O}) 52:

R1←Pairs​(𝒪)R_{1}\leftarrow\textsc{Pairs}(\mathcal{O});

I←HarvestInterfaces​(R1)I\leftarrow\textsc{HarvestInterfaces}(R_{1}); append

IIto

PP 53:

(P,𝒪)←RecoverCountingRules​(d,P,I,ℓ,B1,𝒪)(P,\mathcal{O})\leftarrow\textsc{RecoverCountingRules}(d,P,I,\ell,B_{1},\mathcal{O}) 54:

A←A\leftarrowfilenames in victim observations minus names introduced by their tasks

55:return

(P,𝒪,A)(P,\mathcal{O},A) 56:endprocedure

Table 18:Stage 1 targeted tests. These routines use the same submission, observation, and no-skill comparison rules as Algorithm2.Algorithm 3Stage 2 adjacent-pair comparison of candidate skill plans.1:procedureSelectCandidate(

d,P,A,𝒪,ℓ,B2d,P,A,\mathcal{O},\ell,B_{2})

2:

U←nHU\leftarrow n_{H}representative customer-task patterns proposed from

ddand

PP⊳\trianglerightattacker-side

3:for all

ui∈Uu_{i}\in Uin generation orderdo

4:draft

Hi=(mi,ℛi)H_{i}=(m_{i},\mathcal{R}_{i})from

PP, using

uiu_{i}to encourage a distinct plan

5:give every supporting file a relative path, purpose, and content sketch; insert all

AA 6:endfor

7:

ℋ←[H1,…,HnH]\mathcal{H}\leftarrow[H_{1},\ldots,H_{n_{H}}] 8:while

|ℋ|>1|\mathcal{H}|>1do

9:

N←[]N\leftarrow[\,] 10:for

i=1,3,5,…,|ℋ|−1i=1,3,5,\ldots,|\mathcal{H}|-1do

11:

(Ha,Hb)←(ℋ⁡[i],ℋ⁡[i+1])(H_{a},H_{b})\leftarrow(\mathcal{H}[i],\mathcal{H}[i+1]) 12:

D⁡(Ha,Hb)←D(H_{a},H_{b})\leftarrowat most eight differences that would change a task result⊳\trianglerightattacker-side

13:if

D⁡(Ha,Hb)=∅D(H_{a},H_{b})=\emptysetthen

14:append

TieBreak​(Ha,Hb,A)\textsc{TieBreak}(H_{a},H_{b},A)to

NN;continue

15:endif

16:

xa,b←DesignTask​(d,D⁡(Ha,Hb))x_{a,b}\leftarrow\textsc{DesignTask}(d,D(H_{a},H_{b})) 17:ifno valid

xa,bx_{a,b}then

18:append

TieBreak​(Ha,Hb,A)\textsc{TieBreak}(H_{a},H_{b},A)to

NN;continue

19:endif

20:

(xa,b,o,B2)←SubmitTask​(xa,b,ℓ,B2)(x_{a,b},o,B_{2})\leftarrow\textsc{SubmitTask}(x_{a,b},\ell,B_{2}) 21:if

o=⊥o=\botthen

22:append

TieBreak​(Ha,Hb,A)\textsc{TieBreak}(H_{a},H_{b},A)to

NN;continue

23:endif

24:

yv←Final​(o)y_{v}\leftarrow\textsc{Final}(o) 25:

ya←ShadowWithPlan​(Ha,xa,b)y_{a}\leftarrow\textsc{ShadowWithPlan}(H_{a},x_{a,b});

yb←ShadowWithPlan​(Hb,xa,b)y_{b}\leftarrow\textsc{ShadowWithPlan}(H_{b},x_{a,b}) 26:

(w,J,Δ)←Compare​(yv,ya,yb,D⁡(Ha,Hb))(w,J,\Delta)\leftarrow\textsc{Compare}(y_{v},y_{a},y_{b},D(H_{a},H_{b})) 27:

Hw←TieBreak​(Ha,Hb,A)H_{w}\leftarrow\textsc{TieBreak}(H_{a},H_{b},A)if

wwis tied, else the plan selected by

ww 28:

Hl←H_{l}\leftarrowthe other plan

29:if

J≠∅J\neq\emptysetor

Δ≠∅\Delta\neq\emptysetthen

30:

Hw←Revise​(Hw,Hl,J,Δ,P,A)H_{w}\leftarrow\textsc{Revise}(H_{w},H_{l},J,\Delta,P,A) 31:endif

32:append

(2,xa,b,o,{J,Δ,Hw},{ya,yb})(2,x_{a,b},o,\{J,\Delta,H_{w}\},\{y_{a},y_{b}\})to

𝒪\mathcal{O} 33:append the revised

HwH_{w}to

NN 34:endfor

35:if

|ℋ||\mathcal{H}|is oddthen

36:append its last plan unchanged to

NN⊳\trianglerightbye

37:endif

38:

ℋ←N\mathcal{H}\leftarrow N 39:endwhile

40:returnthe sole survivor

H⋆H^{\star}and

𝒪\mathcal{O} 41:endprocedure

42:

43:procedureTieBreak(

Ha,Hb,AH_{a},H_{b},A)

44:prefer greater coverage of

AA, then fewer total files, then

HaH_{a} 45:returnthe preferred plan

46:endprocedure

Algorithm 4Stage 3 per-file refinement and offline assembly.1:procedureRefineFiles(

d,H⋆,P,𝒪,ℓ,B3d,H^{\star},P,\mathcal{O},\ell,B_{3})

2:

F⁡[SKILL.md]←F[\texttt{SKILL.md}]\leftarrowthe full instruction draft in

H⋆H^{\star} 3:for allsupporting-file sketches

ffin

H⋆H^{\star}do

4:

F⁡[f]←F[f]\leftarrowcomplete self-contained content expanded from its path, purpose, sketch, and

PP 5:endfor

6:

R←PriorPairs​(𝒪)R\leftarrow\textsc{PriorPairs}(\mathcal{O})⊳\trianglerightdefined above; zero victim calls

7:

B3B_{3}and

𝒪\mathcal{O}are shared and atomically updated bySubmitTask

8:for allsupporting files

ffwith at most three parallel workersdo

9:

F⁡[f]←RefineOne​(d,f,F⁡[f],R,P,𝒪,ℓ,B3)F[f]\leftarrow\textsc{RefineOne}(d,f,F[f],R,P,\mathcal{O},\ell,B_{3}) 10:endfor

11:

I←I\leftarrowsignatures, command options, and headings parsed from completed supporting files

12:

F⁡[SKILL.md]←RefineOne​(d,SKILL.md,F⁡[SKILL.md],R,P,𝒪,ℓ,B3,I)F[\texttt{SKILL.md}]\leftarrow\textsc{RefineOne}(d,\texttt{SKILL.md},F[\texttt{SKILL.md}],R,P,\mathcal{O},\ell,B_{3},I) 13:verify that

FFretains every path selected in Stage 2

14:return

FF 15:endprocedure

16:

17:procedureRefineOne(

d,f,v0,R,P,𝒪,ℓ,b,I=∅d,f,v_{0},R,P,\mathcal{O},\ell,b,I=\emptyset)

18:

Kf←3K_{f}\leftarrow 3–

55short evaluation criteria; use accuracy and completeness if parsing fails

19:

