SkillEffect: Checked Lowering for Memory-Bounded Agent Tools

Yinuo Wang; Yiyu Shi

cs.AIAug 17, 2026

SkillEffect: Checked Lowering for Memory-Bounded Agent Tools

Authors: Yinuo Wang, Yiyu Shi

Organizations: Department of Computer Science & Engineering University of Notre Dame Notre Dame, IN, USA

Abstract

Agent Skills can specify procedural and resource obligations for tool use, and language models instantiate them as concrete programs. However, when models turn this guidance into code for existing tool interfaces, even a semantically correct program may load an entire input and exceed the memory available to one tool call. We present SkillEffect, a checked-lowering runtime for computations with a recoverable source relation, an audited bounded implementation, and a registered output postcondition. Before granting execution authority, an independent checker rebuilds each proposed lowering from the submitted program and immutable input. Every relation plugin supplies a source recognizer, input-fact extractor, bounded-IR constructor, arena-bound function, and postcondition; one common runtime provides checked selection, bounded-VM execution, atomic capacity leasing, and staged publication. Generality in SkillEffect is architectural rather than automatic: each supported computation requires an audited relation plugin, while the dispatch, resource-control, execution, and publication mechanisms are shared across plugins. Across six operator families, bounded access substantially reduces peak memory and improves completion under externally fixed caps. Six plugins instantiate the same contract across five execution patterns, from streaming reduction to bounded-heap Top-k. The XLSX onboarding study and Top-k extension show that a new relation and a new retained-state pattern reuse the same trust boundary, while the checker accepts all evaluated legal configurations and rejects all adversarial proposals. Together, these results show that one checked-lowering architecture can enforce heterogeneous registered memory relations at Agent tool dispatch.

Figures & tables

Figure 1: The SkillEffect trust boundary, illustrated with the two-million-row Polars S2 relation. The 338.6/69.5 MiB peaks are paired generous-cap operator measurements; 96 MiB is the same-input development cap, not an external-sweep tier. The builder’s lowering is untrusted. An independent checker identifies the unique matching relation, rebuilds source semantics and input facts, and validates the target configuration and live set; a bounded VM executes only the accepted IR under a capacity lease and publishes staged output only after its registered postcondition passes.

Relation	Source pattern	Execution pattern and retained state	Input facts $I_{r}$	Postcondition $G_{r}$
CSV / Polars	Eager relational pipeline	Streaming relational pipeline: projection, filters, and integer reduction; input window plus constant aggregates	Header and strict stream scan	Schema/range and aggregate invariants
FASTA / Biopython	Sequence-list materialization	Iterator/record reduction; input window plus fixed histogram	Bounded-line sequence scan	Record/base cardinality and conservation
FCS / FlowIO	Event-payload loading	Metadata projection from header/TEXT; bounded metadata state	File offsets, header, and TEXT segment	Requested metadata reconstructed from input facts
Zarr	Full-array materialization	Chunked incremental reduction; one chunk plus fixed histogram	Array metadata and raw chunks	Shape, unsigned sum, and histogram reconstructed from chunks
XLSX	Worksheet materialization	Iterator/row-window reduction; row window plus constant aggregates	Workbook metadata and row scan	Three aggregates reconstructed from row facts
Audit Top- $k$	Global materialization and sort	Bounded-heap Top- $k$ ; input window plus $k$ records	Strict JSONL stream scan	Cardinality, unique IDs, value ranges, and registered ordering

Table 1: Six executable plugins for one checked-relation contract, spanning five bounded-execution patterns. Each row supplies

S_{r}

I_{r}

L_{r}

A_{r}

, and

G_{r}

; the common checker additionally validates source, input, platform, target-IR, and bound bindings. “Retained state” describes the relation-specific variable state rather than the fixed platform reserve. The table separates relation-specific obligations from the common runtime mechanisms, which are not reimplemented per plugin.

Figure 2: Verifier-passing task completion under six externally frozen binary caps across all 24 tasks. Markers are the measured quota tiers; connecting segments aid comparison and do not denote intermediate-cap observations. The composition series includes its semantic coverage limit. On the same nine tasks for which the composition is valid, it and the bounded-lowering arm have identical completion at every cap, as quantified in the preceding paragraph.

Proposal class	Checker decision
Target-IR semantics	200/200 rejected
Resource understatement	80/80 rejected
Source semantics	80/80 rejected
Immutable input binding	40/40 rejected
Output-gate binding	40/40 rejected
Platform binding	40/40 rejected

Table 2: Checker decisions in the frozen five-relation validation matrix; Top-

k

extension checks are reported separately in Section 4.5 . Legal configurations vary VM resources; mutations alter semantics, resources, or bindings after recomputing all affected hashes.

Extension	Relation-specific code	Shared-core changes
XLSX	Checker: 216 VM operator: 63 Builder: 197	12 wiring lines Core path unchanged
Top- $k$	Recognizer + facts Heap target + arena Postcondition	Registration + routing Dispatch + freeze 7 core files unchanged

Table 3: Relation-interface extension accounting. Code-size counts are nonblank lines; shared changes connect each plugin to the common runtime.

Figure 3: Completion and measured cgroup peak under one 2 GiB cgroup. Panel (a) shows verifier-passing completion; panel (b) shows the corresponding physical peak, with the dashed horizontal line marking the cap. The hollow, hatched composition bars reach only 37.5% completion at concurrency 8 and 16; its lower peak reflects less completed work rather than greater capacity. The bounded-lowering arm completes every submission while remaining below the cap.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Family	Bounded form	Eager form
XLSX	load_workbook(read_only=True) or projected read_excel(usecols=...)	The same loaders without the mode or column projection
FlowIO	FlowData(..., only_text=True)	The same constructor without only_text , materializing event data
AnnData	read_h5ad(..., backed=’r’)	The same reader without backed , materializing the matrix
Zarr	Chunked slices and an incremental reduction	array[:] on the same array object
Polars	scan_csv(...).collect(engine=’streaming’)	Sibling read_csv followed by the same relational operations
Biopython	Single-pass consumption of the SeqIO.parse iterator	The caller wraps the same iterator in list(...)

