mlsanityData to 7 Oct 2026

Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills

arXiv 2608.04192 ↗First posted 4 Aug 2026cs.CR cs.AI cs.CLcited by 2

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Closed source agent skills may encode proprietary instructions, scripts, constants, and data. Providers may offer their capabilities as services while keeping the underlying packages hidden. Prior work focuses on prompt injection attacks that directly disclose these artifacts, and existing defenses accordingly aim to prevent such leakage. However, preventing file disclosure does not prevent users from recovering the functionality those files implement. This raises a fundamental question: can a user reconstruct a skill's functionality through ordinary use while its files remain hidden? We study behavioral skill reconstruction (BSR), in which an attacker uses valid task requests and observed responses to build a functional clone of a hidden skill. We introduce SkillClone, a black-box attack that clones a target skill by forming an interface hypothesis from its public advertisement, issuing structured benign probes, synthesizing an executable replica, and iteratively repairing it through differential validation against the victim skill. Across 30 skills spanning rules, tables, procedures, and algorithms, SkillClone achieves exact or partial recovery on held-out inputs for several targets. Iterative requerying closes gaps missed by single-round reconstruction. Because SkillClone uses only legitimate interactions, disclosure-focused defenses provide limited coverage, and less detailed skill descriptions offer limited protection. These results show that file secrecy alone does not ensure functional secrecy. Defenses must also limit cumulative information leakage from ordinary use.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 31 of its 55 references that are in the map. First posted on arXiv 4 Aug 2026.

Builds on

31 of 55 references.

Closest ancestors · 6

Same direction, newest first

  1. 2026SkillVetBench: LLM-as-Judge for Multi-Dimensional Security Risk Evaluation in Open-Source LLM Agent Skills14 Jun
  2. 2026Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems13 Jun
  3. 2026SkillMutator: Benchmarking and Defending Language-and-Code Cross-modal Attacks on LLM Agent Skills12 Jun
  4. 2026Black-Box Skill Stealing Attack from Proprietary LLM Agents: An Empirical Study23 Apr
  5. 2026Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale15 Jan
  6. 2025DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents13 Jun

Other references · 25

  1. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  2. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  3. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  4. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  5. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  6. 2020Extracting Training Data from Large Language Modelscited by 2,144
  7. 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,880
  8. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  9. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  10. 2026DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligencecited by 877
  11. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  12. 2016Stealing Machine Learning Models via Prediction APIscited by 602
13 more
  1. 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 325
  2. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
  3. 2024Stealing Part of a Production Language Modelcited by 152
  4. 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 136
  5. 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Promptingcited by 113
  6. 2023Effective Prompt Extraction from Language Modelscited by 83
  7. 2026SkillRet: A Large-Scale Benchmark for Skill Retrieval in LLM Agentscited by 37
  8. 2026SkillsVote: Lifecycle Governance of Agent Skills from Collection, Recommendation to Evolutioncited by 18
  9. 2025Rethinking Jailbreak Detection of Large Vision Language Models with Representational Contrastive Scoringcited by 9
  10. 2024PromptKeeper: Safeguarding System Prompts for LLMscited by 4
  11. 2025You Can't Steal Nothing: Mitigating Prompt Leakages in LLMs via System Vectorscited by 4
  12. 2026Agent Skills Matter: Inferring Proprietary Skills from Execution Trajectoriescited by 4
  13. 2026Spore: Efficient and Training-Free Privacy Extraction Attack on LLMs via Inference-Time Hybrid Probingcited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Daydreaming: Stealing Hidden Agent Skills through Black-Box Task Interactioncited by 0
  2. 2026AgentLeak: Cloning Stronger LLM Agent Capabilities onto Weaker Agents Beyond Skill Stealingcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners
  2. 2026Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks
  3. 2026SkillSecurer: Detecting and Patching Prompt-Injection Vulnerabilities in AI Agent Skills
  4. 2026When Skills Lie: Hidden-Comment Injection in LLM Agents
  5. 2026SkillsMetric: Mapping the Detection Boundary of Static Analysis for Malicious Agent Skills
  6. 2026SkillAtlas: An Attack Trace Library for Agent Skills
  7. 2026SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents
  8. 2026SkillTrojan: Backdoor Attacks on Skill-Based Agent Systems