PaperlayerView exact revision on arXiv

Source-linked AI summary

Towards a Systems Foundation for Agentic Skills: Architecture, Lifecycle, and Security

Sanket Badhe, Deep Shah, Priyanka Tiwari, Nehal Kathrotia

arXiv:2608.29596v1cs.AIcs.LGcs.MA

TL;DR

Long-horizon LLM agents face reliability, context, and execution bottlenecks, while existing prompting and stateless tool-calling approaches do not preserve reusable procedural knowledge. The paper formalizes externalized agentic skills and organizes their systems lifecycle, finding that their value depends on environmental feedback and remains bounded by verification and domain-scope limitations.

  • Problem

    Long-horizon agents accumulate early execution failures and repeatedly re-derive procedural routines because knowledge is lost across sessions.

  • Method

    The paper develops a systems foundation for modular skills that externalize procedural knowledge, distinguish it from adjacent abstractions, and organize its lifecycle across discovery, execution, adaptation, evaluation, and security governance.

  • Results

    Across 120+ cybersecurity CTF tasks, procedural skills produced zero statistically significant gain over raw tool-use baselines, with an 8.9 percentage point spread (p = 0.71).

  • Takeaways & Limitations

    Skill utility is not universal: in high-feedback environments, immediate diagnostics can supply the self-correction loop that procedural guidelines would otherwise provide.

  • Takeaways & Limitations

    The analysis emphasizes software engineering, operating-system automation, web navigation, and data analysis, while real-world robotic control requires dedicated study of physical dynamics and hardware latency.

Abstract

from arXiv · show

Autonomous large language model (LLM) agents increasingly face reliability, context consumption, and execution stability bottlenecks when deployed on complex, long-horizon tasks. While monolithic prompt engineering and stateless tool-calling paradigms struggle to scale, the field is rapidly converging toward \emph{agentic skills}: modular procedural abstractions that externalize execution knowledge into reusable, executable, and portable artifacts. This paper establishes a unified systems foundation and reference architecture for the agentic skills ecosystem. We formalize skills as externalized procedural knowledge bridging high-level cognitive planning with deterministic execution environments, and systematically delineate the architecture across a nine-stage lifecycle: autonomous discovery, authoring and representation formats, memory storage, dynamic retrieval and routing, composition and orchestration, execution and repair, lifelong adaptation, empirical evaluation, and security governance. We further examine marketplace dynamics, public registries, and emerging adversarial threat vectors, alongside runtime verification and defense mechanisms. Finally, we categorize system implementations across software engineering, operating system navigation, embodied robotics, and scientific discovery, while highlighting critical open challenges in continual learning and benchmark realism. This work establishes agentic skills as a foundational paradigm for building scalable, robust, and verifiable autonomous language agents.

1 Introduction

Long-horizon agents suffer from early execution errors, unrecoverable downstream failures, and procedural knowledge that does not persist across sessions. The paper proposes externalized executable skills and formalizes their lifecycle, boundaries, and ecosystem.

  • Motivation: Long-horizon agents are especially vulnerable to early execution and path-resolution errors that propagate downstream without recovery.Agents may loop or exhaust recursion limits instead of revisiting faulty premises.
  • Motivation: Procedural knowledge remains trapped in discarded transcripts, forcing agents to re-derive routines across sessions.Context-window storage adds token costs, while fine-tuning cannot track rapidly changing tools, APIs, and conventions.
  • Proposed abstraction: Externalized executable skills package activation conditions, instructions, tools, and executable assets into reusable artifacts that load selectively and can be revised without retraining.This abstraction separates high-level planning from deterministic execution.
  • Formalization: The paper formalizes a skill as s = (A, I, C, T, π, E), covering activation, instructions, constraints, tools, execution policy, and intended effects.These components define the skill’s procedural interface and state-transition behavior.
  • Formalization: Skills require encapsulated modularity, late-binding invocation, and procedural state transformation rather than static prompting, episodic logging, or atomic tools.Composite workflows and recovery-enabled tool wrappers qualify when externalized and dynamically retrieved.
  • Scope and contributions: Skills uniquely combine persistence across resets, external execution, runtime composition, and modification without retraining, but cannot be fully verified before invocation.The latter property motivates the paper’s security analysis.
  • Scope and contributions: The paper contributes a unified systems foundation, a nine-phase lifecycle architecture, domain taxonomy, and analysis of marketplaces, registries, evaluation suites, and runtime defenses.The lifecycle spans discovery, representation, storage, routing, orchestration, execution and repair, adaptation, evaluation, and security governance.

