Source-linked AI summary
Auto-Policy, not Auto-Skill: Compiled Agent Skills for the Physical World
Zhonghao Zhan, Hamed Haddadi
TL;DR
Agent Skills package procedural knowledge, but current orchestration leaves authority decisions—whether behavior may become physical action—to the model, creating an intersection between documented skill attacks and robotic jailbreaks. Edge Skillguard embeds typed contracts and guards over world state, leases, and sensor evidence; it rejects Borrowed Authority requests while preserving benign requests across scaled and cross-host tests.
Problem
Current Skills formats describe procedures but provide no typed authority mechanism for deciding when inter-agent messages may become physical actions, amid documented malicious skills and jailbroken LLM-controlled robots.
Method
Edge Skillguard embeds a typed authority layer in Skill artifacts, using contract checks and guards over typed world state, events, leases, and sensor evidence before deterministic actions execute.
Results
Edge Skillguard rejected 60/60 Borrowed Authority requests across five attack variants without blocking benign requests; at 5× scale and across hosts, it preserved 300/300 attack rejection and 300/300 benign success.
Takeaways & Limitations
The results support co-packaging typed invocation policy with procedural knowledge so physical actions depend on machine-checkable evidence rather than peer-agent permission claims.
Takeaways & Limitations
The workshop concept paper evaluates hand-authored guards on a single edge testbed and does not include a formal information-flow checker or automated compiler.
Abstract
from arXiv · showhide
Self-evolving Skill harnesses (AutoSkills, Hermes Agent) generate more advisory orchestration automatically; their reported gains are efficiency, not safety. This misses the actual gap: a Skill describes how an agent should behave; a Policy decides which behavior is allowed to become an action. Today's format covers the first with markdown and scripts; the second is left to the model. Generating more Skills scales the gap, not the safety, especially when a wrong invocation can unlock a door or move money. Two adjacent attacks are documented: malicious skills compromising cloud software, and jailbroken LLM-controlled robots causing physical harm. Their intersection, malicious agent skills causing physical harm, follows directly but has not been reported. We name this class Borrowed Authority: Skills format gives the receiving agent no typed way to reject an inter-agent permission claim, so a malicious or misused Skill can drive actuation by attaching one. We propose Edge Skillguard, a typed authority layer that lives inside the Skill artifact rather than between tools as workflow engines do, with guards over world state and sensor evidence. On a live edge control-plane testbed, the guards reject 60/60 borrowed-authority requests across five attack variants without blocking benign requests, and the result holds at 5x scale and across hosts over a Tailscale mesh. These results suggest that high-risk Skills should co-package typed invocation policy with procedural knowledge, so that physical actions depend on machine-checkable evidence rather than peer-agent claims.
1 Introduction
As agent Skills move toward physical actuation, advisory procedural knowledge lacks an enforceable authority boundary. The paper names Borrowed Authority and proposes Edge Skillguard to enforce typed authorization at invocation.
- 1 Introduction: Physical-consequence Skills combine procedural agent behavior with actions that can affect the physical world.Examples include relays, door locks, and other actuators.
- 1 Introduction: Documented malicious Skills and jailbroken LLM-controlled robots populate adjacent attack landscapes, while their physical-consequence intersection remains publicly unreported.The paper characterizes this intersection as imminent rather than hypothetical.
- 1 Introduction: Borrowed Authority occurs when an inter-agent message attaches an unverifiable permission claim to an instruction that the receiving Skill cannot type-check.The script may execute deterministically, while the invocation authority remains invalid.
- 1 Introduction: Edge Skillguard packages a typed authority layer inside the Skill artifact and evaluates world state, leases, and sensor evidence before actuation.This targets orchestration-level authorization rather than script correctness.
- 1 Introduction: 60/60 borrowed-authority requests were rejected across five attack variants without blocking benign requests on an edge multi-agent testbed.This is the paper’s reported initial defense result.
2 Natural Language is not Authority
Natural-language Skills can execute deterministic scripts but leave authority decisions to model behavior. Edge Skillguard compiles high-risk transitions into typed guards over state and evidence, while retaining bounded LLM-mediated gaps explicitly.
- 2 Natural Language is not Authority: Deterministic scripts can run reproducibly, but deciding when to invoke them and whether evidence suffices is an authority decision.The paper distinguishes execution correctness from orchestration authorization.
- 2 Natural Language is not Authority: Edge Skillguard turns requirements such as resident presence into executable guards over typed state rather than advisory text.The same policy requirement is therefore evaluated by the runtime before transition.
- 2.3 Defining Edge Skillguard: An Edge Skillguard artifact models orchestration states, typed world state, typed events, deterministic actions, guard predicates, transitions, LLM holes, and inter-agent contracts.These components define the machine-checkable policy boundary.
- 2.3 Defining Edge Skillguard: Borrowed Authority is rejected when a message contains a natural-language permission claim but lacks required typed evidence such as a fresh presence token, valid lease, or authorized issuer.The evaluator emits either an inbox publish or a structured policy_block log naming failed predicates.
- 2.3 Defining Edge Skillguard: The policy is co-versioned with the Skill artifact and evaluates inter-agent messages against broker-attested envelope fields and substrate state.The paper distinguishes this enforcement point from workflow engines that sit between tools.
- 2.4 What Deployers Get: Typed authority reduces routine LLM calls, identifies missing predicates when blocking, and exposes policy coverage and stale-evidence rejection as Skill-quality dimensions.These deployer-facing outputs extend evaluation beyond task pass rate.
