SkillEffect: Checked Lowering for Memory-Bounded Agent Tools

Yinuo Wang; Yiyu Shi

cs.AIAug 17, 2026

SkillEffect: Checked Lowering for Memory-Bounded Agent Tools

Authors: Yinuo Wang, Yiyu Shi

Organizations: Department of Computer Science & Engineering University of Notre Dame Notre Dame, IN, USA

Abstract

Agent Skills can specify procedural and resource obligations for tool use, and language models instantiate them as concrete programs. However, when models turn this guidance into code for existing tool interfaces, even a semantically correct program may load an entire input and exceed the memory available to one tool call. We present SkillEffect, a checked-lowering runtime for computations with a recoverable source relation, an audited bounded implementation, and a registered output postcondition. Before granting execution authority, an independent checker rebuilds each proposed lowering from the submitted program and immutable input. Every relation plugin supplies a source recognizer, input-fact extractor, bounded-IR constructor, arena-bound function, and postcondition; one common runtime provides checked selection, bounded-VM execution, atomic capacity leasing, and staged publication. Generality in SkillEffect is architectural rather than automatic: each supported computation requires an audited relation plugin, while the dispatch, resource-control, execution, and publication mechanisms are shared across plugins. Across six operator families, bounded access substantially reduces peak memory and improves completion under externally fixed caps. Six plugins instantiate the same contract across five execution patterns, from streaming reduction to bounded-heap Top-k. The XLSX onboarding study and Top-k extension show that a new relation and a new retained-state pattern reuse the same trust boundary, while the checker accepts all evaluated legal configurations and rejects all adversarial proposals. Together, these results show that one checked-lowering architecture can enforce heterogeneous registered memory relations at Agent tool dispatch.

Figures & tables

Figure 1: The SkillEffect trust boundary, illustrated with the two-million-row Polars S2 relation. The 338.6/69.5 MiB peaks are paired generous-cap operator measurements; 96 MiB is the same-input development cap, not an external-sweep tier. The builder’s lowering is untrusted. An independent checker identifies the unique matching relation, rebuilds source semantics and input facts, and validates the target configuration and live set; a bounded VM executes only the accepted IR under a capacity lease and publishes staged output only after its registered postcondition passes.

Relation	Source pattern	Execution pattern and retained state	Input facts $I_{r}$	Postcondition $G_{r}$
CSV / Polars	Eager relational pipeline	Streaming relational pipeline: projection, filters, and integer reduction; input window plus constant aggregates	Header and strict stream scan	Schema/range and aggregate invariants
FASTA / Biopython	Sequence-list materialization	Iterator/record reduction; input window plus fixed histogram	Bounded-line sequence scan	Record/base cardinality and conservation
FCS / FlowIO	Event-payload loading	Metadata projection from header/TEXT; bounded metadata state	File offsets, header, and TEXT segment	Requested metadata reconstructed from input facts
Zarr	Full-array materialization	Chunked incremental reduction; one chunk plus fixed histogram	Array metadata and raw chunks	Shape, unsigned sum, and histogram reconstructed from chunks
XLSX	Worksheet materialization	Iterator/row-window reduction; row window plus constant aggregates	Workbook metadata and row scan	Three aggregates reconstructed from row facts
Audit Top- $k$	Global materialization and sort	Bounded-heap Top- $k$ ; input window plus $k$ records	Strict JSONL stream scan	Cardinality, unique IDs, value ranges, and registered ordering

Table 1: Six executable plugins for one checked-relation contract, spanning five bounded-execution patterns. Each row supplies

S_{r}

I_{r}

L_{r}

A_{r}

, and

G_{r}

; the common checker additionally validates source, input, platform, target-IR, and bound bindings. “Retained state” describes the relation-specific variable state rather than the fixed platform reserve. The table separates relation-specific obligations from the common runtime mechanisms, which are not reimplemented per plugin.

Figure 2: Verifier-passing task completion under six externally frozen binary caps across all 24 tasks. Markers are the measured quota tiers; connecting segments aid comparison and do not denote intermediate-cap observations. The composition series includes its semantic coverage limit. On the same nine tasks for which the composition is valid, it and the bounded-lowering arm have identical completion at every cap, as quantified in the preceding paragraph.

Proposal class	Checker decision
Target-IR semantics	200/200 rejected
Resource understatement	80/80 rejected
Source semantics	80/80 rejected
Immutable input binding	40/40 rejected
Output-gate binding	40/40 rejected
Platform binding	40/40 rejected

Table 2: Checker decisions in the frozen five-relation validation matrix; Top-

k

extension checks are reported separately in Section 4.5 . Legal configurations vary VM resources; mutations alter semantics, resources, or bindings after recomputing all affected hashes.

