PaperlayerView exact revision on arXiv

Source-linked AI summary

SkCC: Portable and Secure Skill Compilation for Cross-Framework LLM Agents

Yipeng Ouyang, Yi Xiao, Yuhao Gu, Xianwei Zhang

arXiv:2605.03353v4cs.CRcs.AI

TL;DR

Agent skills are difficult to port because frameworks respond differently to prompt formats, while systematic compile-time security enforcement remains unavailable. SkCC uses a typed intermediate representation and security optimizer to compile skills across frameworks, delivering consistent pass-rate gains of up to +13.5%.

  • Problem

    Agent skill deployment lacks systematic handling of format sensitivity and compile-time security enforcement across increasingly diverse frameworks.

  • Method

    SkCC parses SKILL.md into typed SkIR, applies compile-time security analyses, and emits framework-native artifacts through a four-phase pipeline.

  • Results

    Up to +13.5% pass-rate improvement, 94.8% Anti-Skill Injection coverage, and 10–46% runtime token savings were observed across four frameworks.

  • Takeaways & Limitations

    Compiler-driven adaptation provides effective and practical portable and secure deployment for the evaluated agent-skill ecosystem.

  • Takeaways & Limitations

    The security rules do not address prompt injection, side-channel data exfiltration, or supply-chain vulnerabilities in MCP dependencies.

Abstract

from arXiv · show

LLM agents increasingly rely on reusable skills (e.g., SKILL markdown files) to execute complex tasks, yet these artifacts lack portability: agent frameworks are highly sensitive to prompt formatting, leading to a large performance variation for the same skill. Nevertheless, most skills are authored once as format-agnostic Markdown, necessitating costly per-framework rewrites and also leaving security largely unaddressed, with widespread vulnerabilities in practice. To address this, we present SkCC, a compiler for LLM agents that introduces classical compilation design into agent skill development. SkCC centers on SkIR, a strongly-typed intermediate representation that decouples skill semantics from framework-specific formatting, thus enabling portable deployment across agent frameworks. Atop of this IR, a static Optimizer enforces security constraints, blocking vulnerabilities before deployment. Implemented as a four-phase pipeline, SkCC effectively reduces adaptation complexity from $O(m \times n)$ to $O(m + n)$ across $m$ skills and $n$ frameworks. Experiments on SkillsBench demonstrate that SkCC delivers consistent and substantial gains over original counterparts, with pass rate increases from 21.1% to 33.3% on Claude Code and from 35.1% to 48.7% on Kimi CLI. Further, the design achieves sub-10ms compilation latency, 94.8% proactive security trigger rate, and 10-46% runtime token savings across frameworks.

1 Introduction

SKCC addresses cross-framework skill portability and security by compiling skills through a unified intermediate representation, SKIR, rather than relying on format-agnostic delivery. Its four-phase design reduces adaptation complexity while improving pass rates, security coverage, compilation latency, and runtime token efficiency.

  • Approach: O(m+n) replaces O(m×n) adaptation complexity by requiring m skill sources and n emitter implementations instead of m×n manual adaptations.The unified IR separates skills from frameworks and supports portable deployment through framework-specific emitters.
  • Motivation: Format sensitivity makes identical skills perform differently across agent frameworks, rendering manual per-framework adaptation increasingly infeasible.Claude benefits from XML semantic layering, GPT-series models from XML-tagged Markdown, and deeply nested data is parsed most accurately in YAML.
  • Approach: SKCC uses SKIR to decouple skill authoring from framework-specific formatting, allowing each skill to be written once and compiled to multiple frameworks.A polymorphic emission layer produces framework-native formats from the unified intermediate representation.
  • Security: 94.8% Anti-Skill Injection coverage accompanies secure execution through Anti-Skill Injection and semantic validation before deployment.SKCC’s static security constraints are enforced during compilation rather than after deployment.
  • Evaluation: Up to +13.5% pass rate improvement, sub-10ms compilation latency, and 10–46% runtime token savings demonstrate gains across mainstream agent frameworks.The evaluation reports consistent pass rate improvements alongside latency and runtime-efficiency benefits.

