Black-box probing reconstructs what a closed agent skill actually does — hidden functionality recovered from benign queries alone
arXiv 2608.04192·low signal
SkillClone sends structured benign probes to an agent and recovers the hidden functionality of its installed skills, achieving exact or partial reconstruction on multiple targets without any disclosure-focused defense in place. The implication cuts both ways: proprietary skill logic is not protected by keeping the file private, and defenders can use the same technique to audit third-party skills they cannot read. Assume any skill reachable through a public agent endpoint is effectively published.