Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound

Genliang Zhu; Chu Wang

cs.CRSep 5, 2026

Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound

Authors: Genliang Zhu, Chu Wang

Organizations: Accentrust · Georgia Institute of Technology · Accentrust, Vancouver, Canada · Georgia Institute of Technology, Atlanta, Georgia, USA ·

Abstract

Agent Skills combine instructions with files, packages, tools, models, and services, so operational identity can exceed a signed directory. Recursive or lazy dependencies may change while root-level evidence remains valid, and different surfaces may reach the same durable effect. We present ClosureBound, a reference monitor that prevents authorization transfer across material changes to this heterogeneous closure. Its resolver commits typed graph nodes and topology. Each grant binds an exact closure root, effect ceiling, purpose/provenance, validity, and epochs. At durability, it re-resolves closure and state, normalizes the operation into an external-effect IR, and admits it only if a joint witness satisfies every bound. Supported equivalent paths share one ceiling. Assuming complete mediation and discovery, authenticated freshness, sound normalization, cryptographic binding, and authoritative linearization, we establish metadata non-authority, closure determinism, version non-inheritance, effect non-amplification, bound-value freshness, and path invariance. We do not establish program equivalence or remote-service honesty. A provider-free implementation matches 40 frozen lifecycle fixtures; 18 kernel contracts and six mutants cover binding and downgrade cases. Full-profile exploration reaches 84,608 states and 530,752 transitions without a declared invariant violation; six weakened profiles yield witnesses. A lexical audit of 549 public Skills (4,872 unique files) finds that 21 of 526 roots with bundled files name every non-manifest path verbatim, 67 contain links resolving outside their roots, and no root declares a frontmatter dependencies field. These observations motivate conservative closure discovery and define concrete targets for broader runtime, interoperability, efficacy, and production validation.

Figures & tables

Panel of Figure 1 — Figure 1. The authorization-transfer gap. Load-time integrity of a root Skill does not bind a later transitive resolution or an equivalent effect path. ClosureBound rebinds the exact closure and normalized effect at operation time. Blue denotes trusted authority, purple identity, amber change, green the effect boundary, and red a rejected transfer. A loop from a task grant through a load-time root check, a lazy dependency update, a durable effect, and silent reuse of old authority.

Question	In scope	Explicitly out of scope
Skill identity	Canonical represented transitive closure and topology	Complete semantic dependency discovery for arbitrary prose/code
Authorization	Exact closure/effect joint witness under a trusted task grant	Inferring latent user intent or proving the grant is normatively correct
Runtime	Mediated prepare/commit and current epochs	Unmediated sinks, compromised monitor, Byzantine infrastructure
Effects	Finite adapter-defined external-effect IR	General program equivalence, receiver honesty, guaranteed rollback
Evidence	Finite conformance, mutants, bounded model, local kernel cost	Hosted-model efficacy, ecosystem prevalence, production SLOs

Table 1. Research scope and evidence boundary.

Panel of Figure 2 — Figure 2. ClosureBound architecture. Authority, exact transitive identity, current state, purpose/provenance, and the normalized effect meet at one operation-time decision. A material change creates a new grant; it never edits the old closure binding. A pipeline with trusted task grant, closure resolver, graph root, current state, effect normalizer, joint predicate, atomic commit, reauthorization, and deny or indeterminate outcomes.

Panel of Figure 3 — Figure 3. Operation-time update discipline. Preparation never makes an old closure authoritative. A distinguishable material mismatch at the linearization point forces denial or a new grant. Timeline from prepare, through dependency update and re-resolution, to either deny and reauthorize or atomic commit.

Profile	Root	Closure	Effect	Commit refresh	Correlation	Purpose
Metadata/manifest only	–	–	–	–	–	Negative control
Root identity	$\checkmark$	–	–	–	–	Flat-root binding
Load-time closure	$\checkmark$	$\checkmark$	–	–	–	Exact load snapshot
Effect-only commit	–	–	$\checkmark$	$\checkmark$	$\checkmark$	Effect boundary
Prepared closure + effect	$\checkmark$	$\checkmark$	$\checkmark$	–	$\checkmark$	Composed prepare binding without commit-time closure/effect/state refresh
ClosureBound	$\checkmark$	$\checkmark$	$\checkmark$	$\checkmark$	$\checkmark$	Full joint predicate

Table 2. Transparent reference profiles. A check mark means that the finite reference evaluator performs the dimension.

Profile	Exact	Unsafe allow	Decision err.	Main omitted protection
Metadata/manifest only	8	32	32	Trusted recursive identity and effect gate
Root identity	14	26	26	Transitive closure and normalized effect
Load-time closure	20	20	20	Operation-time refresh and effect binding
Effect-only commit	24	16	16	Artifact/closure identity
Prepared closure + effect	32	8	8	Commit-time freshness/replay fencing
ClosureBound	40	0	0	None within represented profile

Table 3. Finite fixture results. Unsafe allow is the security error; false denial counts benign rows denied contrary to their exact oracle. Profiles are mechanism classes, not reproduced cited systems.

