Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound

Genliang Zhu; Chu Wang

cs.CRSep 5, 2026

Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound

Authors: Genliang Zhu, Chu Wang

Organizations: Accentrust · Georgia Institute of Technology · Accentrust, Vancouver, Canada · Georgia Institute of Technology, Atlanta, Georgia, USA ·

Abstract

Agent Skills combine instructions with files, packages, tools, models, and services, so operational identity can exceed a signed directory. Recursive or lazy dependencies may change while root-level evidence remains valid, and different surfaces may reach the same durable effect. We present ClosureBound, a reference monitor that prevents authorization transfer across material changes to this heterogeneous closure. Its resolver commits typed graph nodes and topology. Each grant binds an exact closure root, effect ceiling, purpose/provenance, validity, and epochs. At durability, it re-resolves closure and state, normalizes the operation into an external-effect IR, and admits it only if a joint witness satisfies every bound. Supported equivalent paths share one ceiling. Assuming complete mediation and discovery, authenticated freshness, sound normalization, cryptographic binding, and authoritative linearization, we establish metadata non-authority, closure determinism, version non-inheritance, effect non-amplification, bound-value freshness, and path invariance. We do not establish program equivalence or remote-service honesty. A provider-free implementation matches 40 frozen lifecycle fixtures; 18 kernel contracts and six mutants cover binding and downgrade cases. Full-profile exploration reaches 84,608 states and 530,752 transitions without a declared invariant violation; six weakened profiles yield witnesses. A lexical audit of 549 public Skills (4,872 unique files) finds that 21 of 526 roots with bundled files name every non-manifest path verbatim, 67 contain links resolving outside their roots, and no root declares a frontmatter dependencies field. These observations motivate conservative closure discovery and define concrete targets for broader runtime, interoperability, efficacy, and production validation.

Figures & tables

Panel of Figure 1 — Figure 1. The authorization-transfer gap. Load-time integrity of a root Skill does not bind a later transitive resolution or an equivalent effect path. ClosureBound rebinds the exact closure and normalized effect at operation time. Blue denotes trusted authority, purple identity, amber change, green the effect boundary, and red a rejected transfer. A loop from a task grant through a load-time root check, a lazy dependency update, a durable effect, and silent reuse of old authority.

Question	In scope	Explicitly out of scope
Skill identity	Canonical represented transitive closure and topology	Complete semantic dependency discovery for arbitrary prose/code
Authorization	Exact closure/effect joint witness under a trusted task grant	Inferring latent user intent or proving the grant is normatively correct
Runtime	Mediated prepare/commit and current epochs	Unmediated sinks, compromised monitor, Byzantine infrastructure
Effects	Finite adapter-defined external-effect IR	General program equivalence, receiver honesty, guaranteed rollback
Evidence	Finite conformance, mutants, bounded model, local kernel cost	Hosted-model efficacy, ecosystem prevalence, production SLOs

Table 1. Research scope and evidence boundary.

Panel of Figure 2 — Figure 2. ClosureBound architecture. Authority, exact transitive identity, current state, purpose/provenance, and the normalized effect meet at one operation-time decision. A material change creates a new grant; it never edits the old closure binding. A pipeline with trusted task grant, closure resolver, graph root, current state, effect normalizer, joint predicate, atomic commit, reauthorization, and deny or indeterminate outcomes.

Panel of Figure 3 — Figure 3. Operation-time update discipline. Preparation never makes an old closure authoritative. A distinguishable material mismatch at the linearization point forces denial or a new grant. Timeline from prepare, through dependency update and re-resolution, to either deny and reauthorize or atomic commit.

Profile	Root	Closure	Effect	Commit refresh	Correlation	Purpose
Metadata/manifest only	–	–	–	–	–	Negative control
Root identity	$\checkmark$	–	–	–	–	Flat-root binding
Load-time closure	$\checkmark$	$\checkmark$	–	–	–	Exact load snapshot
Effect-only commit	–	–	$\checkmark$	$\checkmark$	$\checkmark$	Effect boundary
Prepared closure + effect	$\checkmark$	$\checkmark$	$\checkmark$	–	$\checkmark$	Composed prepare binding without commit-time closure/effect/state refresh
ClosureBound	$\checkmark$	$\checkmark$	$\checkmark$	$\checkmark$	$\checkmark$	Full joint predicate

Table 2. Transparent reference profiles. A check mark means that the finite reference evaluator performs the dimension.