2 Foundations of Skill-Based Agents

The foundations view skills as non-parametric procedural memory externalized from the model and activated conditionally within a formal agent state. This architecture supports progressive disclosure, capability-constrained execution, and conditional state transitions.

  • Procedural foundations: Agentic skills function as non-parametric procedural memory, distinct from declarative facts and episodic trajectory logs.Unlike transient plans, they are persistent, generalized, and reusable across multi-session lifetimes.
  • Externalization: Externalized skill files enable progressive disclosure: agents read lightweight metadata first and load implementation code only during execution.Plain-text storage also permits updates without model retraining.
  • Formal primitives: The framework formalizes skills as reusable procedural abstractions containing activation conditions, instructions, constraints, tools, execution policy, and intended effects.This abstraction provides the mathematical basis for the lifecycle architecture.
  • Formal primitives: Agent state includes conversation history, internal memory, environment observations, tool outputs, active goals, and retrieved documents.Conditional activation evaluates this state together with the active goal.
  • Security boundary: Capability-based permissions require a skill’s declared tools to be a strict subset of the tools permitted by the active execution context.Violating this containment condition defines privilege escalation and separates sandboxing from static auditing.
  • Execution semantics: When activated, a skill applies its execution policy and instructions through deterministic tool interaction to produce a conditional state transition.The transition is represented as x_t+1 = s(x_t) when the activation condition holds.

3 Procedural Skill Lifecycle in LLM Agents

The procedural skill lifecycle spans discovery, acquisition, verification, and continual management, but current discovery systems differ in how they generate skills, use failures, and control repository growth. The main bottlenecks are sparse-environment exploration, skill proliferation, and unreliable automated vetting.

  • Lifecycle overview: The lifecycle governs skills from creation through runtime deployment, adaptation, and eventual decommissioning.It is presented as the core operational architecture for reliable, safe, and efficient agent capability ecosystems.
  • Discovery and acquisition: Skill discovery extracts reusable sub-policies from long-horizon rollout histories and maps them into candidate skill representations.The discovery operator D processes trajectories containing observations, actions, rewards, and conversational context.
  • Discovery and acquisition: Candidate sub-trajectories are selected for persistent environmental outcomes and reduced decision entropy, then assigned applicability contexts that define triggering conditions.The applicability context identifies states where the routine remains numerically or semantically stable.
  • Discovery and acquisition: Acquisition consolidates raw candidates into production-ready skills and commits them to procedural memory only after verification checks.Verification may use unit tests, static AST analysis, or formal invariant proving to detect regressions, interface drift, and privilege-escalation vulnerabilities.
  • Discovery approaches: Existing discovery architectures span autonomous reinforcement learning, inductive AI synthesis, and evolutionary search over textual prompts or code.These approaches differ in trajectory sources, optimization assumptions, and the amount of demonstration data required.
  • Failure signals: Failure handling ranges from discarding failed trajectories to using verifier feedback, targeted patches, and contrastive boundaries during skill synthesis.Failure-aware methods include patch generation from file diffs and mismatches, dense verifier feedback, and clustering of success and failure summaries.
  • Open bottlenecks: Three bottlenecks limit autonomous discovery: sparse-environment exploration, repository dilution by redundant skills, and unreliable LLM-based admission judges.The paper links these problems to zero-to-one capability gaps, retrieval confusability, and missed syntax errors or stealthy payloads.

3.2 Skill Authoring and Representation

Skill authoring ranges from manual engineering to autonomous synthesis and human-in-the-loop collaboration, while representations trade portability against pre-execution verifiability. Across formats, natural-language instructions remain a security blindspot because they are not checked before runtime invocation.