Mutant	First violated invariant	Minimal witness
Project out material package	I2 exact closure	Full resolver reauthorizes; projected resolver/grant omits changed package and commits
Omit commit epoch	I4 current operation	Full gate reauthorizes after redeploy; mutant accepts prepared epoch
Omit commit root	I2 exact closure	Full gate reauthorizes after helper update; mutant accepts prepared root
Trust shell surface	I5 path invariance	Full clause gate rejects; named shell path bypasses normalized policy
Union clause fields	I3 non-amplified effect	Full relation rejects; mutant combines recipient and amount from distinct clauses
Omit reservation freshness	I4 current operation	Full gate denies consumed nonce; mutant commits its replay

Table 4. Single-point full-profile mutants and minimized witness shape.

Source	Skills	Unique files	Bundled roots	All paths named	Roots with cross-root links
Anthropic Skills	19	411	18	6	0
OpenAI Plugins	530	4,461	508	15	67
Total	549	4,872	526	21	67

Table 5. External static closure audit at two fixed public commits. “All paths named” is evaluated only among roots with bundled files. It is a strict lexical measure, not semantic dependency recall.

Work	Exact hetero. artifact closure	Runtime authority	Durability refresh	Realized-effect normalization	Joint witness	Primary scope
Skills Are Not Islands ( Jia et al., 2026 )	$\circ$	–	–	–	–	Measurement and dependency management
SkillFortify ( Bhardwaj, 2026 )	$\circ$	$\circ$	–	–	–	Static analysis, SAT resolution, lockfile
OpenAPM v0.1 ( Microsoft, 2026 )	$\circ$	–	–	–	–	Install-time package/lock/policy draft
SIGIL ( Shen et al., 2026 )	$\circ$	$\circ$	–	–	–	Audit-to-load integrity
SkillGuard ( Pan et al., 2026 )	$\circ$	$\checkmark$	$\circ$	$\circ$	–	Skill permission framework
Edge Skillguard ( Zhan and Haddadi, 2026 )	$\circ$	$\checkmark$	$\circ$	$\circ$	–	Physical-world state/sensor guards

Table 6. Closest-work capability matrix. “Exact heterogeneous closure” requires authenticated operational Skill/package/tool/model/service structure; “joint witness” binds that closure and realized effect in one durability-time authorization record.

Work	Adjacent public abstraction	Not re-claimed here
OpenPort	Protocol facts, policy/effect vocabulary, conformance discipline	Protocol novelty or published runtime evidence
IGAC	Authenticated current-task certificate	Intent inference and IGAC empirical results
EBTE	Server-owned claims and digest-bound evidence	Explanation verification novelty and observations

Table 7. Public team-work reuse boundary. Prior observations and denominators are not ClosureBound evidence.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Symbol	Meaning
$\mathcal{G}_{t}(s;\pi,c_{\pi},B)$	Typed transitive capability graph under profile/canonicalizer $(\pi,c_{\pi})$ and candidate effects $B$
$q_{t}(v)$	Canonical authenticated evidence record for node $v$
$\rho_{t}(s;\pi,c_{\pi},B)$	Root-, context-, and endpoint-sensitive SCC/Merkle graph commitment
$\gamma$	Trusted correlated task/closure/effect grant
$\mathcal{N}(x,S)$	Partial trusted surface-to-effect normalizer
$A_{\mathrm{cur}}(t,e)$	Current task, closure, state, and purpose/provenance meet

Appendix

Table 8. Core notation.

Input	Trust treatment	Failure behavior
Skill name/description/prose	Untrusted discovery/instruction data	Cannot mint authority
Skill manifest/lockfile	Evidence only; authenticated if possible	Missing/unknown material edge denies exact profile
Supply-chain attestation	Authenticated identity/provenance evidence	Invalid/stale evidence denies
Task/purpose certificate	Trusted issuer input	Missing/ambiguous denies or asks for clarification
Tool/service schema	Versioned closure/effect-contract node	Drift requires new grant
Effect adapter	TCB, versioned and closure-bound	Unknown/ambiguous normalization denies

Appendix

Table 9. Trusted and untrusted inputs.

Runtime Enforcement for AI Agents

Runtime enforcement for AI agents checks and constrains actions as they execute, helping prevent unsafe or unauthorized effects.