2 Background and Motivation

Agent skills are reusable SKILL.md artifacts whose portability is limited by framework-sensitive prompt formatting and unresolved compile-time security gaps. Classical compiler design motivates a unified intermediate representation and phased analysis to decouple skill semantics from target-specific formatting while enforcing constraints before deployment.

  • Agent Skills: Structure and Usage: SKILL.md combines YAML metadata with Markdown instructions, and progressive disclosure loads roughly 50 tokens per skill before retrieving matched content.This structure supports reusable, on-demand skill execution in agent systems.
  • Classical Compilation Principles: Classical compilers use an intermediate representation to decouple frontend parsing from backend generation, reducing support complexity from m × n to m + n.The broader pipeline includes lexical analysis, parsing, semantic analysis, IR generation, optimization, and target code generation.
  • Format Sensitivity and Skill Retrieval: 40% variation can result from prompt-format changes alone, with framework preferences differing across XML, JSON, and YAML.Claude benefits from XML semantic layering, GPT-series models incur a JSON format tax, and YAML parses nested data more accurately.
  • Challenges: Existing systems either ignore format sensitivity, rely on expensive instance-specific search, or lack systematic compile-time security enforcement for agent skills.The identified gap combines format-syntax adaptation with security analysis before deployment.
  • Challenges: A unified intermediate representation is needed to separate skill semantics from framework-specific formatting and enable compile-time security constraints before deployment.This compiler-based methodology treats skills as compilable artifacts rather than static files manually rewritten for each target.

3 SKCC Design

SKCC compiles a single SKILL.md source through four phases into framework-native artifacts, using strongly typed SKIR to separate skill semantics from target-specific formatting. Its IR-level optimizer applies compile-time security checks and constraints before polymorphic emitters generate extensible framework-native outputs.

  • Pipeline: The Syntax Parser separates YAML metadata into a typed routing table and lowers Markdown instructions into a deterministic AST with classified steps, code blocks, and examples.This removes ambiguity between structural metadata and freeform instructional content.
  • Intermediate Representation: SKIR normalizes procedures, permissions, schemas, and constraints into typed semantic categories, allowing properties such as nested-data depth to guide every target emitter without duplication.The IR acts as an information bridge between semantic skill properties and framework-specific rendering decisions.
  • Pipeline: SKCC’s four-phase pipeline parses SKILL.md, builds strongly typed SKIR, performs compile-time security optimization, and emits framework-native artifacts.SKIR decouples skill semantics from framework-specific formatting.
  • Security Optimizer: Compile-time security analysis structurally validates skills, audits permissions, injects anti-injection constraints, and assigns tiered risk classifications before execution.Structural failures are rejected at compile time, while security constraints are embedded in SKIR rather than relying on runtime guardrails.
  • Target Emitters: Polymorphic Target Emitters map SKIR to framework-specific formats, generate lightweight routing manifests, and support new frameworks through additional emitter implementations without changing earlier phases.This extensible design delivers O(m + n) adaptation complexity across skills and frameworks.

4 Evaluation

SKCC improves portability, security, and execution efficiency across agent frameworks, while evaluation shows that compilation gains depend on the target model and format. It also achieves strong pass-rate improvements, proactive safety interception, sub-10ms compilation latency, and net token savings.

  • Portability and Security: SKCC raises pass rates and mean rewards across all four tested frameworks, with an average pass-rate gain of +7.0 percentage points.The largest absolute gain is on Kimi CLI, increasing from 35.1% to 48.7%.
  • Portability and Security: 12.2pp and 13.5pp are SKCC’s pass-rate gains on Claude Code and Kimi CLI, respectively, exceeding Liu et al.’s +8.1pp and +3.3pp gains.SKCC improves Claude Code from 21.1% to 33.3% and Kimi CLI from 35.1% to 48.7%.
  • Portability and Security: 94.8% of 233 evaluated skills trigger Anti-Skill Injection checks, while compile-time interception blocks dangerous or malformed skills before deployment.For SkillsBench, 221 of 231 Gemini-targeted skills compile successfully, while 10 are intercepted across YAML, security, and schema categories.
  • Ablation Experiments: d = +0.33 (p = 0.0063) on Kimi, d = −0.03 (p = 0.857) on GLM-5, and d = −0.14 (p = 0.2561) on DeepSeek-v4-flash show model-dependent compilation effects.The results provide empirical evidence against a single universally optimal compiled format.
  • Supplementary Properties: Under 10ms is the average compilation latency for all skills.Latency is measured per skill, with detailed complexity results reported separately.
  • Supplementary Properties: 10–46% are the net token savings across frameworks, offsetting static expansion overhead of +4% on Kimi to +25% on Claude.Compiled skills also consistently reduce execution time, while Claude Code achieves lower token consumption alongside higher reward.