Extension	Relation-specific code	Shared-core changes
XLSX	Checker: 216 VM operator: 63 Builder: 197	12 wiring lines Core path unchanged
Top- $k$	Recognizer + facts Heap target + arena Postcondition	Registration + routing Dispatch + freeze 7 core files unchanged

Table 3: Relation-interface extension accounting. Code-size counts are nonblank lines; shared changes connect each plugin to the common runtime.

Figure 3: Completion and measured cgroup peak under one 2 GiB cgroup. Panel (a) shows verifier-passing completion; panel (b) shows the corresponding physical peak, with the dashed horizontal line marking the cap. The hollow, hatched composition bars reach only 37.5% completion at concurrency 8 and 16; its lower peak reflects less completed work rather than greater capacity. The bounded-lowering arm completes every submission while remaining below the cap.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Family	Bounded form	Eager form
XLSX	load_workbook(read_only=True) or projected read_excel(usecols=...)	The same loaders without the mode or column projection
FlowIO	FlowData(..., only_text=True)	The same constructor without only_text , materializing event data
AnnData	read_h5ad(..., backed=’r’)	The same reader without backed , materializing the matrix
Zarr	Chunked slices and an incremental reduction	array[:] on the same array object
Polars	scan_csv(...).collect(engine=’streaming’)	Sibling read_csv followed by the same relational operations
Biopython	Single-pass consumption of the SeqIO.parse iterator	The caller wraps the same iterator in list(...)

Appendix

Table B.1: Bounded and eager access forms in each evaluated family.

Figure B.1: Largest-input eager and bounded physical peaks. Ratios are annotated at the eager bars; paired executions produce the same verified result.

Method	Tasks	Passed	Failures
Direct eager	0/24	0/72	72/0/0
Always-pin	9/24	27/72	12/33/0
Retry	4/24	12/72	9/51/0
Composition	9/24	27/72	0/15/30
Bounded lowering	24/24	72/72	0/0/0

Appendix

Table C.1: Constructive outcomes at per-family development caps in operator characterization. “Passed” counts verifier-passing runs; failures are reported as cap/verifier/abstention counts.

Family	Direct (s)	Bounded (s)	Ratio
XLSX	24.381	19.727	0.811
FlowIO	0.534	0.449	0.833
AnnData	1.355	1.098	0.846
Zarr	1.220	1.057	0.879
Polars	1.069	0.787	0.740
Biopython	3.136	1.947	0.622

Appendix

Table D.1: Matched warm-cache in-container process wall time at 2 GiB. Each row reports the median time over four tasks, each measured with six AB/BA pairs. Ratio is the median of the four per-task ratios, not the ratio of the two time medians.

Relation	Bound	Median peak	Peak range	Cert./exec. (s)
CSV / Polars	80.142	14.707	14.672–14.746	0.410/0.418
FASTA / Biopython	80.142	14.770	14.641–14.801	0.456/0.432
FCS / FlowIO	80.143	14.668	14.652–14.785	0.398/0.412
Zarr	80.266	14.711	14.664–14.746	0.409/0.426
XLSX	80.209	71.844	71.801–71.844	41.700/41.587

Appendix

Table E.1: Per-relation physical validation of the frozen five-relation admission configuration. Memory values are MiB over three fresh 128 MiB cgroups per relation; cert./exec. reports median capped phase wall times in seconds.

Runtime Enforcement for AI Agents

Runtime enforcement for AI agents checks and constrains actions as they execute, helping prevent unsafe or unauthorized effects.

See all 270 papers

May 12, 2026

SkillSmith: Compiling Agent Skills into Boundary-Guided Runtime Interfaces

Recently, skills have been widely adopted in large language model (LLM)-based agent systems across various domains. In existing frameworks, skills are typically injected into the agent reasoning loop as contextual guidance once matched to a runtime task, enabling specialized task-solving capabilities. We find that this execution paradigm introduces two major sources of redundancy: irrelevant context injection and repeated skill-specific reasoning and planning. To this end, we propose SkillSmith, a boundary-first compiler-runtime framework that compiles skill packages offline into minimal executable interfaces. By extracting fine-grained operational boundaries from skills, SkillSmith enables agents to dynamically access and execute only the relevant components at runtime, thereby minimizing unnecessary context injection and redundant reasoning overhead. In the evaluation on SkillsBench benchmark, SkillSmith reduces solve-stage token usage by 57.44%, thinking iterations by 42.99%, solve time by 50.57% (2.02x faster), and token-proportional monetary cost by 57.44% compared with using raw-skills. Moreover, compiled artifacts produced by a stronger model can be reused by a smaller or more efficient runtime model, improving task accuracy in cases where raw skill interpretation fails. The source code and data are available at https://github.com/AetherHeart-AI/Aeloon.