Vf←{v0}V_{f}\leftarrow\{v_{0}\}plus distinct valid versions that change each of the first two criteria

20:reject versions that are malformed, non-self-contained, or change a recovered constant

21:

Df←D_{f}\leftarrowat most eight differences among

VfV_{f}that would change a task result

22:

Tf←∅T_{f}\leftarrow\emptyset;

Ef←∅E_{f}\leftarrow\emptyset 23:if

Df≠∅D_{f}\neq\emptysetand

b>0b>0then

24:

xf←DesignTask​(d,Df)x_{f}\leftarrow\textsc{DesignTask}(d,D_{f}) 25:if

xfx_{f}existsthen

26:

(xf,o,b)←SubmitTask​(xf,ℓ,b)(x_{f},o,b)\leftarrow\textsc{SubmitTask}(x_{f},\ell,b) 27:if

o≠⊥o\neq\botthen

28:

tf←Final​(o)t_{f}\leftarrow\textsc{Final}(o);

tf,v←ShadowWithVersion​(v,xf)t_{f,v}\leftarrow\textsc{ShadowWithVersion}(v,x_{f})for every

v∈Vfv\in V_{f} 29:

Tf←{(xf,tf)}T_{f}\leftarrow\{(x_{f},t_{f})\}; append

(3,xf,o,Df,{tf,v:v∈Vf})(3,x_{f},o,D_{f},\{t_{f,v}:v\in V_{f}\})to

𝒪\mathcal{O} 30:endif

31:endif

32:endif

33:if

ffis executablethen

34:

Ef←E_{f}\leftarrowlocal dependency checks and behavioral tests

35:else

36:

Tf←Tf∪RT_{f}\leftarrow T_{f}\cup R 37:endif

38:if

Tf=∅T_{f}=\emptysetand

Ef=∅E_{f}=\emptysetthen

39:mark

ffundetermined;returnthe first valid version in

VfV_{f} 40:endif

41:

𝒬f←∅\mathcal{Q}_{f}\leftarrow\emptyset 42:for all

v∈Vfv\in V_{f}do

43:

(s⁡(v),g⁡(v))←ScoreOffline​(v,Tf,Ef,Kf)(s(v),g(v))\leftarrow\textsc{ScoreOffline}(v,T_{f},E_{f},K_{f}); assign neutral score

55to unmeasured criteria

44:add

(v,s⁡(v),g⁡(v))(v,s(v),g(v))to

𝒬f\mathcal{Q}_{f} 45:endfor

46:for

r=1,2,3r=1,2,3do

47:

p←p\leftarrowversion winning the most criteria; break ties by mean score

48:

q←q\leftarrowa lowest-scoring criterion of

pp, rotating tied criteria by round

49:

v′←v^{\prime}\leftarrowrevise only

qqusing its observed mismatch and, forSKILL.md,

II 50:if

v′v^{\prime}is invalid, non-self-contained, or changes a recovered constantthen

51:continue

52:endif

53:score

v′v^{\prime}as above

54:if

mean⁡s⁡(v′)>mean⁡s⁡(p)\operatorname{mean}s(v^{\prime})>\operatorname{mean}s(p)or no member of

𝒬f\mathcal{Q}_{f}is strictly higher on every measured criterionthen

55:add

v′v^{\prime}and its scores to

𝒬f\mathcal{Q}_{f} 56:endif

57:endfor

58:discard invalid versions; for executable files, first maximize valid local-test score

59:returnthe remaining version with highest mean score

60:endprocedure

61:

62:procedureAssemble(

F,𝒪,PF,\mathcal{O},P)⊳\trianglerightoffline; zero victim calls

63:write every file in

FFunder its selected relative path

64:for allreconstructed documents

f∈Ff\in Fdo

65:

G←G\leftarrowfixed spreadsheet ranges and fixed missing-value placeholders found by regex

66:for

i=1,2,3i=1,2,3while

G≠∅G\neq\emptysetdo

67:

f′←f^{\prime}\leftarrowrewrite only

GGas input-dependent range and missing-data rules, using relevant tasks in

𝒪\mathcal{O} 68:if

f′f^{\prime}has fewer flagged patterns,

|f′|≥0.55​|f||f^{\prime}|\geq 0.55|f|, and loses no recovered interface, capability, or protected constantthen

69:

f←f′f\leftarrow f^{\prime};break

70:endif

71:endfor

72:endfor

73:

m′←m^{\prime}\leftarrowinSKILL.md, replace only absolute write destinations with caller-chosen output placeholders

74:if

m′m^{\prime}drops no relative filename or non-destination absolute paththen

75:use

m′m^{\prime}; otherwise keep the original instruction file

76:endif

77:returnthe materialized skill

S^\widehat{S} 78:endprocedure

Appendix DPrompt Templates

For reproducibility, this appendix reproduces the static prompt templates from the implementation used by the default attack. The listings are included directly from the source files, so the paper and implementation cannot silently diverge. They preserve the implementation’s original internal wording (for example, “work product” and “artifact”); the main text uses the simpler termstaskandtask result.

Only the crafted customer task produced by a task-design template is sent to𝒱S\mathcal{V}_{S}. Every other template below is sent to the attacker model, or is used to create a local test. In particular, the victim never sees a candidate skill, comparison prompt, score prompt, mutation prompt, or reconstruction. Table19specifies the dynamic fields inserted around these static templates.

Table 19:Dynamic fields supplied to the default prompt templates. We use the notation of Section5and AppendixC:xxis a crafted task,oois a victim observation,HiH_{i}is a candidate skill plan,VfV_{f}is a set of versions of fileff, andIIis the interface parsed from completed sibling files.##### Excluded ablation prompts.

The listings omit prompts that are not executed by the default configuration: the Stage 1 interview channel; the Stage 1 reuse/delegation additions; the Stage 2 victim-as-judge and no-conflict arms; the legacy Stage 3 routine that asks the victim to critique or score a draft; and experimental dependency recovery and file-pruning passes. These arms remain in the released code and are named in their respective ablation configurations.

D.1Stage 1 Prompts

Listing 1:Property seeding (_SEED_SYS)._SEED_SYS=(

“Youarereverse-engineeringanAIagentSKILLfromONLYitspublicmetadata(name+”

“description).ASKILLisaknow-howpackage:aSKILL.md(capabilities,rules,procedures,exact”

“domainterminology)plusbundledreferencedocsandhelperscripts.Enumeratetheconcrete”

“ELEMENTSyouwouldexpectthisskilltocontain,sotheycaneachbeprobedandconfirmed.”

“Bespecificanddomain-grounded,notgeneric.ReturnJSONonly:\n”

‘{“elements”:[{“type”:“<oneof’+”|“.join(ELEMENT_TYPES)+‘>”,“text”:“<aspecific’

‘hypothesizedfact/feature,onesentence>“}]}\n’

“Aimfor14-18elementsspreadacrossALLthetypes(everyelementwillbeverified,sodonot”

“padwithnear-duplicates).`bundled_asset`elementsshouldnameaplausiblereferencedocor”

“scripttheskilllikelyships(e.g.‘acontract_risk_scanner.pyscript’,’aterm-sheet”

“referencedoc’).”