  • Authoring paradigms: Skill authoring uses manual human engineering, autonomous AI synthesis, or collaborative hybrid workflows.Hybrid systems combine human-defined schemas, safety constraints, and permission boundaries with generated implementations and sandboxed testing.
  • Representation formats: Natural-language SKILL.md and SOP representations maximize portability by encoding procedures as human-readable instructions and checklists.These formats are designed to work across arbitrary LLM harnesses.
  • Representation formats: Structured JSON, YAML, DSL, and state-machine formats support parameter typing and schema validation but lack arbitrary procedural computation.They can encode validated UI transitions and API calls while restricting agents to declarative parameter passing.
  • Representation formats: Executable programmatic specifications support complex control flow and deterministic error handling but require sandboxing and introduce code-execution security vulnerabilities.Their capabilities include state queries, loops, conditional branching, runtime stack traces, and static AST linting.
  • Representation formats: Hybrid and adaptive representations combine natural-language guidance, declarative schemas, and executable scripts in structured hierarchical packages.Graph-based organization can represent procedural dependencies for hierarchical retrieval.
  • Verifiability trade-off: Across the main format gradient, increasing pre-execution verifiability corresponds to decreasing portability across heterogeneous LLM harnesses.The comparison places natural language through formal contracts on a monotonic trade-off, while hybrid formats sit outside the main gradient.
  • Security blindspot: No current representation format verifies natural-language instructions or activation conditions before runtime invocation.Structured and contract-based formats constrain tools and executable code, but prose in docstrings, comments, or prompts remains exposed to indirect injection.

3.3 Skill Storage and Memory Architecture

The paper organizes agent expertise across memory tiers that compress experience, preserve reusable procedures, and manage context limits. It also emphasizes curation because growing skill libraries create retrieval pollution, technical debt, and catastrophic forgetting.

  • Memory tiers: Memory architectures partition agent expertise across episodic, procedural, virtual-paging, and symbolic tiers along an experience-compression continuum.Episodic memory retains raw traces, while other tiers progressively consolidate operational knowledge and constraints.
  • Memory tiers: Episodic traces preserve operational granularity but rapidly saturate context windows and increase inference latency when loaded directly.
  • Memory tiers: Procedural memory stores persistent, executable skills that decouple reusable workflows from noisy episodic histories.These artifacts can be invoked across task instances without retaining full execution traces.
  • Curation: Utility-aware curation evaluates counterfactual performance gain against retrieval, token, and execution costs, evicting skills below thresholds or with decaying activation.The update operator also incorporates newly consolidated candidates and evicted skills.
  • Failure modes: Uncontrolled growth produces context overflow, retrieval confusability, dependency drift, and stability–plasticity conflicts that can cause memory-level forgetting.Large uncurated repositories also degrade downstream task completion by saturating retrieval indices.
  • Retrieval implications: At ecosystem scale, selective retrieval and routing become necessary because exposing entire repositories in context is computationally intractable.Metadata-only routing can also fail when similar descriptions conceal materially different procedural constraints.

3.5 Skill Composition and Synthesis

Skill composition extends isolated procedures into multi-step workflows through sequential pipelines, typed DAGs, hierarchical delegation, and multi-agent orchestration. The central design trade-off is between token-efficient single-agent loading and context-isolating distributed architectures.

  • Composition: Long-horizon workflows require composition architectures that combine, chain, and orchestrate multiple atomic skills.
  • Composition structures: Sequential composition passes one skill’s terminal output into the next skill’s execution context under the precondition E1 ⊆ C2.
  • Composition structures: Dynamic DAG orchestration represents skills as execution nodes and dependencies as typed data-flow or control-flow edges, enabling localized repair of affected descendants.
  • Composition structures: Hierarchical and recursive invocation delegates sub-goals to specialized skills, isolates intermediate reasoning, and supports nested sub-problem resolution.
  • Orchestration paradigms: Single-agent dynamic loading reduces inference-token consumption and conversational latency, whereas multi-agent collaboration distributes expertise across specialized roles.
  • Orchestration trade-offs: Single-agent routing undergoes a capacity phase transition: beyond a critical library size, attention dilution and semantic interference sharply reduce selection accuracy, favoring partitioned multi-agent systems.

3.6 Skill Execution, Verification, and Repair

Execution architecture combines conditional activation, capability checks, explicit state transitions, sandboxing, runtime verification, and localized repair. These mechanisms aim to contain unauthorized actions, control context growth, and recover from failures without restarting entire workflows.