Duling Xu, Zheng Chen, Zaifeng Pan +4

AetherHeart Tech Co., Ltd., Shanghai, China · Renmin University of China, Beijing, China · University of California San Diego, CA, USA

LLM Agent Workflow Optimization LLM Agent Skill Retrieval LLM Agents LLM Agent Efficiency

Ask PDF

Aug 6, 2026

SkillZip: Contract-Preserving Graph Compression for Scalable Agent Skill Libraries

Large Language Models (LLMs) increasingly act as agents whose procedural knowledge is stored in reusable skill packages and loaded at inference time. As skill libraries grow, a central challenge is to expose the smallest sufficient executable context under a limited context budget. Existing systems struggle to reuse routines below the whole-skill level, preserve procedural contracts during compression, keep compressed routines executable and expandable, and update the compressed library as skills evolve. These challenges reveal a unit mismatch: skills are retrieved as packages, compressed as text, and converted into execution graphs only after retrieval, whereas reliable reuse requires a contract-bearing procedural unit. We propose SkillZip, an execution-aware procedural abstraction framework that performs contract-preserving compression over section-level graphs. SkillZip rewrites recurring contract-valid motifs into reversible ported macros while preserving boundary signatures, dependency closure, verifier reachability, and source-level expansion. At inference time, it hydrates a compact, dependency-closed context and expands macros only when required. ReZip further integrates new skills and revises risky macros using execution evidence. Comprehensive experiments1 on technical and embodied agent benchmarks show SkillZip consistently outperforms the strongest baseline by up to 12.2 points, while achieving a 3.46x compression ratio with 99.2% dependency preservation and 98.7% verifier reachability. Scaling analyses further confirm robust retrieval across skill libraries ranging from 200 to 100K skills.

Xingyu Tan, Xiaoyang Wang, Qing Liu +4

UNSW & CSIRO Sydney, Australia · UNSW Sydney, Australia · CSIRO Hobart, Australia +2

LLM Agent Skill Retrieval LLM Agent Harnesses

Ask PDF

Aug 23, 2026

When Not to Imitate: Boundary-Aware Skill Memory for Reliable Tool-Use LLM Agents

Extracting skills from past successes is critical for the efficient evolution of Large Language Model (LLM) agents. Prevailing agent self-evolution paradigms typically rely on a core assumption: equipping LLMs with skill memories derived from successful trajectories will monotonically improve their problem-solving capabilities. However, probe analyses reveal that extracting skills solely from successful trajectories traps the model in a Skill Imitation Trap. For tasks that resemble past successes but require different tools, retrieving more skills paradoxically increases the model's confidence in wrong tool calls---procedure skills raise the wrong-tool margin by

47\%

over a memory-free baseline. To overcome this limitation, we propose Boundary-Aware Skill Memory (BASM), which augments each skill with explicit boundary fields---applicability conditions, risk cues, avoidance rules, and recovery notes. These fields transform each retrieved skill from an unconditional action template into state-conditioned guidance: the agent applies the skill when its conditions hold, suppresses inapplicable tool calls when they do not, and issues targeted repairs when execution fails. Across three agent benchmarks and four model scales, BASM consistently outperforms success-distilled skill-memory baselines: it improves task success rate by up to

23.8\%

on AppWorld, accuracy by up to

5.0\%

on BFCL, and reduces attack success rate by

4.6\%

on AgentDojo, while simultaneously reducing average AppWorld steps by up to

6.6\%

relative to the memory-free baseline.

Zihan Lin, Zhenyu Chen, Jiawen Wei +6

Meituan · School of Advanced Interdisciplinary Sciences, University of Chinese Academy of Sciences · MAIS&NLPR, Institute of Automation, Chinese Academy of Sciences +1

LLM Agent Memory LLM Agent Skill Learning Memory-Augmented Language Model Agents Tool-Using Agents LLM Agent Reliability

Ask PDF

Abstract

Runtime Enforcement for AI Agents

Explore similar work

SkillSmith: Compiling Agent Skills into Boundary-Guided Runtime Interfaces

SkillZip: Contract-Preserving Graph Compression for Scalable Agent Skill Libraries

When Not to Imitate: Boundary-Aware Skill Memory for Reliable Tool-Use LLM Agents