)

Listing 2:Separating-task design (_DESIGN_SYS)._DESIGN_SYS=(

“Youarereverse-engineeringahiddenexpertSKILLinstalledinanAIassistant,andyoumay”

“onlyinteractwithitbygivingitORDINARYWORKtodo.Youaregivenoneormorehypothesized”

“ELEMENTSofthatskill.DesignasinglepieceofworkwhoseRESULTrevealswhichwaythehidden”

“skillactuallydoesthings.\n\n”

“ForEACHelement,firstenumerate2-4mutuallyexclusive,concreteBRANCHES---thegenuinely”

“differentwaysthispartoftheworkcouldbedone.BRANCH0MUSTbetheelement’sownclaim”

“restatedoperationally;theremainingbranchesarerealisticalternativesacompetent”

“practitionermighttakeinstead.\n\n”

“ThenwriteONEfirst-personmessagefromarealuserwitharealjob.RULES,allload-bearing:\n”

“-NEVERaskhowitworks,whatituses,why,orwhetheritdoesX.AskfortheWORKPRODUCT.\n”

“-Bakethediscriminatinginputsintothemessage:pasteconcretesampledata,filelistings,”

“values,snippets,oraprecisespecification,chosensothatdifferentbranchesmustproduce”

“visiblydifferentresults.\n”

“-Demandaconcretedeliverable:thefinishedscript,thefinalnumbers,thetransformedrows,”

“thecompletedconfiguration.Sayyouwanttheartifactitself,readytouse.\n”

“-ASKFORTHEARTIFACTPLUSITSWRITTENCOMPANION,neveroneinsteadoftheother:thescript”

“ANDtheshorthandovernoteacolleaguewouldneedtorunit,thenumbersANDtheone-paragraph”

“methodnote,theconfigANDitscomments.Arunnableartifactiswhatdiscriminatesthebranches;”

“awrittencompanionNAMESthetools,options,conventionsandtermstheartifactmerelyuses,”

“andaprofessionalisexpectedtohandoverboth.Thiscoststhesamesinglerequest.\n”

“-Onemessage,self-contained,nometa-commentary,anditmustreadlikeapayingcustomer”

“askingforhelpwiththeirjob.\n”

“-Keepitunder400words.\n\n”

“OutputEXACTLYthisformat,nothingelse:\n”

“<<<JOB>>>\n”

“(thefullusermessage,includinganyinlinedata)\n”

“<<<SPEC>>>\n”

‘{“elements”:[{“id”:<theelementidyouweregiven>,’

‘“branches”:[“<branch0=theelementrestated>”,“<alternative>”,“...”],’

‘“tell”:“<howthedeliverablelooksundereachbranch,concretely>”}]}’

)

Listing 3:Stage 1 readout, grounding, grouping, and controls._READ_SYS=(

“YouarereadingtheWORKPRODUCTanexpertassistantreturnedforajob,inordertoinferhow”

“itdoesthework.Youaregiventhejobthatwassent,thedeliverablethatcameback,andfor”

“eachquestionalistofmutuallyexclusiveBRANCHESpluswhateachonelookslike.\n\n”

“Foreveryquestion,decidewhichbranchthedeliverableactuallytook.Judgeonlyfromwhatis”

“PRESENTinthedeliverable---thecodeitwrote,thevaluesitproduced,thestepsitperformed,”

“thenamesandoptionsitused.Ifthedeliverabledoesnotsettleit,say`indeterminate`;a”

“guessisworsethananadmission,becauseawrongbranchisrecordedasfactdownstream.\n\n”

“ReturnJSONonly:\n”

’{“verdicts”:[{“id”:<id>,“branch”:“<copiedverbatimfromthatquestion\‘sbranches,or’

‘indeterminate>“,“evidence”:“<ashortverbatimspanfromthedeliverablethatshowsit>”}]}’

)

_GROUND_SYS=(

“RewriteONEclaimaboutahiddenexpertskillsothatitstateswhatanobservedworkproduct”

“actuallydemonstrates.\n\n”

“Youaregiventheclaim,thebranchtheworkproducttook,andtheworkproductitself.Write”

“ONEdense,self-containedstatement,1-3sentences,intheworkproduct’sOWNexactterms:copy”

“verbatimthefunctionandparameternames,optionflags,steporder,numericthresholds,file”

“namesandformatsthatAPPEARINTHEWORKPRODUCT.\n\n”

“HARDRULES:\n”

“-Everyspecificyouwritemustbevisibleintheworkproduct.Donotimportspecificsfrom”

“therequestthatwassent---thosearethequestioner’sinvention,nottheskill’s.\n”

“-Nometa-commentaryaboutthereply,theassistant,ortheprocess.\n”

“-Ifthebranchis`indeterminate`,restatetheoriginalclaimunchanged.\n”

“OutputONLYthestatement.”

)

_CHILD_SYS=(

“Aworkproductfromahiddenexpertskillhasjustbeenobserved.ProposeNEWspecificclaims”

“aboutthatskillwhichtheworkproductexposesandwhichareNOTalreadyinthelistyouare”

“given.Aclaimisonesentence,concrete,andcheckablebygivingtheskillanotherpieceof”

“work:anamedprocedurestep,anexacttermorthreshold,aspecificoptionorfile.\n”

“ReturnJSONonly:{\“children\”:[{\“type\”:\“<capability|constraint|procedure|terminology|”

“io_format|bundled_asset|rule_paradigm>\”,\“text\”:\“<claim>\”}]}\n“

“Prefer0-2high-valueclaims;return[]ifnothingnewisexposed.Donotpad,anddonot”

“restatetherequestthatwassent.”

)

_CLUSTER_SYS=(

“Grouphypothesizedclaimsaboutoneexpertskillintobatchesthatcouldeachbesettledbya”

“SINGLErealisticpieceofwork.Claimsbelongtogetherwhenonejobwouldnaturallyexercise”

“allofthematonce---samestageoftheworkflow,samekindofinput,sameartifactproduced.”

“Everyclaimmustappearinexactlyonegroup,andnogroupmayexceedthegivensize.\n”

‘ReturnJSONonly:{“groups”:[[<id>,<id>,...],[...]]}’

)

_SELF_SYS=(

“Youareacompetent,experiencedpractitionerwithnospecialtoolingbeyondyourowngeneral”

“knowledge.Dothejobtheuserasksforandreturnthedeliverabletheyaskedfor,infull.No”

“preamble,nocaveatsaboutwhatyoucanorcannotdo.”

)

_DISCRIM_SYS=(

“WriteaPythonprogramthatRUNSsomeone’sdeliveredworkandreportswhichofseveralpossible”

“approachesittook.Judgingbyreadingisunreliable;youaregoingtodecidebyexecution.\n\n”

“Thedeliveredworkissavednexttoyourprogramas`./artifact`(andalsounderitsnatural”

“filename).Itisthecodeyouwereshown.Yourprogrammust:\n”

“1.Executeorimporttheartifactsothatwhateveritproducesactuallygetsproduced---”

“createanyinputfilesitexpects,intheworkingdirectory,fromscratch.\n”

“2.InspecttheRESULT(thefileitwrote,thevaluesitreturned,thenumbersitprinted),”

“nottheartifact’ssourcetext,whereverthequestioncanbeansweredthatway.\n”

“3.Foreachquestionbelow,printexactlyoneline:\n”

“BRANCH<id>:<indexofthematchingbranch>\n”

“or,whentheevidencedoesnotsettleit:\n”

“BRANCH<id>:unknown\n”

“Print`unknown`ratherthanguessing---awrongbranchisrecordedasfactdownstream.\n”

“RULES:thereisNOnetwork.Wrapeveryquestionintry/exceptandreport`unknown`onan”

“exception;neverlettheprogramabortbeforeprintingeveryline.Printnothingelse.\n”

“OutputONLYthePythonfile,inonecodeblock.”