  • Runtime execution: Skills activate from the current state and goal, but execution is permitted only when declared tools are authorized in the active context.Violating the subset constraint causes the runtime to intercept the invocation before dispatch.
  • State management: Traditional append-only histories incur O(T^2) cumulative token consumption, while mutable execution state maintains a bounded prompt footprint per step.SKILL.state applies validated state patches and discards intermediate reasoning after each transition.
  • Security: Sandboxed containers isolate arbitrary commands and mutations, but effective defense also requires syscall filtering and network-egress restrictions because misconfiguration can permit container breakout.
  • Verification: Execution verification spans formal pre/post-condition checks, interactive verifier tools, and static-dynamic constraint proving.These paradigms respectively identify invariant violations, critique intermediate outputs, and prevent tainted data from reaching sensitive sinks.
  • Repair: Localized repair attributes failures to upstream sub-skills, replans only reachable DAG descendants, or iteratively reflects on runtime tracebacks.GraSP reduces recovery complexity from O(N) full replanning to O(dh) descendant-subgraph repair.

3.7 Skill Adaptation and Evolution

Skill adaptation operates at short-term and lifelong horizons, adjusting parameters during inference and evolving persistent libraries and decision policies across sessions. Evaluation shows broad promise but exposes interference, retrieval noise, benchmark contamination, and domain-dependent utility limits.

  • Adaptation horizons: Non-stationary environments require both in-context adaptation during active inference and persistent procedural evolution across sessions.
  • Short-term adaptation: Short-term methods use verifier feedback and introspective correction to tune parameters, diagnose execution warnings, and refine plans before terminal actions.
  • Lifelong evolution: Long-term methods refine textual instructions, optimize skill parameters and membership, and automate interface standardization or redundant-skill pruning.
  • Co-evolution: Policy-skill co-evolution is presented as necessary because decision policies and procedural libraries jointly shape agent behavior.An isolated surrogate verifier can provide adversarial checks against spurious execution shortcuts.
  • Open vulnerabilities: Uncontracted co-adaptation can create brittle planner dependencies, so upgrading an upstream skill may silently cause regressions on previously solved tasks.
  • Evaluation: Evaluation spans correctness, continual learning, retrieval noise, graph scalability, and token economy, but open-registry distractors, backward interference, and shared APIs remain difficult settings.
  • Evaluation: SKILL.state reduces token costs from quadratic O(T^2) to linear O(T) while improving task pass rates in the reported evaluations.
  • Evaluation boundary: In high-feedback CTF environments, procedural skills produced no statistically significant gain over raw tool use, with an 8.9 percentage point spread and p = 0.71.

3.9 Security, Governance, and Market Defenses

Agentic skills expand the attack surface across unverified instructions, execution policies, credentials, and multi-skill supply chains. Defense therefore requires coordinated static auditing, runtime monitoring, collaborative testing, and marketplace governance.

  • The six-tuple maps skill vulnerabilities to procedural components, with unverified instructions and activation conditions serving as primary conduits for zero-click privilege escalation.
  • Threats include indirect prompt injection, backdoored execution policies, credential exfiltration, and compositional supply-chain escalation.
  • Table 7 compares 18 offensive systems across indirect prompt injection, backdoor or Trojan attacks, credential exfiltration, and ecosystem or supply-chain risk.
  • Table 8 compares 11 defense architectures across pre-admission auditing, runtime filtering, multi-agent auditing, and marketplace governance.
  • Defenses span pre-admission static auditing, dynamic runtime guardrails, collaborative multi-agent testing, and platform governance with access controls and signature verification.

4 Taxonomy of Skills

The taxonomy distinguishes procedural skills by capability type and operational domain, while comparing authoring and representation strategies. It also highlights trade-offs between portability, structured execution, compositionality, and environmental stability.

