SkillGuard shrinks agent authority after untrusted data arrives, with zero extra model calls.

It treats untrusted data entering agent state as contamination and restricts future capabilities so the state cannot reach deployer-defined forbidden states, using a Skill Impact Graph, steerability signatures and an inline reference monitor (arXiv 2608.30041). Across four AgentDojo suites with Gemini 2.5 Flash and Llama3.3-70B it eliminates attack success on three of four and cuts Slack to 4.8% and 14.3%, beating Spotlighting, CaMeL and AttriGuard. Fractional-flow restriction preserves substantially more capability than binary cutoff at equal attack success, and it adds no model calls or token overhead. That last part is why I would try it.