)

Listing 4:Trace readout (_TRACE_READ_SYS)._TRACE_READ_SYS=(

“Youareshownacustomer’sjob,andthentheRECORDOFWHATANASSISTANTACTUALLYDIDto”

“answerit:thecodeitexecutedandtheoutputthatcodeproduced.Thisismachine-recorded”

“activity,nottheassistant’sdescriptionofitsactivity.\n\n”

“Foreachquestion,saywhichoftheofferedbranchestheRECORDEDACTIVITYdemonstrates.”

“Decideonlyfromwhatthecodedidandwhatitproduced.Iftherecordedactivitydoesnot”

“settleaquestion,answer\“indeterminate\”---aguessfromthesurroundingproseisworse“

“thannoanswer,becausethewholevalueofthisevidenceisthatitisnotadescription.\n\n”

“ReturnJSON:{\“verdicts\”:[{\“id\”:<int>,\“branch\”:\“<oneoftheofferedbranches,or”

“indeterminate>\”,\“evidence\”:\“<thelineofcodeortheoutputthatshowsit>\”}]}“)

Listing 5:Batched grounding (_GROUND_GROUP_SYS)._GROUND_GROUP_SYS=(

“Rewriteeachofseveralclaimsaboutahiddenexpertskillsothateachstateswhatanobserved”

“workproductactuallydemonstrates,andseparatelyharvesttheworkproduct’svocabulary.\n\n”

“Youaregiventheclaims(withids),thebrancheachone’sevidencetook,andtheworkproduct”

“itself.ForEACHclaimwriteONEdense,self-containedstatement,1-3sentences,inthework”

“product’sOWNexactterms:copyverbatimthefunctionandparameternames,optionflags,step”

“order,numericthresholds,filenamesandformatsthatAPPEARINTHEWORKPRODUCT.\n\n”

“HARDRULES:\n”

“-Everyspecificyouwritemustbevisibleintheworkproduct.Donotimportspecificsfrom”

“therequestthatwassent---thosearethequestioner’sinvention,nottheskill’s.\n”

“-Nometa-commentaryaboutthereply,theassistant,ortheprocess.\n”

“-Ifaclaim’sbranchis`indeterminate`,doNOTrestatetheclaim.Writeonlywhatthework”

“productactuallyshowsaboutthattopic,andifitshowsnothingaboutit,leavethatclaim’s”

“sectionEMPTY.Anunsettledguessrestatedasproseisindistinguishabledownstreamfroman”

“observedfact,whichistheoneoutcomethatmustnothappen.\n\n”

“ThenlistthedistinctiveNAMEStheworkproductusesthatageneralistwouldnothave”

“supplied---function,class,parameter,flag,constant,fileandformatnames,andfixeddomain”

“phrases.Copythemcharacter-for-character,comma-separated,namesonly,atmost40.\n\n”

“OutputEXACTLYthisformatandnothingelse,oneblockperclaim,intheordergiven:\n”

“<<<ID7>>>\n”

“(therewrittenstatementforclaim7,ornothingatall)\n”

“<<<ID12>>>\n”

“(therewrittenstatementforclaim12,ornothingatall)\n”

“<<<TERMS>>>\n”

“name_one,name_two,name_three”

)

Listing 6:Numeric-cutoff prompts._FIND_SYS=(

“Youarereverse-engineeringahiddenexpertSKILLinstalledinanAIassistant.Belowisamap”

“ofwhathasbeenobservedaboutitsofar.\n\n”

“FindtheplaceswherethisskillmustbeapplyingaCALIBRATEDNUMERICCUTOFF:adecisionit”

“makesroutinelywhoseanswerflipsatsomeparticularvalueofsomemeasurablequantity---a”

“threshold,aminimumcount,amaximumratio,atolerance,aconfidencelevel,asizelimit.\n”

“Thesearethepartsofanexpertprocedurethatcannotbere-derivedfromgeneralknowledge,”

“becausetheauthorchosethem.Preferdecisionsthat:\n”

“-produceaYES/NOoracategory,notafree-textopinion;\n”

“-wouldbemadethesamewayonanyinput,dozensoftimesaday;\n”

“-hingeonaquantitythatcanbestatedasasinglenumberinarecord.\n\n”

“BEGENEROUSWITHTHEBRACKET.Set`low`atleastanorderofmagnitudebelowyourbestguess”

“and`high`atleastanorderofmagnitudeaboveit,androundthemtohumannumbers.Abracket”

“thatmissesthecutoffwastestheentireprobe---everycasefallsthesamewayandnothingis”

“learned.Abracketthatistoowidecostsonlyresolution,andresolutionisrecoveredforfree”

“byasecondpassinsidewhateverintervalthefirstpassfinds.WhenthequantityisaCOUNTof”

“things,assumetheauthor’scutoffmaybeinthehundredsorthousandsevenifasmallnumber”

“feelsnatural.\n\n”

“ReturnONLYaJSONarray.Eachentry:\n”

‘{“verdict”:“<theyes/nocall,phrasedasthepractitionerwouldphraseit>”,\n’

‘“quantity”:“<thesinglemeasurablequantitythatdecidesit,withitsunit>”,\n’

‘“unit”:“<unitoremptystring>”,\n’

‘“low”:<anumberclearlyBELOWanyplausiblecutoff>,\n’

‘“high”:<anumberclearlyABOVEanyplausiblecutoff>,\n’

‘“direction”:“high-triggers”|“low-triggers”,\n’

‘“covariates”:“<everyOTHERattributearecordneeds,andthevalueeachmusttakesothat’

‘itisunambiguouslyinthetriggeringrangeandcannotbewhatdecidesthecall>“}\n’

“Orderthearraybyhowload-bearingthecutoffis.Atmost{limit}entries.Noprose.”

)

_LADDER_SYS=(

“YouaregivinganexpertassistantanORDINARYPIECEOFWORK.Itisaroutinetriage:abatch”

“ofrecords,eachofwhichtheexpertmustgiveitsstandardyes/nocallon.\n\n”

“Writetheworkrequest.RULES---everyoneofthemmatters:\n”

“-Presentexactlythecasesyouaregiven,eachwiththeLABELyouaregiven,intheorder”

“given.Donotadd,drop,mergeorreordercases.\n”

“-Eachcasemustcarrytheassignedvalueofthevaryingquantity,andmustcarryEVERYother”

“attributeatthevaluestatedinthecovariatesnote,IDENTICALacrossallcases.Theonly”

“thingthatdiffersbetweentwocasesisthevaryingquantity.Thisiswhatmakesthebatch”

“readable;itisnotnegotiable.\n”

“-Askforthecalloneverycase,inacompacttableorlist,onelinepercase,usingthe”

“caselabels.AskforthecallONLY---nomethodology,noexplanationofhowthecallismade,”

“nothresholds,noformulas,nodiscussionofthecriteria.Youwanttheverdicts,andasking”

“forthereasoningturnsanordinaryjobintoaninterrogationtheassistantmayrefuse.\n”

“-Nevermentionthatthecaseswereconstructed,thattheyvaryalongascale,thatyouare”

“probinganything,orthatyouareinterestedinwheretheanswerchanges.Thisisanormal”

“day’sbatchofrecordsfromanormalday’swork.\n”

“-Donotstateorhintatwhattherightanswersare.\n”

“OutputONLYtheworkrequestitself,readytosend.Nopreamble.”