Profile	Exact	Unsafe allow	Decision err.	Main omitted protection
Metadata/manifest only	8	32	32	Trusted recursive identity and effect gate
Root identity	14	26	26	Transitive closure and normalized effect
Load-time closure	20	20	20	Operation-time refresh and effect binding
Effect-only commit	24	16	16	Artifact/closure identity
Prepared closure + effect	32	8	8	Commit-time freshness/replay fencing
ClosureBound	40	0	0	None within represented profile

Table 3. Finite fixture results. Unsafe allow is the security error; false denial counts benign rows denied contrary to their exact oracle. Profiles are mechanism classes, not reproduced cited systems.

Mutant	First violated invariant	Minimal witness
Project out material package	I2 exact closure	Full resolver reauthorizes; projected resolver/grant omits changed package and commits
Omit commit epoch	I4 current operation	Full gate reauthorizes after redeploy; mutant accepts prepared epoch
Omit commit root	I2 exact closure	Full gate reauthorizes after helper update; mutant accepts prepared root
Trust shell surface	I5 path invariance	Full clause gate rejects; named shell path bypasses normalized policy
Union clause fields	I3 non-amplified effect	Full relation rejects; mutant combines recipient and amount from distinct clauses
Omit reservation freshness	I4 current operation	Full gate denies consumed nonce; mutant commits its replay

Table 4. Single-point full-profile mutants and minimized witness shape.

Source	Skills	Unique files	Bundled roots	All paths named	Roots with cross-root links
Anthropic Skills	19	411	18	6	0
OpenAI Plugins	530	4,461	508	15	67
Total	549	4,872	526	21	67

Table 5. External static closure audit at two fixed public commits. “All paths named” is evaluated only among roots with bundled files. It is a strict lexical measure, not semantic dependency recall.

Work	Exact hetero. artifact closure	Runtime authority	Durability refresh	Realized-effect normalization	Joint witness	Primary scope
Skills Are Not Islands ( Jia et al., 2026 )	$\circ$	–	–	–	–	Measurement and dependency management
SkillFortify ( Bhardwaj, 2026 )	$\circ$	$\circ$	–	–	–	Static analysis, SAT resolution, lockfile
OpenAPM v0.1 ( Microsoft, 2026 )	$\circ$	–	–	–	–	Install-time package/lock/policy draft
SIGIL ( Shen et al., 2026 )	$\circ$	$\circ$	–	–	–	Audit-to-load integrity
SkillGuard ( Pan et al., 2026 )	$\circ$	$\checkmark$	$\circ$	$\circ$	–	Skill permission framework
Edge Skillguard ( Zhan and Haddadi, 2026 )	$\circ$	$\checkmark$	$\circ$	$\circ$	–	Physical-world state/sensor guards

Table 6. Closest-work capability matrix. “Exact heterogeneous closure” requires authenticated operational Skill/package/tool/model/service structure; “joint witness” binds that closure and realized effect in one durability-time authorization record.

Work	Adjacent public abstraction	Not re-claimed here
OpenPort	Protocol facts, policy/effect vocabulary, conformance discipline	Protocol novelty or published runtime evidence
IGAC	Authenticated current-task certificate	Intent inference and IGAC empirical results
EBTE	Server-owned claims and digest-bound evidence	Explanation verification novelty and observations

Table 7. Public team-work reuse boundary. Prior observations and denominators are not ClosureBound evidence.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Symbol	Meaning
$\mathcal{G}_{t}(s;\pi,c_{\pi},B)$	Typed transitive capability graph under profile/canonicalizer $(\pi,c_{\pi})$ and candidate effects $B$
$q_{t}(v)$	Canonical authenticated evidence record for node $v$
$\rho_{t}(s;\pi,c_{\pi},B)$	Root-, context-, and endpoint-sensitive SCC/Merkle graph commitment
$\gamma$	Trusted correlated task/closure/effect grant
$\mathcal{N}(x,S)$	Partial trusted surface-to-effect normalizer
$A_{\mathrm{cur}}(t,e)$	Current task, closure, state, and purpose/provenance meet

Appendix

Table 8. Core notation.