5 Conclusion

SkCC enables portable and secure deployment of agent skills across heterogeneous frameworks by decoupling skill semantics from framework-specific formatting through a four-phase, SkIR-centered pipeline. Its compile-time security enforcement and empirical gains demonstrate effective and practical compiler-driven adaptation.

  • 5 Conclusion: SkCC decouples skill semantics from framework-specific formatting, allowing skills to be authored once and compiled to diverse targets.The design uses a four-phase pipeline centered on SkIR for portable deployment across heterogeneous frameworks.
  • 5 Conclusion: 94.8% Anti-Skill Injection coverage is achieved through a compile-time Security Optimizer that enforces safety constraints before skills reach an agent’s context window.The optimizer applies Anti-Skill Injection during compilation rather than at runtime.
  • 5 Conclusion: Up to +13.5% consistent pass rate improvements and 10–46% runtime token savings across four frameworks demonstrate effective and practical compiler-driven adaptation.These results support SkCC’s applicability to the emerging agent skill ecosystem.

A Implementation Details · A.1 Compilation Performance Details

SkCC is implemented as a Rust-based, four-crate compiler with framework-specific templates and a Node.js wrapper. Its compilation pipeline achieves sub-10ms single-skill latency, linear batch scaling, and low memory usage.

  • A Implementation Details: SkCC is implemented in Rust and organized into four crates.The crates cover the CLI, core compiler, templates, and npm integration.
  • A Implementation Details: The nexa-skill-cli exposes commands for building, checking, validating, initializing, listing, indexing, and cleaning skills.It uses clap for argument parsing and miette for diagnostic rendering.
  • A Implementation Details: The nexa-skill-core separates parsing, SKIR construction, analysis, backend emission, diagnostics, and security functionality.Its backend includes four framework-specific Target Emitters and routing-manifest generation.
  • A Implementation Details: Four Askama templates map SKIR fields to framework-specific outputs for Claude, Codex, Gemini, and Kimi.The templates are compile-time validated and use framework-specific Markdown, XML, or YAML formatting.
  • A Implementation Details: The npm-nexa-skill-compiler package downloads the precompiled Rust binary and exposes nsc globally for JavaScript-based agent toolchains.This wrapper enables integration with Node.js users and JavaScript-based workflows.
  • A Implementation Details: Arc<str> enables zero-copy sharing across phases and emitters, while sequential batch processing keeps peak memory below 50MB for corpora such as 233 skills.ValidatedSkIR adds only a Vec<Diagnostic> without duplicating the underlying IR.
  • A.1 Compilation Performance Details: Under 10ms is required for single-skill compilation across all four targets, while 225-skill batches finish in approximately 1.8 seconds.Average batch latency is 8ms per skill, complexity adds only +0.59ms, and the maximum compilation time is 22.89ms.

B Data Validity · C Design Artifacts

Experiments used SkillsBench with Docker execution and automated pytest verification, while infrastructure-related trial failures were excluded before reward analysis to preserve unbiased comparisons.

  • B Data Validity: 89 tasks from SkillsBench formed the experimental benchmark.All experiments used the SkillsBench benchmark.
  • B Data Validity: Docker-based execution supported the benchmark experiments.The experiments used Docker-based execution.
  • B Data Validity: Automated pytest verification evaluated task execution.The benchmark used automated pytest verification.
  • B Data Validity: Regional API availability constraints caused some framework trials to fail.The passage identifies regional API availability as an infrastructure constraint in cloud-based evaluation.
  • B Data Validity: Network conditions in cloud-based LLM evaluation also contributed to trial failures.Reported examples included container timeouts and API rate limits.
  • B Data Validity: Infrastructure-related failures were excluded before reward analysis, ensuring unbiased comparisons.The excluded failures were attributed strictly to infrastructure issues.