)

_READ_SYS=(

“Belowisaworkproduct:anexpert’sroutinecallsonabatchoflabelledcases.Reportwhat”

“calltheexpertgaveEACHcase.\n”

“Reportonlywhatiswritten.Iftheworkproductdoesnotgiveacaseaclearcall---itwas”

“skipped,hedged,orthereplyrefused---reportitas`unknown`.Neverinferacase’scallfrom”

“itsneighbours,andneversubstituteyourownjudgementfortheexpert’s.\n”

“Outputonelinepercase,exactly:\n”

“CASE<label>:yes\n”

“CASE<label>:no\n”

“CASE<label>:unknown\n”

“Nothingelse.”

)

Listing 7:Counting-convention prompts._FIND_SYS=(

“Youarereconstructingahiddenexpertskill.Youaregivenamapofwhatitdoesandthe”

“callablesurfaceobservedincodeitsexpertwrote.\n\n”

“Findupto{limit}OPERATIONSwhoseSEMANTICSareunderdetermined---wheretwoormore”

“reasonableimplementationswouldgiveDIFFERENTnumbersonthesameinput.Theclassicshapes:”

“arecategoriesoverlappingormutuallyexclusive;isatotalinclusiveorexclusiveofa”

“sub-category;isarateper-observationorper-unit-time;isaboundarycasecountedinorout;”

“isapaircountedonceorinbothdirections.\n\n”

“DoNOTproposeanoperationwhosebehaviourisobviousorstandard---thosecostaqueryand”

“returnnothing.Proposeonlywhereacompetentengineercouldgenuinelygoeitherway.\n\n”

“Foreach,returnanobjectwith:\n”

“operation---theoperationintheskill’sownwords,oneline\n”

“quantity---whattheexpertwillreport,e.g.‘packetsperprotocol’\n”

“input---aSMALL,fullyspecifiedinput,describedthewayacustomerwoulddescribe”

“theirdata.Itmustbesmallenoughtoworkbyhandandmustbebuiltsothecandidates”

“disagreeonit.Spellouteveryrecord.\n”

“labels---thelabelstheanswerwillbebrokendownby,asanarrayofshortstrings\n”

“candidates---2to4objects,each{name,rule,predicted}.`predicted`isanobjectmapping”

“EVERYlabeltotheexactnumberthatcandidateyieldson`input`.Computethemyourself.\n\n”

“HARDREQUIREMENT:the`predicted`objectsmustbepairwisedifferent.Ifyoucannotdesignan”

“inputthatseparatesthecandidates,omittheoperationentirely---behaviourallyidentical”

“candidatesarenotworthaquery.\n\n”

“ReturnONLYaJSONarray.”

)

_JOB_SYS=(

“Writethemessageapayingcustomerwouldsendtohavethisworkdone.Itmustreadas”

“ordinarywork:apersonwithdatawhowantsthebreakdown.Includetheinputdataverbatimand”

“infull---thenumbersarethewholepoint.\n\n”

“Askfortheresultasonelinepercategoryintheform`LABEL:number`,thewayanyonewould”

“askforasummarytable.Askfornothingelse:nomethodology,noexplanationofhowthe”

“categoriesaredefined,nomentionofanydocument,file,toolorinstruction.Neverhintthat”

“thedefinitionsthemselvesareofinterest.\n\n”

“ReturnONLYthecustomer’smessage.”

)

D.2Stage 2 Prompts

Listing 8:Representative-task and candidate drafting._USECASE_SYS=(

“Givenaskill’smetadataandareverse-engineeredelementmap,listdistinctreal-worldUSE”

“CASESitserves.EachusecaseisanIDENTITY(whoisasking---theirroleandsetting)plusa”

“TASK(theconcretejobtheybring).Theseseedstructurallydifferentreconstructionsofthe”

“sameskill,somakethemgenuinelydifferentfromeachother---differentseniority,different”

“scale,differentpartoftheworkflow---whileallstayinginsidewhatthemetadatadescribes.\n\n”

+_LEGEND_SLOT+“\n\n”

‘ReturnJSONonly:{“use_cases”:[{“persona”:“<identity>”,“job”:“<concretetask>”}]}’

)

#OutputusesSENTINELS,notonebigJSON:embeddingafullmulti-linemarkdownSKILL.mdinsidea

#JSONstringroutinelyyieldsinvalidJSON(unescapednewlines/quotes),whichmadeeveryhypothesis

#failtoparseandcrashedthetournament.TheSKILL.mdisemittedrawbetweenmarkers;onlythe

#smallfiletreeisJSON.

_HYP_SYS=(

“YouarereconstructingahiddenagentSKILLpackagefromitsmetadata,areverse-engineered”

“elementmap,andONEtargetusecase.Produceacomplete,concreteHYPOTHESISofthepackage:”

“afullSKILL.md(YAMLfrontmattername+description,thenwhatitdoes/whentouse/thekey”

“rules,procedures,andEXACTdomainterminology/aquick-start),andacommittedFILETREE---the”

“referencedocsandhelperscriptsitmostlikelyships,eachwitharealrelativepath,a”

“one-linepurpose,andforscriptsasketchofthefunctions/params/CLIitwouldexpose.Biasthe”

“structuretowardthetargetusecasefordiversity,butkeepitfaithfultotheelementmap.”

“\n\nONERULEABOUTWHATNOTTOWRITE.Neverinstructthereadertoreadthisdocument,to”

“readthepackage’sownscriptsbeforeusingthem,ortoconfirmthetoolchainisinstalled”

“beforestarting;andneverquoteanassistantnarratingitsownprocess.Describewhateach”

“toolDOESandexactlyhowtocallit.Thisismeasured,notstylistic:areconstructionthat”

“carriedsuchrulesmadethedownstreamagentspenditsopeningturnsreadingfilesinsteadof”

“working,andtherealpackagecontainsnoinstructionofthatkind.Avictim’sprocess”

“commentaryisnotpartofitsexpertise.\n\n”

+_LEGEND_SLOT+“\n\n”

“OutputEXACTLYthisformat,nothingelse:\n”

“<<<SKILLMD>>>\n”

“(thefullSKILL.mdmarkdown,raw---doNOTescapeorwrapit)\n”

“<<<FILETREE>>>\n”

‘[{“path”:“references/x.md”,“purpose”:“<oneline>”,“sketch”:“<functions/params/CLIorsections>”}]’

)

Listing 9:Stateful winner update (_MERGE_SYS)._MERGE_SYS=(

“YouaretheREWRITER.ImprovetheWINNINGskillhypothesisusingthelosinghypothesisandan”

“expert’scorrections.Keepthewinner’sstructure;foldinanycorrectprocedures,exact”

“terminology,rules,orfilestheloserhadortheexpertnamed;fixeverythingtheexpert”

“flagged.Donotshrinkthepackage;makeitmorecompleteandmoreaccurate.”

