Search papers, labs, and topics across Lattice.
This paper investigates the feasibility of reconstructing hidden functionalities of closed-source agent skills through a method called behavioral skill reconstruction (BSR). By employing a black-box attack known as SkillClone, the authors demonstrate that an attacker can successfully clone a target skill using legitimate task requests and observed responses, achieving exact or partial recovery across 30 different skills. The findings reveal that existing defenses focused on preventing file disclosure are inadequate, as functional secrecy can still be compromised through cumulative information leakage during normal interactions.
SkillClone reveals that even hidden functionalities can be reconstructed through legitimate interactions, challenging the effectiveness of current secrecy measures.
Closed source agent skills may encode proprietary instructions, scripts, constants, and data. Providers may offer their capabilities as services while keeping the underlying packages hidden. Prior work focuses on prompt injection attacks that directly disclose these artifacts, and existing defenses accordingly aim to prevent such leakage. However, preventing file disclosure does not prevent users from recovering the functionality those files implement. This raises a fundamental question: can a user reconstruct a skill's functionality through ordinary use while its files remain hidden? We study behavioral skill reconstruction (BSR), in which an attacker uses valid task requests and observed responses to build a functional clone of a hidden skill. We introduce SkillClone, a black-box attack that clones a target skill by forming an interface hypothesis from its public advertisement, issuing structured benign probes, synthesizing an executable replica, and iteratively repairing it through differential validation against the victim skill. Across 30 skills spanning rules, tables, procedures, and algorithms, SkillClone achieves exact or partial recovery on held-out inputs for several targets. Iterative requerying closes gaps missed by single-round reconstruction. Because SkillClone uses only legitimate interactions, disclosure-focused defenses provide limited coverage, and less detailed skill descriptions offer limited protection. These results show that file secrecy alone does not ensure functional secrecy. Defenses must also limit cumulative information leakage from ordinary use.
