# Auto-Policy, not Auto-Skill: Compiled Agent Skills for the Physical World

arXiv: https://arxiv.org/abs/2608.25091 · HTML: https://mlsanity.com/paper/2608.25091/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 9 of its 19 references that are in the map.
- First posted on arXiv 25 Aug 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 9 of 9)

- [Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://mlsanity.com/paper/2302.12173/) (2023)
- [LLMind: Orchestrating AI and IoT with LLM for Complex Task Execution](https://mlsanity.com/paper/2312.09007/) (2023)
- [SkillSieve: A Hierarchical Triage Framework for Detecting Malicious AI Agent Skills](https://mlsanity.com/paper/2604.06550/) (2026)
- [SAGE: Smart home Agent with Grounded Execution](https://mlsanity.com/paper/2311.00772/) (2023)
- [Blueprint First, Model Second: A Framework for Deterministic LLM Workflow](https://mlsanity.com/paper/2508.02721/) (2025)
- [Optimizing Agentic Workflows using Meta-tools](https://mlsanity.com/paper/2601.22037/) (2026)
- [Systems-Level Attack Surface of Edge Agent Deployments on IoT](https://mlsanity.com/paper/2602.22525/) (2026)
- [LLMind 2.0: Distributed IoT Automation with Natural Language M2M Communication and Lightweight LLM Agents](https://mlsanity.com/paper/2508.13920/) (2025)
- [Proactive Rejection and Grounded Execution: A Dual-Stage Intent Analysis Paradigm for Safe and Efficient AIoT Smart Homes](https://mlsanity.com/paper/2603.16207/) (2026)

## Built on by (most cited first, 1 of 1)

- [Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound](https://mlsanity.com/paper/2609.05920/) (2026)

## Abstract (arXiv)

Self-evolving Skill harnesses (AutoSkills, Hermes Agent) generate more advisory orchestration automatically; their reported gains are efficiency, not safety. This misses the actual gap: a Skill describes how an agent should behave; a Policy decides which behavior is allowed to become an action. Today's format covers the first with markdown and scripts; the second is left to the model. Generating more Skills scales the gap, not the safety, especially when a wrong invocation can unlock a door or move money. Two adjacent attacks are documented: malicious skills compromising cloud software, and jailbroken LLM-controlled robots causing physical harm. Their intersection, malicious agent skills causing physical harm, follows directly but has not been reported. We name this class Borrowed Authority: Skills format gives the receiving agent no typed way to reject an inter-agent permission claim, so a malicious or misused Skill can drive actuation by attaching one. We propose Edge Skillguard, a typed authority layer that lives inside the Skill artifact rather than between tools as workflow engines do, with guards over world state and sensor evidence. On a live edge control-plane testbed, the guards reject 60/60 borrowed-authority requests across five attack variants without blocking benign requests, and the result holds at 5x scale and across hosts over a Tailscale mesh. These results suggest that high-risk Skills should co-package typed invocation policy with procedural knowledge, so that physical actions depend on machine-checkable evidence rather than peer-agent claims.