Appendix

Table B.1: Bounded and eager access forms in each evaluated family.

Figure B.1: Largest-input eager and bounded physical peaks. Ratios are annotated at the eager bars; paired executions produce the same verified result.

Method	Tasks	Passed	Failures
Direct eager	0/24	0/72	72/0/0
Always-pin	9/24	27/72	12/33/0
Retry	4/24	12/72	9/51/0
Composition	9/24	27/72	0/15/30
Bounded lowering	24/24	72/72	0/0/0

Appendix

Table C.1: Constructive outcomes at per-family development caps in operator characterization. “Passed” counts verifier-passing runs; failures are reported as cap/verifier/abstention counts.

Family	Direct (s)	Bounded (s)	Ratio
XLSX	24.381	19.727	0.811
FlowIO	0.534	0.449	0.833
AnnData	1.355	1.098	0.846
Zarr	1.220	1.057	0.879
Polars	1.069	0.787	0.740
Biopython	3.136	1.947	0.622

Appendix

Table D.1: Matched warm-cache in-container process wall time at 2 GiB. Each row reports the median time over four tasks, each measured with six AB/BA pairs. Ratio is the median of the four per-task ratios, not the ratio of the two time medians.

Relation	Bound	Median peak	Peak range	Cert./exec. (s)
CSV / Polars	80.142	14.707	14.672–14.746	0.410/0.418
FASTA / Biopython	80.142	14.770	14.641–14.801	0.456/0.432
FCS / FlowIO	80.143	14.668	14.652–14.785	0.398/0.412
Zarr	80.266	14.711	14.664–14.746	0.409/0.426
XLSX	80.209	71.844	71.801–71.844	41.700/41.587

Appendix

Table E.1: Per-relation physical validation of the frozen five-relation admission configuration. Memory values are MiB over three fresh 128 MiB cgroups per relation; cert./exec. reports median capped phase wall times in seconds.

Runtime Enforcement for AI Agents

Runtime enforcement for AI agents checks and constrains actions as they execute, helping prevent unsafe or unauthorized effects.

See all 273 papers

SkillSmith: Compiling Agent Skills into Boundary-Guided Runtime Interfaces
May 12, 2026Duling Xu, Zheng Chen, Zaifeng Pan +4LLM Agent Workflow Optimization LLM Agent Skill Retrieval
AetherHeart Tech Co., Ltd., Shanghai, China · Renmin University of China, Beijing, China · University of California San Diego, CA, USA
SkillZip: Contract-Preserving Graph Compression for Scalable Agent Skill Libraries
Aug 6, 2026Xingyu Tan, Xiaoyang Wang, Qing Liu +4LLM Agent Skill Retrieval LLM Agent Harnesses
UNSW & CSIRO Sydney, Australia · UNSW Sydney, Australia · CSIRO Hobart, Australia +2
When Not to Imitate: Boundary-Aware Skill Memory for Reliable Tool-Use LLM Agents
Aug 23, 2026Zihan Lin, Zhenyu Chen, Jiawen Wei +6LLM Agent Memory LLM Agent Skill Learning
Meituan · School of Advanced Interdisciplinary Sciences, University of Chinese Academy of Sciences · MAIS&NLPR, Institute of Automation, Chinese Academy of Sciences +1

May 12, 2026J/K move · Enter open · S save

SkillSmith: Compiling Agent Skills into Boundary-Guided Runtime Interfaces

Duling Xu, Zheng Chen, Zaifeng Pan, Jiawei Guan+3

AetherHeart Tech Co., Ltd., Shanghai, China · Renmin University of China, Beijing, China · University of California San Diego, CA, USA

LLM Agent Workflow Optimization LLM Agent Skill Retrieval LLM Agents LLM Agent Efficiency

Open paper AskPDF arXiv

Recently, skills have been widely adopted in large language model (LLM)-based agent systems across various domains. In existing frameworks, skills are typically injected into the agent reasoning loop as contextual guidance once matched to a runtime task, enabling specialized task-solving capabilities. We find that this execution paradigm introduces two major sources of redundancy: irrelevant context injection and repeated skill-specific reasoning and planning. To this end, we propose SkillSmith, a boundary-first compiler-runtime framework that compiles skill packages offline into minimal executable interfaces. By extracting fine-grained operational boundaries from skills, SkillSmith enables agents to dynamically access and execute only the relevant components at runtime, thereby minimizing unnecessary context injection and redundant reasoning overhead. In the evaluation on SkillsBench benchmark, SkillSmith reduces solve-stage token usage by 57.44%, thinking iterations by 42.99%, solve time by 50.57% (2.02x faster), and token-proportional monetary cost by 57.44% compared with using raw-skills. Moreover, compiled artifacts produced by a stronger model can be reused by a smaller or more efficient runtime model, improving task accuracy in cases where raw skill interpretation fails. The source code and data are available at https://github.com/AetherHeart-AI/Aeloon.

Abstract

Runtime Enforcement for AI Agents

Explore similar work

SkillSmith: Compiling Agent Skills into Boundary-Guided Runtime Interfaces

SkillZip: Contract-Preserving Graph Compression for Scalable Agent Skill Libraries

When Not to Imitate: Boundary-Aware Skill Memory for Reliable Tool-Use LLM Agents