See all 270 papers

Jul 1, 2026

Skills Are Not Islands: Measuring Dependency and Risk in Agent Skill Supply Chains

Agent skills package reusable operational knowledge for Large Language Model (LLM) agents, yet as they grow in scope, they become dependency-bearing artifacts whose identities, versions, and provenance remain implicit. This opacity already causes duplicated dependencies and inconsistent installations, exposing a gap that dependency management has yet to close. We introduce Agent Skill Supply Chains (ASSCs) to characterize mixed skill-package-service dependency graphs and help close this gap. Borrowing from Software Bill of Materials (SBOMs), we design SkillDepAnalyzer to capture natural-language dependency evidence and model skills as dependency-bearing artifacts. On the SKILL-DEP benchmark, SkillDepAnalyzer recovers skill metadata and dependency graphs accurately and comprehensively, substantially outperforming an LLM-based baseline and package-centric SBOM tools. Applying SkillDepAnalyzer to over 1.43 million skills, we obtain ASSCs and explore their structural diversity and security signals. We find four structural patterns: skill metadata is activation-ready but governance-poor; dependency graphs span skill, package, and service dependencies with concentrated reuse; recursive skill reuse expands dependency graphs and creates hidden package inventory; and skill dependency clusters form around related workflows. We also find that inspecting a skill alone misses security-relevant signals hiding in its dependencies. By analyzing ASSCs, we identify and report known malicious skills persisting in ASSCs to their developers. Based on these findings, we recommend typed dependency manifests, first-class dependency-cluster management, risk-warning audit commands for skill infrastructure maintainers, and lockfile-like records for skill developers.

Changguo Jia, Tianqi Zhao, Runzhi He +1

Peking University, Beijing, China · Zhongguancun Laboratory, Beijing, China

LLM Agents Agent Skill Security Auditing

Ask PDF

Feb 24, 2026

SoK: Agentic Skills -- Beyond Tool Use in LLM Agents

Agentic systems increasingly rely on reusable procedural capabilities, a.k.a., agentic skills, to execute long-horizon workflows reliably. These capabilities are callable modules that package procedural knowledge with explicit applicability conditions, execution policies, termination criteria, and reusable interfaces. Unlike one-off plans or atomic tool calls, skills operate (and often do well) across tasks. This paper maps the skill layer across the full lifecycle (discovery, practice, distillation, storage, composition, evaluation, and update) and introduces two complementary taxonomies. The first is a system-level set of seven design patterns capturing how skills are packaged and executed in practice, from metadata-driven progressive disclosure and executable code skills to self-evolving libraries and marketplace distribution. The second is an orthogonal \textbf{representation

\times

scope} taxonomy describing what skills are (natural language, code, policy, hybrid) and what environments they operate over (web, OS, software engineering, robotics). We analyze the security and governance implications of skill-based agents, covering supply-chain risks, prompt injection via skill payloads, and trust-tiered execution, grounded by a case study of the ClawHavoc campaign in which nearly 1{,}200 malicious skills infiltrated a major agent marketplace, exfiltrating API keys, cryptocurrency wallets, and browser credentials at scale. We further survey deterministic evaluation approaches, anchored by recent benchmark evidence that curated skills can substantially improve agent success rates while self-generated skills may degrade them. We conclude with open challenges toward robust, verifiable, and certifiable skills for real-world autonomous agents.

Yanna Jiang, Delong Li, Haiyu Deng +4

University of Technology Sydney · CSIRO Data61

Agentic AI LLM Agent Skill Learning LLM Agent Security

Ask PDF

Aug 17, 2026

SkillEffect: Checked Lowering for Memory-Bounded Agent Tools

Agent Skills can specify procedural and resource obligations for tool use, and language models instantiate them as concrete programs. However, when models turn this guidance into code for existing tool interfaces, even a semantically correct program may load an entire input and exceed the memory available to one tool call. We present SkillEffect, a checked-lowering runtime for computations with a recoverable source relation, an audited bounded implementation, and a registered output postcondition. Before granting execution authority, an independent checker rebuilds each proposed lowering from the submitted program and immutable input. Every relation plugin supplies a source recognizer, input-fact extractor, bounded-IR constructor, arena-bound function, and postcondition; one common runtime provides checked selection, bounded-VM execution, atomic capacity leasing, and staged publication. Generality in SkillEffect is architectural rather than automatic: each supported computation requires an audited relation plugin, while the dispatch, resource-control, execution, and publication mechanisms are shared across plugins. Across six operator families, bounded access substantially reduces peak memory and improves completion under externally fixed caps. Six plugins instantiate the same contract across five execution patterns, from streaming reduction to bounded-heap Top-k. The XLSX onboarding study and Top-k extension show that a new relation and a new retained-state pattern reuse the same trust boundary, while the checker accepts all evaluated legal configurations and rejects all adversarial proposals. Together, these results show that one checked-lowering architecture can enforce heterogeneous registered memory relations at Agent tool dispatch.

Yinuo Wang, Yiyu Shi

Department of Computer Science & Engineering University of Notre Dame Notre Dame, IN, USA

Runtime Enforcement for AI Agents Tool-Using Agents LLM Agent Harnesses

Ask PDF

Abstract

Runtime Enforcement for AI Agents

Explore similar work

Skills Are Not Islands: Measuring Dependency and Risk in Agent Skill Supply Chains

SoK: Agentic Skills -- Beyond Tool Use in LLM Agents

SkillEffect: Checked Lowering for Memory-Bounded Agent Tools