Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills

Peichun Hua; Haoxuan Xu; Mengyuan Li

arXiv preprint · 2026

Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills

Peichun Hua, Haoxuan Xu, Mengyuan Li

Read paper (PDF) arXiv record arXiv PDF

Overview

Behavioral skill reconstruction asks whether ordinary interactions with an LLM agent can reveal the functionality of a hidden skill even when its instructions, scripts, and files remain undisclosed. The paper introduces SKILLCLONE to study this threat.

Method

SKILLCLONE forms an interface hypothesis from the public skill description, issues valid task requests, synthesizes an executable replica, and repairs it through differential validation against the target. Evaluation separates functionality contributed by a skill from capabilities already present in the base model.

SKILLCLONE workflow from a public skill interface through hypotheses, adaptive probes and typed observations to clone synthesis and differential validation. — SKILLCLONE reconstructs behavior through valid task probes, executable synthesis, and differential validation. Figure 1 in the paper

Evaluation

The evaluation covers 30 skills spanning rules, tables, procedures, and algorithms. Several targets permit exact or partial recovery on held-out inputs, and iterative requerying closes gaps left by a single reconstruction round. The experiments show limited coverage from defenses focused only on direct file disclosure.

Behavioral reconstruction by dominant skill component
Component type	Skills	Median ASR	Skills above floor
Threshold / decision rules	5	83%	4 / 5
Lookup tables / data	10	82%	7 / 10
Rule composition	3	87%	3 / 3
Procedures / algorithms	6	77%	4 / 6
Numeric formulas	6	43%	3 / 6

From Table 1 of arXiv v2. Each skill contributes its median ASR across available full-OpenHands victims: Flash, Pro, and Luna for mined skills, and all five victims for SkillsBench. The displayed median and above-floor counts are computed within each component type. Table 1 in the paper

agent skills
functional cloning
black-box reconstruction
LLM agents
intellectual property
information leakage

Citation

@article{hua2026skillclone,
      title={Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills}, 
      author={Peichun Hua and Haoxuan Xu and Mengyuan Li},
      journal={CoRR},
      volume={abs/2608.04192},
      year={2026},
      url={https://arxiv.org/abs/2608.04192},
      doi={10.48550/arXiv.2608.04192},
      eprinttype={arXiv},
      eprint={2608.04192},
      primaryClass={cs.CR}
}