Agent skills have a new security problem: the model itself can become the extraction interface.

This paper tests whether a user can steal a proprietary SKILL.md through nothing more than normal black-box interaction with an agent. Across 5 commercial models, even the plainest extraction prompt averaged 48% exact recovery and a 0.91 LLM-judged leakage ratio.

More structured attacks made it worse. Chain-of-thought prompts pushed exact recovery to 72% on average, while few-shot examples produced the highest lexical and semantic similarity.

The harder problem is that blocking verbatim copying is not enough. Translation and rewriting attacks often drove exact match to 0% while preserving most of the skill's meaning.

The authors' strongest defenses can stop exact disclosure, but meaningful semantic leakage still survives in harder cases.

So if skills become paid, reusable IP, prompt secrecy alone is a weak protection model. Platforms need to treat skill contents as data that can be exfiltrated through model behavior, not merely hidden text.

• arxiv. org/abs/2604.21829

Title: "Black-Box Skill Stealing Attack from Proprietary LLM Agents: An Empirical Study"