  • Procedural skills are classified into instructional SOPs, tool and API calling, reasoning and planning, domain-specific execution, and collaborative or meta-skills.
  • Instructional SOP Skills: Instructional SOP skills constrain action selection through natural-language procedures and can be mined, compressed, or manually authored.
  • Table 9 compares 16 systems across instructional SOP, tool and API calling, software engineering, GUI and OS navigation, and embodied robotics domains.
  • Instructional SOP Skills: Instructional SOPs maximize cross-model portability but remain vulnerable to semantic ambiguity and indirect prompt injection.
  • Tool and API Calling Skills: Tool and API skills translate language intent into structured invocations, using schema-validated parameters and architectures for tokenization, retrieval, verification, hierarchy, and composition.
  • Tool and API Calling Skills: Tool-calling skills provide deterministic execution but can fail silently when remote APIs drift unless wrappers use schema synchronization or runtime contract verification.
  • Reasoning and Planning Skills: Reasoning and planning skills operate within the latent workspace, mapping the current state and goal to an explicit sequence of thought tokens.

5 Skill Ecosystems and Marketplaces

Agentic skills are moving from isolated repositories toward public registries and marketplaces that support discovery, composition, evaluation, and governance. Evidence shows benefits from structured skill use but substantial fragility and security risk in open pools.

  • Public registries distribute packages combining natural-language guidance, executable scripts, and container specifications across agent backbones.
  • At 200 to 200,000 skills, AgentSkillOS uses hierarchical capability trees and DAG compilation to address retrieval crowding and ranking saturation.
  • Autonomous retrieval from 34,000 real-world skills substantially degrades end-to-end task success compared with idealized oracle skill subsets.
  • Continual Learning: SkillsBench evaluates 87 tasks across 8 domains and reports consistent pass-rate improvements over base LLMs, while SkillLearnBench finds persistent memory interference and procedural drift.
  • Continual Learning: SkillFlow finds that workflow-level composite skills transfer across structurally analogous tasks better than isolated atomic SOP checklists.
  • Security and Governance: SkillSec-Eval identifies vulnerabilities across all five lifecycle stages in 327 enterprise skills spanning 15 domains.
  • Security and Governance: Audits report undeclared capabilities, excessive permissions, weaponized instructions, and markdown-layer injection pathways in large community skill pools.
  • Domain Testbeds: Interactive benchmarks show that execution success can fall exponentially with DAG depth, whereas static skills provide no significant gain in high-feedback CTF environments.

6 Open Challenges and Future Directions

The field’s next challenges concern model dependence, retrieval at registry scale, recoverable orchestration, supply-chain security, continual-learning drift, and realistic feedback-sensitive evaluation. Progress requires compact representations, hierarchical routing, localized repair, stronger governance, and interactive benchmarks.

  • Current authoring relies heavily on frontier models, while small or quantized models face context limits, schema brittleness, and formatting hallucinations.
  • Scaling registries to millions of skills requires hierarchical capability trees and self-reflective meta-routers because flat dense retrieval suffers semantic crowding and distractor collisions.
  • Typed DAG orchestration can restrict recovery to failed dependency subtrees instead of aborting the whole sequence or triggering global replanning.
  • Open community distribution creates description-implementation gaps, container breakout risks, indirect prompt injection, and stealthy exfiltration pathways.
  • Simultaneous adaptation of decision policies and skill memories can produce co-adaptation drift when noisy rewards reinforce suboptimal heuristics.
  • The Environment-Feedback Bandwidth Hypothesis predicts diminishing marginal skill utility in environments with rich diagnostic traces, motivating interactive long-horizon benchmarks.

7 Conclusion

Externalized executable skills mark a shift from monolithic prompting and atomic tool use toward architectures that separate cognitive planning from deterministic procedural execution. The paper formalizes this abstraction and establishes a unified lifecycle-oriented reference architecture.

  • The transition beyond monolithic prompting and atomic tools addresses context scaling and reliability bottlenecks in contemporary LLM systems.
  • Skill-based architectures decouple high-level cognitive planning from deterministic procedural execution.
  • The paper formalizes agentic skills and establishes a unified lifecycle-oriented reference architecture.

8 Limitations

The paper identifies scope boundaries arising from the field’s rapid evolution, its emphasis on software-oriented domains, and its focus on English-language and Python/JavaScript-centric implementations.

  • Runtime frameworks, proprietary APIs, and model-specific tool harnesses will continue evolving beyond the systems analyzed.
  • The analysis centers on software engineering, operating system automation, web navigation, and data analysis rather than specialized robotic control.
  • The implementation analysis focuses on English-language and Python/JavaScript-centric skills, reflecting current open-source registries and public benchmarks.
Loading 2608.29596v1…