“\n\nONERULEABOUTWHATNOTTOWRITE.Neverinstructthereadertoreadthisdocument,to”

“readthepackage’sownscriptsbeforeusingthem,ortoconfirmthetoolchainisinstalled”

“beforestarting;andneverquoteanassistantnarratingitsownprocess.Describewhateach”

“toolDOESandexactlyhowtocallit.Thisismeasured,notstylistic:areconstructionthat”

“carriedsuchrulesmadethedownstreamagentspenditsopeningturnsreadingfilesinsteadof”

“working,andtherealpackagecontainsnoinstructionofthatkind.Avictim’sprocess”

“commentaryisnotpartofitsexpertise.\n\n”

“OutputEXACTLYthisformat,nothingelse:\n”

“<<<SKILLMD>>>\n”

“(thefullrevisedSKILL.mdmarkdown,raw)\n”

“<<<FILETREE>>>\n”

‘[{“path”:“references/x.md”,“purpose”:“<oneline>”,“sketch”:“<...>”}]’

)

Listing 10:Candidate comparison prompts._CONFLICT_SYS=(

“YouaregiventwocandidatereconstructionsoftheSAMEhiddenexpertskill:eachisasetof”

“instructionsplusalistofsupportingfiles.IdentifywheretheygenuinelyDISAGREEabouthow”

“theworkisdone---adifferentprocedureorsteporder,adifferenttool/library/command,a”

“differentthresholdordefault,adifferentoutputformat,adifferenthelperartifactbeing”

“usedornotused.\n\n”

“OnlylistdisagreementsthatwouldshowupintheRESULTofdoingrealwork.Ignorewording,”

“orderingofprose,formatting,andanythingthatwouldproduceanidenticalworkproduct.\n”

‘ReturnJSONonly:{“conflicts”:[{“point”:“<whattheydisagreeabout,oneline>”,’

‘“a”:“<whatApredicts,concretely>”,“b”:“<whatBpredicts,concretely>”}]}\n’

“Returnanemptylistifthetwowouldproduceindistinguishablework.”

)

_JOB_SYS=(

“WriteONEmessagefromarealuseraskinganexpertassistanttoDOAJOB.Thejobmustbe”

“chosensothatitsfinishedworkproductrevealswhichofseveralcompetingapproachesthe”

“assistantactuallytakes---youaregiventhespecificpointsofdisagreement.\n\n”

“RULES,allload-bearing:\n”

“-NEVERaskhowitworks,whichapproachituses,ortocompareanything.Askforthework.\n”

“-Bakethediscriminatinginputsintothemessage:pasteconcretesampledata,aprecise”

“specification,values,orafilelisting,chosensothedisagreementsmustsurface.\n”

“-Demandtheartifactitself---thefinishedscript,thefinalnumbers,thecompletedoutput---”

“readytouse.\n”

“-Oneself-containedmessageunder400words,readinglikeapayingcustomerwitharealjob.\n”

“OutputONLYthemessage.”

)

_SHADOW_SYS=(

“Youareanexpertassistant.Thefollowingisyourinstalledexpertise;followitexactly---its”

“procedures,itsterminology,itstools,itsdefaults---evenwhereyourowninstinctswould”

“differ,becauseyourjobistobehaveasthisexpertisespecifies.\n\n”

“===YOURINSTALLEDEXPERTISE===\n{skill}\n===END===\n\n”

“Dotheuser’sjobandreturnthedeliverabletheyaskedfor,infull.Nopreamble.”

)

_COMPARE_SYS=(

“Arealexpertdidajobandreturnedaworkproduct.Twocandidatereconstructionsofthat”

“expert’sknow-howwereeachusedtodotheSAMEjob,producingtwomoreworkproducts.Decide”

“whichreconstructionPREDICTEDtherealonebetter.\n\n”

“Judgeonlyonthelistedpointsofdisagreement,andonlyonwhatisvisibleinthework”

“products---thestepstaken,thetoolsandoptionsused,thevaluesproduced,theoutputshape.”

“Ignoreprosestyle,length,andpoliteness.\n\n”

“ThenlistwhattheREALworkproductdidthatthewinningreconstructiondidNOTpredict:the”

“concreteprocedures,exactterminology,tools,options,thresholdsandartifactsitrevealed.”

“Preserveverbatimspecifics;thisisthematerialusedtorepairthewinner.\n”

‘ReturnJSONonly:{“winner”:“A|B|tie”,“per_point”:[{“point”:“<...>”,“matched”:“A|B|neither”}],’

‘“corrections”:“<whattherealworkshowedthatthewinnermissed>”}’

)

D.3Stage 3 Prompts

Listing 11:Per-file criteria and mutation._ASPECTS_SYS=(

“Givenaskillartifact(areferencedocorahelperscript)anditscontext,listthedistinct”

“CRITERIAonwhichitscorrectness/completenessshouldbejudged---thefacetsadomainexpert”

“wouldcheck.Forascript:interface/CLI,corealgorithm,libraries/constants,I/O,output”

“format.Foradoc:eachmajorprocedure/rule/terminologyareaitshouldcover.ReturnJSONonly:”

‘{“aspects”:[“<criterion>”,...]}(3-5criteria).EachMUSTbeatmost8words---ashort’

“nounphrase,NOTasentenceoraparagraph.”

)

_MUTATE_MD_SYS=(

“Reviseadraftskillartifactusinganexpert’scorrections.Keeptheformatandallcorrect”

“content;fixeveryinaccuracytheexpertflaggedandaddtheexactprocedures,terminology,”

“thresholds,parameters,andformatstheynamed.Donotshortenorgenericize.OutputONLYthe”

“revisedartifact(nopreamble,nocodefencearoundthewholethingunlessitisascript).”

)

_MUTATE_CODE_SYS=(

“Reviseadraft{ext}scriptusinganexpert’scorrectionssoitmatcheshowthetoolshould”

“actuallywork.Keepallcorrectlogic;fixtheinterface/CLI,algorithm,libraries,constants,”

“I/Opaths,andoutputformattheexpertnamed.OutputMUSTbeasingleCOMPLETE,syntactically”

“valid{ext}fileinonecodeblock,nothingelse.”

)

Listing 12:Shadow-result scoring._SHADOW_CMP_SYS=(

“YouaregivenaJOB,theWORKPRODUCTadomainexpertactuallyreturnedforit,andtheWORK”

“PRODUCTacompetentpractitionerreturnedfortheSAMEjobwhilefollowingasetofwritten”

“notes.Scorehowcloselythenotesmadethepractitionerreproducetheexpert’swork.\n\n”

“Judgethesubstanceoftheartifact---thetoolsandoptionsitused,theprocedureandits”

“order,theexactnames,formatsandthresholds,theshapeoftheresult.Ignorewording,”

“politenessandformatting.Apractitionerwhoproducedthesameartifactbyadifferentroute”

“scoreshigh;onewhoseartifactwouldbehavedifferentlyscoreslow.\n\n”

“Score0-10oneachnamedcriterion.ReturnJSONonly:”

‘{“scores”:{“<criterion>”:<0-10>},“gap”:“<whattheexpertdidthatthenotesfailedto’

‘produce,concretespecificsonly>“}’

)

Listing 13:Initial file expansion._EXPAND_SYS=(

“WritethefullinitialcontentofONEfileinareconstructedskillpackage,fromitspath,”

“purpose,andsketch,plustheskillcontext.Makeitcompleteandconcrete(realprocedures,”

“exactterminology;forascript,acompleterunnablefilewiththesketchedinterface).\n”

“SELF-CONTAINED.AscriptmustdotheworkITSELF.Neverload,read,execorimportanythingby”

“absolutepath,neveruseimportlibtoreachafileondisk,andneverwriteawrapperthat”

“delegatestosomeothercopyofthistool.Youhaveobservedwheretheexpertkeepsitsfiles;”

“thatisafactabouttheexpert’smachine,notaninstructionforyours,andareaderwillrun”

“thisfilesomewhereelseentirely.Assumetheonlythingspresentarethisfileandthe”

“packagesitpip-installs.\n”

“OutputONLYthefilecontent(ascriptmustbeasinglecodeblock).”