Input	Trust treatment	Failure behavior
Skill name/description/prose	Untrusted discovery/instruction data	Cannot mint authority
Skill manifest/lockfile	Evidence only; authenticated if possible	Missing/unknown material edge denies exact profile
Supply-chain attestation	Authenticated identity/provenance evidence	Invalid/stale evidence denies
Task/purpose certificate	Trusted issuer input	Missing/ambiguous denies or asks for clarification
Tool/service schema	Versioned closure/effect-contract node	Drift requires new grant
Effect adapter	TCB, versioned and closure-bound	Unknown/ambiguous normalization denies

Appendix

Table 9. Trusted and untrusted inputs.

Runtime Enforcement for AI Agents

Runtime enforcement for AI agents checks and constrains actions as they execute, helping prevent unsafe or unauthorized effects.

See all 270 papers

Skills Are Not Islands: Measuring Dependency and Risk in Agent Skill Supply Chains
Jul 1, 2026Changguo Jia, Tianqi Zhao, Runzhi He +1LLM Agents Agent Skill Security Auditing
Peking University, Beijing, China · Zhongguancun Laboratory, Beijing, China
SoK: Agentic Skills -- Beyond Tool Use in LLM Agents
Feb 24, 2026Yanna Jiang, Delong Li, Haiyu Deng +4Agentic AI LLM Agent Skill Learning
University of Technology Sydney · CSIRO Data61
SkillEffect: Checked Lowering for Memory-Bounded Agent Tools
Aug 17, 2026Yinuo Wang, Yiyu ShiRuntime Enforcement for AI Agents Tool-Using Agents
Department of Computer Science & Engineering University of Notre Dame Notre Dame, IN, USA

Jul 1, 2026J/K move · Enter open · S save

Skills Are Not Islands: Measuring Dependency and Risk in Agent Skill Supply Chains

Changguo Jia, Tianqi Zhao, Runzhi He, Minghui Zhou

Peking University, Beijing, China · Zhongguancun Laboratory, Beijing, China

LLM Agents Agent Skill Security Auditing

Open paper AskPDF arXiv

Agent skills package reusable operational knowledge for Large Language Model (LLM) agents, yet as they grow in scope, they become dependency-bearing artifacts whose identities, versions, and provenance remain implicit. This opacity already causes duplicated dependencies and inconsistent installations, exposing a gap that dependency management has yet to close. We introduce Agent Skill Supply Chains (ASSCs) to characterize mixed skill-package-service dependency graphs and help close this gap. Borrowing from Software Bill of Materials (SBOMs), we design SkillDepAnalyzer to capture natural-language dependency evidence and model skills as dependency-bearing artifacts. On the SKILL-DEP benchmark, SkillDepAnalyzer recovers skill metadata and dependency graphs accurately and comprehensively, substantially outperforming an LLM-based baseline and package-centric SBOM tools. Applying SkillDepAnalyzer to over 1.43 million skills, we obtain ASSCs and explore their structural diversity and security signals. We find four structural patterns: skill metadata is activation-ready but governance-poor; dependency graphs span skill, package, and service dependencies with concentrated reuse; recursive skill reuse expands dependency graphs and creates hidden package inventory; and skill dependency clusters form around related workflows. We also find that inspecting a skill alone misses security-relevant signals hiding in its dependencies. By analyzing ASSCs, we identify and report known malicious skills persisting in ASSCs to their developers. Based on these findings, we recommend typed dependency manifests, first-class dependency-cluster management, risk-warning audit commands for skill infrastructure maintainers, and lockfile-like records for skill developers.

Abstract

Runtime Enforcement for AI Agents

Explore similar work

Skills Are Not Islands: Measuring Dependency and Risk in Agent Skill Supply Chains

SoK: Agentic Skills -- Beyond Tool Use in LLM Agents

SkillEffect: Checked Lowering for Memory-Bounded Agent Tools