C.1 Key Insights from Evaluation … D.1 Four-Model Comparison Summary

SkCC improves execution through framework-aware compilation: it adapts formatting to model preferences, adds static security constraints, and exchanges modest skill-size overhead for lower runtime token use. Across four frameworks, the resulting effects vary with format sensitivity, while compilation remains fast and security coverage high.

  • C.1 Key Insights from Evaluation: 10–46% runtime token savings accompany compilation gains across four frameworks, alongside sub-10ms latency and 94.8% Anti-Skill Injection coverage.These engineering results establish both dynamic efficiency and proactive security benefits.
  • C.1 Key Insights from Evaluation: Claude gains most from compilation (d = 0.60), whereas Gemini improves minimally (d ≈0), showing that format-sensitive models benefit more than format-tolerant ones.Claude’s XML-heavy training distribution makes structural alignment especially useful; Gemini is comparatively format-tolerant.
  • C.1 Key Insights from Evaluation: 4–25% static skill-size growth is exchanged for 10–46% lower dynamic token consumption during execution.Structured formats provide cognitive scaffolding that reduces parsing ambiguity and trial-and-error.
  • C.2 Framework-Specific Emission Details: 23% is the maximum reported reasoning-accuracy improvement from Claude’s semantic XML layering of procedures, constraints, and examples.The emitter uses nested tags such as <execution_steps>, <strict_constraints>, and <examples>.
  • C.3 SKIR Example: A simplified github-api-client SKIR normalizes raw Markdown into a framework-agnostic structure with procedures and automatically injected anti_skill_constraints.The example illustrates the intermediate representation produced before target-specific emission.
  • C.4 Anti-Skill Injection Rules: 91.4% of anti-skill triggers involve HTTP safety, and new rules can be added through trigger patterns and constraint templates without changing the pipeline.The rules were selected from common vulnerability patterns in community skill audits.
  • C.5 Four-Framework Format Divergence: Four target emitters diverge in representation while consistently preserving anti-skill constraints, with Gemini conditionally rendering nested schemas at depth ≥3 as YAML.The divergence demonstrates framework-specific formatting from a shared SKIR.
  • D.1 Four-Model Comparison Summary: Claude’s effect is d ≈0.60, Kimi’s is d = 0.33, and Codex and Gemini show negligible effects; Claude and Kimi are statistically significant at p < 0.01.The effect-size gradient follows documented format sensitivity, and significance persists despite modest sample sizes.

D.2 Claude Code — Complete Data

On Claude Code, SKCC improves or matches the baseline across all 22 paired tasks, with seven improvements and no losses. Six improvements are complete failure-to-success flips, indicating that native XML presentation resolves parsing failures affecting plain Markdown instructions.

  • Paired task outcomes: 7 of 22 tasks (31.8%) favored SKCC, while 15 (68.2%) tied and 0 (0%) favored the baseline.Six of the seven improvements flipped from reward=0 to reward=1.
  • Parsing failure resolution: 6 complete failure-to-success flips show that XML Semantic Layering addresses a genuine parsing failure mode in Claude Code.Claude could not interpret the plain Markdown instructions but succeeded when the same semantic content was presented in native XML format.

D.3 Kimi CLI — Complete Data … D.10 Compilation Interception Types

Across Kimi CLI and ablation analyses, SKCC improves task outcomes while showing that compilation gains depend on model-specific format alignment. The appendices further report efficiency, security coverage, rule distributions, and calibrated interception behavior across frameworks.