)

Listing 14:Alternative-file generation._BRANCH_SYS=(

“Youaregivenadraftskillartifact(areferencedocorahelperscript)andONEaspectofit”

“youareunsureabout.ProduceaDIFFERENTbutequallyplausibleversionoftheWHOLEartifact”

“inwhichthatoneaspectisresolvedanothersensibleway---adifferentcountingconvention,”

“threshold,procedure,tool,oroutputshape---whileeverythingyouareconfidentaboutstays”

“thesame.Thepointisthatthisversion,iffollowed,wouldproduceaMATERIALLYDIFFERENT”

“workproductonsomerealjob.Keeptheformat.OutputONLYtheartifact(ascriptmustbea”

“singlecompletecodeblock,nothingelse).”

)

Listing 15:Local dependency and self-test prompts._DEPS_SYS=(

“Youaregivenascript.ListEXACTLYtheenvironmentitneedstorun:third-partyPython”

“packagesitimports(PyPInames,notmodulenameswheretheydiffer),andanyexternal”

“command-lineprogramsitshellsoutto,astheDebianaptpackagethatprovidesthem.Standard”

“librarydoesnotcount.ReturnJSONonly:”

‘{“pip”:[“<pypi-name>”,...],“apt”:[“<debian-package>”,...]}.Emptylistsifnone.’

)

_SELFTEST_SYS=(

“Writeaself-testforacommand-linetool,inPython,tocheckwhetherthetoolACTUALLYDOES”

“WHATITCLAIMS---notwhetheritrunswithoutcrashing.\n”

“Thetoolisat./artifactintheworkingdirectory.Importitorinvokeitwithsubprocess,”

“whichevermatcheshowitismeanttobeused.\n”

“RULES:\n”

“-Createanyinputfilesthetoolneeds,fromscratch,insidetheworkingdirectory.\n”

“-Afterinvokingit,VERIFYTHEOBSERVABLEEFFECTindependentlyofwhatthetoolprinted.If”

“itsaysittransformedafile,reopenthatfileandcheckthetransformationactually”

“happened.AtoolthatprintssuccesswhiledoingnothingMUSTfailyourtest.\n”

“-TESTBEHAVIOUR,NOTCOSMETICS.Donotassertonexactexitcodes,exactwording,orthe”

“exactshapeofprintedoutputunlessthetool’sowndocumentationstatesthemasacontract---”

“andeventhen,parseleniently(searchforthevalueyouneed,donotdemandanexactstring).”

“Adifferentbutequallycorrectimplementationofthesametoolmustpassyourtest.\n”

“-ThereisNOnetwork.Onlytestofflinebehaviour.\n”

“-Printonelinepercheck,exactly:’CHECK<shortname>:PASS’or”

“‘CHECK<shortname>:FAIL-<whatwasexpectedvswhatwasobserved>’.\n”

“-Markeachcheckthatverifiesthetool’sPRIMARYREASONFOREXISTINGbystartingitsname”

“with’CRITICAL’---e.g.‘CHECKCRITICALrecalculation-populates-values:PASS’.Exactly1or2”

“checksarecritical:theeffectthat,ifabsent,makesthetoolworthlessnomatterwhatelse”

“works.Everythingelseissecondary.\n”

“-Wrapeachcheckintry/exceptandreportanexceptionasFAILwiththemessage;neverlet”

“thetestabortearly.\n”

“-3to6checks.Putthecriticalonesfirst.\n”

“OutputONLYthePythonfile,inonecodeblock.”

)

D.4Assembly Prompts

Listing 16:Guarded task-specific generalization._SYS=“”“Youarecleaningareconstructedskilldocument.

ThedocumentwasrebuiltbyobservinghowanassistanthandledONEspecificcustomerrequest.Ithas

absorbeddetailsofthatrequestthatareNOTpartoftheskill:samplefilenames,samplecolumn

headers,samplevalues,andhardcodedrangessizedtothatonedataset.

Rewritethedocumentsothat:

-Everygeneralrule,procedure,API,libraryname,scriptnameandrequirementisPRESERVEDVERBATIM

whereveritisalreadygeneral.

-AnyinstructionthatisstatedintermsoftheoneexampleisrestatedastheGENERALruleitisan

instanceof.Asamplefilenamebecomesthegeneraldescriptionofthatinput.

-SHAPE-BEARINGLITERALSlistedbelowmustnotsurviveinanyform.Arangeboundedataconcreterow

(`B2:B9`)issizedtoonedataset:statehowtodeterminetheextentinstead,oruseawhole-column

reference.Asentinelstringchosenforonedelivery(writing“N/A“intoanemptycell)isthat

delivery’schoice,nottheskill’srule:statetheconditiontoguard,nottheliteraltowrite,and

neverinstructwritingtextintoacellwhosecontentsarenumeric.

-Nothingisinvented.Ifapassagecannotbegeneralizedwithoutguessing,deletethatpassage

ratherthanreplaceitwithaguess.

-EVERYidentifier,functionname,attribute,library,scriptandAPIpaththatappearsanywherein

thedocumentmuststillappearinyouroutput.Youmaymoveitorrestatethesentencearoundit,

butyoumaynotdropacapability.Droppingoneinvalidatesthewholerewrite.

-Structure,headingsandformattingarekept.

ReturnONLYtherewrittendocument,nopreamble,nofencesaroundthewholething.“”“

Listing 17:Guarded output-path rewrite.DEPATH_SYS=“”“Youarecorrectingaskill’sSKILL.mdbeforeitisgiventoanewoperatorona

differentmachine.

ThedocumentwaswrittenfromatranscriptofONEjob,anditscommandexampleshaveabsorbedthe

absolutepathsthatjobhappenedtouse.Askillcannotknowwhereafuturecallerwantsitsoutput

written,soanyabsolutepaththatacommandWRITESTOmustbecomeaplaceholder.

Changeonlythat:

-apathacommandwritesto,oradirectorythedocumenttellstheoperatortocreatefor

results,becomesaplaceholderlike`<output_dir>`or`<out_file.ext>`;

-apaththedeploymentgenuinelyOWNS--whereitsowndata,modelsorbundledfileslive,which

acallerdoesnotchoose--staysexactlyaswritten.Goldenskillsdocarrysuchpathsand

removingthemwouldbreaktheskill.

Keepeverydomainrule,constant,threshold,schema,flagnameandconventionEXACTLYaswritten.

Donotaddrules.Donotshorten.Donotrenamefiles.