3 Demonstration
The demonstration evaluates Edge Skillguard on a live edge control-plane testbed across deployment tiers, attack variants, scale, and boundary cases. Full typed guards reject unauthorized transitions while preserving benign requests, but do not address compromised trusted principals or false sensor evidence.
- 3 Demonstration: The experiment measures whether unauthorized transitions reach the adapter boundary, not whether a physical lock changes state.Test subjects are isolated and intentionally do not trigger device adapters.
- 3.2 Result: Edge Skillguard rejects all 60 Borrowed Authority attacks across five variants and preserves all 60 benign requests.The workload covers stale presence, missing presence source, wrong-grantee lease, expired lease, and lease-scope mismatch.
- 3.2 Result: At 5× scale, the full policy preserves 300/300 attack rejections and 300/300 benign successes at p95 399 μs; cross-host correctness remains 300/300 at p95 7.9 ms.Latency is reported for the same broker and over a Tailscale mesh.
- 3.2 Result: The lease-only ablation catches 36/60 attacks but allows all 24 sensor-bound attacks, showing that sensor predicates add distinct coverage.The missed cases are stale presence and untrusted source variants.
- 3.2 Result: Policy evaluation remains microsecond-scale, while broker and overlay transport add roughly 85× amplification and another order of magnitude, respectively.Each rejection also identifies failed predicates, such as a presence observation exceeding its 30-second freshness limit.
- 3.3 Boundary Cases: Edge Skillguard allows a compromised trusted principal and spoofed physical evidence when all declared predicates remain satisfied.The paper frames these as out-of-scope failures requiring complementary defenses such as sensor attestation, multimodal verification, and audit-trail anomaly detection.
4 Related Work and Limitations
Related work improves procedural knowledge, planning, workflow determinism, or execution verification, but does not provide the typed authority boundary targeted by Edge Skillguard. The paper limits its evidence to a workshop concept evaluated on one testbed with hand-authored guards and a synthesized attack instance.
- Related Work: Curated Skills raise average pass rate by 16.2 percentage points, whereas self-generated Skills provide no average benefit in SkillsBench.This motivates improving procedural knowledge without relying on models to author it reliably.
- Related Work: LLM-IoT systems address planning, code generation, experience, or efficiency, but do not define typed inter-agent contracts for converting natural-language subtasks into physical actions.DS-IA is complementary because its verifier could operate against an Edge Skillguard policy artifact.
- Related Work: Blueprints and deterministic meta-tools reduce runtime model discretion in workflows, while Edge Skillguard targets authority for physical actuation.The distinction is between workflow-path optimization and deciding whether an action is authorized.
- Related Work: Edge Skillguard co-versions typed authorization with the Skill artifact and evaluates message-to-action transitions using attested envelope fields and substrate state.Its contribution is the packaging and enforcement point rather than inventing typed authorization.
- Related Work: Borrowed Authority is orthogonal to prompt-layer attacks because even a non-jailbroken model with a well-formed SKILL.md can act on an unverified permission claim.The attack concerns inter-agent authority claims rather than only prompt injection or skill injection.
- Limitations: The study uses hand-authored guards on a single edge testbed across three deployment tiers and includes no formal information-flow checker or automated compiler.Borrowed Authority is synthesized, with no public disclosure yet documenting a malicious skill causing physical-state harm.
5 Conclusion
The paper names physical-consequence Skill compromise and proposes Edge Skillguard as a typed boundary for deciding who may invoke actions and what evidence is required. On the testbed, it rejects every tested Borrowed Authority request while preserving benign requests.
- 5 Conclusion: Edge Skillguard fills the authority gap by requiring typed evidence for the transition from inter-agent message to physical action.The policy boundary asks who can invoke a script and on what evidence.
- 5 Conclusion: The paper frames the smart-home demonstration as a broader authority gap in Skills whose actions reach beyond the model.It proposes the defense before an in-the-wild incident and identifies trace-driven policy synthesis with embodied feedback as future work.
A Substrate Mechanics (Detail)
The substrate supplies typed, authenticated, durable, and auditable messaging primitives that support Edge Skillguard’s policy decisions. Its schema also constrains message types and predicate forms before policy evaluation.
- Envelope schema: The envelope schema uses a closed enum of message types with conditional fields tied to message type and the A2A v1.0 task-state lifecycle.For example, commands require recipient_id and task_id, while delegations additionally require context_id and hop_count.
- JetStream WorkQueue per-agent inbox: Per-agent JetStream WorkQueue inboxes provide durable delivery, DiscardNew backpressure, 1 MiB maximum messages, 24-hour retention, and five-minute duplicate suppression.Each agent has a durable consumer with max_ack_pending=1 for broker-level per-agent FIFO.
- Audit-mirror outbox: Every successful inbox publish is mirrored to the publisher’s outbox, creating two independently attested write-points for cross-agent actions.The dashboard reads the broadcast outbox rather than contending with the inbox’s exclusive consumer slot.
- Identity and authentication: Connection-attested NATS identities determine sender_id, and adapters reject payload sender identities that do not match the connection.Browser-origin envelopes are translated by the aggregator into typed inbox publishes with broker-set sender_id.
- Predicate vocabulary: The policy schema supports seven typed predicate operators over envelope or state paths, with operator-specific required fields checked at policy load.The operators include equality, inequality, membership, containment, freshness, and cross-field equality.