Behavioral Skill Reconstruction (SkillClone) via Black-Box Querying of Closed-Source Agent Skills

Technical Analysis

The attack treats a closed-source agent skill as a black-box oracle: the attacker forms a hypothesis of its input/output interface from public marketing/documentation, then issues a structured sequence of ordinary, policy-compliant task requests to probe behavior across rules, tables, procedures, and algorithms. Observed input-output pairs are used to synthesize a candidate implementation, which is iteratively refined via differential testing against the real skill until outputs converge (exact or partial recovery on held-out inputs). The entry point is the standard task-invocation interface of the skill/agent service — no prompt injection, jailbreak, or file exfiltration is required, so existing anti-disclosure and injection defenses do not detect or prevent it. The attacker gains a functional clone of proprietary business logic (constants, procedures, decision rules) that can be redeployed independently, crossing the boundary between 'service access' and 'IP ownership' entirely through legitimate API/agent usage patterns.

Detection Signatures

• High-volume or systematically varied query sequences targeting a single skill/tool endpoint from one client identity
• Query patterns resembling structured input-space sweeps (boundary values, edge cases, parameter grids) rather than organic task usage
• Repeated near-duplicate requests differing by small input perturbations consistent with differential/black-box probing
• Unusually high API/skill invocation rate per user relative to typical task-completion baselines
• Client behavior correlating observed outputs across sessions to refine a local model (inferred via request/response timing and clustering, not directly observable server-side without instrumentation)

Remediation Steps

1. 1

   Rate-limit and monitor per-user skill invocation patterns

   Track query diversity, volume, and systematicity per user/API key to detect probing behavior indicative of interface reverse-engineering, not just malicious content.

2. 2

   Introduce output perturbation or watermarking

   Add controlled non-determinism, rounding, or watermarking to skill outputs to degrade the fidelity of behavioral cloning while preserving task usefulness.

3. 3

   Limit cumulative information exposure

   Cap the number of distinct queries or total information-theoretic exposure a single user can extract over time, independent of any single request being benign.

4. 4

   Tiered access and licensing controls

   Require authenticated, licensed access with usage auditing for high-value proprietary skills, and contractually prohibit reverse engineering via terms of service enforcement.

5. 5

   Treat functional secrecy separately from file secrecy

   Recognize that preventing prompt-injection-based file disclosure is insufficient; design threat models and defenses explicitly around black-box functional extraction.