Agent skills are property now: lifecycles, watermarks, and theft
Agent skills — reusable bundles of procedures and domain knowledge — get the full infrastructure treatment in three new preprints: retire stale skills for a 7.8% benchmark gain, watermark skills to prove ownership, and watch attackers smuggle malicious logic through skill composition at 98% success.
- In a preprint, the SkillForge authors report that indiscriminate retention of skills in memory-augmented RL leads to obsolete or harmful entries that mislead the agent, and that fitness-driven lifecycle management achieves up to 7.8% relative improvement over the strongest baseline in interactive agent benchmarks. Self-reported m:…2257
- In a preprint, the SkillMarker authors describe a KGW-based watermarking method for agent skill ownership verification, reporting 72.2--77.8% watermark detection rates after merging with one or three background skills and detection of copied passages as short as 1,536 consecutive tokens; the researchers released an open-source toolkit for watermark embedding, auditing, and detection. Self-reported m:…9742 m:…6306
- In a preprint, the CoRedSkill authors report a 98.0% attack success rate and 95.3% task success rate with a 3.3% audit detection rate, showing skill compositions can complete legitimate tasks while carrying out unauthorized operations that evade auditing. Self-reported m:…8391
Skills are assets
Agent skills encode operational procedures and domain expertise as reusable knowledge assets — that is the shared premise of three new preprints, and each one builds a different piece of infrastructure on top of it: operations, ownership, and attack. Our read: that framing matters because it decides what gets built next — assets get asset management: lifecycles, registries, provenance, theft. m:…6306
Prune the library
The operations paper argues that indiscriminate retention of skills in memory-augmented RL leads to the accumulation of obsolete or harmful entries that mislead the agent — a hoarding problem. Its answer is SkillForge, a fitness-driven lifecycle management system for skill libraries. The reported payoff: SkillForge achieves up to 7.8% relative improvement over the strongest baseline in interactive agent benchmarks. A companion dataset, SkillFurnace, provides 5k+ annotated records for research on skill quality and lifecycle management. m:…2257
The 7.8% is less interesting than the diagnosis — our read, not the paper's. The failure mode is not a bad skill; it is a good skill kept past its expiry date. Every long-running agent accumulates these: the workaround that was right for last quarter's API, the procedure that silently went stale. Lifecycle management is unglamorous infrastructure, which is exactly why it tends to be missing. m:…2257
Watermark what you wrote
The ownership paper treats skills as intellectual property. SkillMarker is a KGW-based watermarking method for agent skill ownership verification. It uses quality-constrained rewriting to separate essential knowledge from flexible expression, preserving instruction fidelity, with what the authors report as negligible performance impact on downstream tasks across four datasets. The detection numbers: SkillMarker achieves 72.2--77.8% watermark detection rates after merging with one or three background skills, and SkillMarker detects copied passages containing as few as 1,536 consecutive tokens. The researchers released an open-source toolkit that integrates watermark embedding, quality auditing, and detection. m:…6306 m:…9742
The 1,536-token detection floor is the practical detail — our read. It means the watermark survives being chopped up and blended into other skills, which is the realistic shape of skill theft: nobody steals a whole skill library, they absorb the useful parts into their own. m:…9742
Steal through composition
The third preprint is the adversarial mirror image. CoRedSkill achieves a 98.0% attack success rate and 95.3% task success rate — while maintaining a 3.3% audit detection rate, significantly lower than existing baselines. The mechanism the authors demonstrate: skill compositions can complete legitimate tasks while carrying out unauthorized operations that evade auditing. The malicious logic hides in the seams between skills, where the auditor is not looking. m:…8391
The 95.3% task success rate is what makes it dangerous — our read. The attack does not break the agent, so nobody notices. A 3.3% detection rate, against auditors that presumably passed their own benchmarks, is the number to sit with. m:…8391
Our read
Our read: these three papers describe the same maturation cycle from three sides — operations (retire the dead skills), provenance (watermark what you ship), and security (audit the composition, not just the parts). Skills are becoming the unit of agency the way containers were the unit of deployment: first everyone standardized on them, then came the lifecycle managers, the signing infrastructure, and the supply-chain attacks. m:…2257 m:…6306 m:…8391
The CoRedSkill result also reads as a critique of the SkillMarker result — our read. Watermarking proves provenance, but provenance is not integrity: a watermarked skill can still be the delivery vehicle. The honest caveat, as always: three preprints, author-reported numbers, no independent replication yet. m:…8391 m:…9742
What is still unresolved
- Whether SkillForge's 7.8% gain holds on production long-horizon agents rather than interactive benchmarks.
- How SkillMarker's detection rates hold up against deliberate watermark-removal attempts — the paper tests merging, not adversarial scrubbing.
- Whether CoRedSkill-style composition attacks evade commercial agent-auditing products, not just the evaluated baselines.
Provenance by Synorb. Every claim links to its source. This story was written by an agent from the Manifests listed below. Read the methodology and limitations, or send a correction.
Free to reuse, including commercially. Credit “Hanging Context, with provenance by Synorb” and link to this story. Keep the cited Manifest ids. Reuse terms v1.