  • D.3 Kimi CLI — Complete Data: 13 task flips from reward=0 to reward=1, with SKCC winning 13 discriminative cases and achieving p = 0.0063 across 74 paired Kimi tasks.Parametric and non-parametric tests consistently support the observed effect.
  • D.4 Ablation Study — Full Data: Kimi’s optimal compiled format can be neutral or harmful for another model, establishing the need for per-model emission in SKCC’s multi-backend architecture.The cited ablation evidence specifically identifies Kimi’s format as underperforming on DeepSeek.
  • D.5 Ablation Radar Chart: Kimi dominates five normalized ablation dimensions, while GLM and DeepSeek cluster near zero, confirming that compilation gains depend on target-model alignment.The dimensions are Delta Reward, Statistical Significance, Pass Rate Delta, Token Efficiency, and Execution Time Delta.
  • D.6 Expansion Overhead by Complexity: −3.1%: Kimi’s complex skills shrink after compilation because structured formatting removes redundant Markdown boilerplate.Relative overhead is largest for simple skills and diminishes for complex skills as fixed formatting costs are amortized.
  • D.7 Claude Code — Full Token Consumption: 18.3M vs. 32.9M input tokens and 459K vs. 574K output tokens: SKCC consumes fewer tokens than Baseline despite adding XML tags and constraints.The clearer structure reduces trial-and-error and the model’s required reasoning steps relative to format-agnostic Markdown.
  • D.8 Anti-Skill Injection — Full Statistics: 94.8%: Anti-Skill Injection triggers on nearly all of 233 skills, while the 12 non-triggering skills are predominantly simple utilities without external interactions.This indicates broad coverage for skills performing substantive operations.
  • D.9 Rule Trigger Distribution — Full Data: HTTP and loop safety dominate rule triggers, DB safety affects approximately one-third of skills, and parse safety is rarely triggered.The passage attributes this distribution to prevalent API calls, iterative processing, and relatively infrequent HTML scraping; broader parsing coverage is proposed as future work.
  • D.10 Compilation Interception Types: 95.7% successful compilation rate (221/231): interception layers block problematic skills across parsing, analysis, and IR construction without overly restricting compilation.YAML violations are caught during parsing, security issues during analysis, and schema violations during IR construction.

E Limitations

SkCC’s evaluation and security analysis remain limited in framework coverage, benchmark domains, vulnerability coverage, and compilation granularity. These boundaries leave broader empirical validation, additional security defenses, and finer-grained compilation for future work.

  • Framework scope: Evaluation covers four mainstream frameworks, while validation on additional frameworks remains future work despite the Emitter architecture’s support for new targets.The evaluated systems are Claude Code, Codex CLI, Gemini CLI, and Kimi CLI.
  • Security coverage: Current Anti-Skill Injection rules target four common vulnerability classes but omit prompt injection, side-channel data exfiltration, and MCP supply-chain vulnerabilities.The covered classes reflect prevalent patterns identified in community audits, but the rule set is not exhaustive.
  • Compilation granularity: SKCC compiles entire SKILL.md files rather than individual procedures or examples, limiting finer-grained optimization.Per-procedure or per-example compilation could yield additional gains but requires more sophisticated dependency analysis.

F Broader Impact · G How to Cite

SKCC seeks to improve LLM-agent reliability and security by enabling portable skills and compile-time security enforcement. Its broader impacts include safer, more reusable agent capabilities, while limitations include false positives and the inability to guarantee semantic safety; the paper also provides a citation entry.

  • F Broader Impact: SKCC improves agent-system reliability and security by making skills portable across frameworks and enforcing security constraints at compile time.Portability lowers barriers for skill authors and reduces maintenance burden for skill consumers, while compile-time enforcement provides systematic vulnerability defense.
  • F Broader Impact: Compile-time security hardening prevents dangerous skills from reaching agent context windows, reducing the risk of unintended harmful actions.The portability mechanism also supports an open ecosystem in which authors can write once and deploy anywhere.
  • F Broader Impact: Write-once, deploy-anywhere portability may accelerate development of high-quality, reusable agent capabilities.This portability mechanism is described as promoting an open skill ecosystem.
  • F Broader Impact: False positives from compile-time security analysis can block legitimate skills and frustrate developers.The current interception rate is 4.3%, but expanding rule sets will require calibration to preserve usability.
  • F Broader Impact: SKCC cannot guarantee semantic safety because it addresses format-level and pattern-level vulnerabilities rather than the semantic safety of skill logic.The compilation framework could otherwise create a false sense of security.
  • F Broader Impact: Non-blocking warnings, overrideable diagnostics, and tiered security classification mitigate false-positive friction and avoid binary accept/reject enforcement.Future explainable security analysis could further improve developer trust.
  • G How to Cite: The paper asks researchers who find SKCC useful to consider citing it and provides a BibTeX entry beginning @misc{ouyang2026skcc.The supplied citation passage is truncated after the entry prefix.
Loading 2605.03353v4…