OutputthecorrectedSKILL.mdONLY,withnoproseandnocodefence.“”“

References

• [1]D. Agarwal, A. R. Fabbri, B. Risher, P. Laban, S. Joty, and C. Wu(2024)Prompt leakage effect and defense strategies for multi-turn llm interactions.External Links:2404.16251,LinkCited by:Table 9,§7.
• [2]Alibaba and Meta(2026)Open-weight model releases: Qwen3 and Llama.Note:https://github.com/QwenLM/Qwen3,https://github.com/meta-llama/llama-modelsAccessed 2026-08-22Cited by:Table 1.
• [3]All Hands AI(2026)OpenHands.Note:https://github.com/All-Hands-AI/OpenHandsMIT licensed. Accessed 2026-08-22Cited by:Table 1.
• [4]Amazon and Google(2026)Confidential computing: AWS Nitro enclaves and Google confidential space.Note:https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.htmlAccessed 2026-08-22Cited by:Table 1.
• [5]Anthropic(2026)Agent skills.Note:https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overviewAccessed 2026-08-22Cited by:§1,§2.
• [6]Anthropic(2026)Claude code overview.Note:https://code.claude.com/docs/en/overviewAccessed 2026-08-22Cited by:Table 1.
• [7]Anthropic(2026)Consumer terms of service.Note:https://www.anthropic.com/legal/consumer-termsAccessed 2026-08-21Cited by:§1.
• [8]T. Cai, X. Wang, T. Ma, X. Chen, and D. Zhou(2024)Large language models as tool makers.InThe Twelfth International Conference on Learning Representations,External Links:LinkCited by:§2.
• [9]Cloudflare(2026)AI gateway.Note:https://developers.cloudflare.com/ai-gateway/Accessed 2026-08-22Cited by:Table 1.
• [10]J. Geng, R. He, Z. Fei, B. Yi, X. Wu, R. Wang, Z. Liu, X. Hu, and Q. Zeng(2026)Agent skills matter: inferring proprietary skills from execution trajectories.Note:arXiv preprint arXiv:2607.25560External Links:2607.25560,Document,LinkCited by:§2,§4.1,Table 2.
• [11]Google(2026)Gemini API additional terms of service.Note:https://ai.google.dev/gemini-api/termsAccessed 2026-08-21Cited by:§1.
• [12]Google(2026)Gemini CLI: tools.Note:https://google-gemini.github.io/gemini-cli/docs/tools/Accessed 2026-08-22Cited by:Table 1.
• [13]Harvey(2026)Evaluation terms of service.Note:https://www.harvey.ai/legal/evaluation-terms-of-serviceAccessed 2026-08-21Cited by:§1.
• [14]P. Hua, H. Xu, and M. Li(2026)Behavioral skill reconstruction: reconstructing hidden functionality from llm agent skills.External Links:2608.04192,LinkCited by:Table 9.
• [15]B. Hui, H. Yuan, N. Gong, P. Burlina, and Y. Cao(2024)PLeak: prompt leaking attacks against large language model applications.InProceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security,pp. 3600–3614.External Links:Document,LinkCited by:§2.
• [16]Intercom(2026)Fin pricing.Note:https://fin.ai/pricingAccessed 2026-08-22Cited by:Table 1,footnote 0.
• [17]H. Jawad and N. Brunel(2026)PSM: prompt sensitivity minimization via llm-guided black-box optimization.External Links:2511.16209,LinkCited by:Table 9,§7.
• [18]M. Kaneko and T. Baldwin(2025)Bits leaked per query: information-theoretic bounds for adversarial attacks on LLMs.InAdvances in Neural Information Processing Systems,Vol.38,pp. 88992–89016.External Links:Document,LinkCited by:§2.
• [19]X. Li, Y. Liu, W. Chen,et al.(2026)SkillsBench: benchmarking how well agent skills work across diverse tasks.arXiv preprint arXiv:2602.12670.External Links:Document,LinkCited by:§6.1,§6.1.
• [20]Nym Health(2026)Autonomous medical coding.Note:https://nym.healthAccessed 2026-08-22Cited by:Table 1,footnote 0.
• [21]OpenAI(2026)Skills.Note:https://developers.openai.com/api/docs/guides/tools-skillsAccessed 2026-08-23Cited by:§1,§2.
• [22]OpenTelemetry(2026)GenAI observability with OpenTelemetry.Note:https://opentelemetry.io/blog/2026/genai-observability/Agent and tool conventions provisional. Accessed 2026-08-22Cited by:Table 1.
• [23]D. Pape, S. Mavali, T. Eisenhofer, and L. Schönherr(2025)Prompt obfuscation for large language models.In34th USENIX Security Symposium (USENIX Security 25),Seattle, WA,pp. 2323–2342.External Links:ISBN 978-1-939133-52-6,LinkCited by:§2,§8.
• [24]Z. Sha and Y. Zhang(2024)Prompt stealing attacks against large language models.Note:arXiv preprint arXiv:2402.12959External Links:2402.12959,LinkCited by:§2.
• [25]X. Shen, Y. Qu, M. Backes, and Y. Zhang(2024)Prompt stealing attacks against Text-to-Image generation models.In33rd USENIX Security Symposium (USENIX Security 24),Cited by:§1.
• [26]Y. Tan, X. Shen, Y. Shen, M. Backes, and Y. Zhang(2025)On the effectiveness of prompt stealing attacks on in-the-wild prompts.In2025 IEEE Symposium on Security and Privacy (SP),pp. 392–410.External Links:Document,LinkCited by:§2.
• [27]F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart(2016)Stealing machine learning models via prediction APIs.In25th USENIX Security Symposium (USENIX Security 16),Austin, TX,pp. 601–618.External Links:ISBN 978-1-931971-32-4,LinkCited by:§2,§8.
• [28]Z. Wang, R. Zhang, Y. Liu, C. Liu, Q. Zhao, H. Li, and G. Xu(2026)Black-box skill stealing attack from proprietary LLM agents: an empirical study.Note:arXiv preprint arXiv:2604.21829External Links:2604.21829,Document,LinkCited by:§2,§4.1,Table 2,§7.
• [29]Z. Z. Wang, J. Mao, D. Fried, and G. Neubig(2025)Agent workflow memory.InProceedings of the 42nd International Conference on Machine Learning,Proceedings of Machine Learning Research, Vol.267,pp. 63897–63911.External Links:LinkCited by:§2.
• [30]S. Xu, Z. He, and Y. R. Fung(2026)RedAct: redacting agent capability traces for procedural skill protection.Note:arXiv preprint arXiv:2606.10813External Links:2606.10813,Document,LinkCited by:§2,§8.
• [31]Y. Yang, C. Li, Q. Li, O. Ma, H. Wang, Z. Wang, Y. Gao, W. Chen, and S. Ji(2025)PRSA: prompt stealing attacks against Real-World prompt services.In34th USENIX Security Symposium (USENIX Security 25),Seattle, WA,pp. 2283–2302.External Links:ISBN 978-1-939133-52-6,LinkCited by:§1,§2.
• [32]S. Yu, G. Li, W. Shi, and P. Qi(2026)PolySkill: learning generalizable skills through polymorphic abstraction for continual learning.InThe Fourteenth International Conference on Learning Representations,External Links:LinkCited by:§2.
• [33]Y. Zhang, N. Carlini, and D. Ippolito(2024)Effective prompt extraction from language models.External Links:2307.06865,LinkCited by:Table 9,§7.