Agent skills encode operational procedures and domain expertise as reusable knowledge assets, yet their distribution in plaintext exposes them to unauthorized copying and leakage. However, practical mechanisms for skill ownership verification and leakage tracing remain underdeveloped. Watermark embedding before distribution offers a potential solution, but structured, compact skill instructions impose stringent requirements for factual and procedural accuracy. To address these challenges, we introduce SkillMarker, a KGW-based watermarking method that jointly targets functionality preservation and strong watermark embedding. SkillMarker unifies quality-constrained rewriting with signal-oriented candidate search. The former separates essential knowledge from flexible expression to preserve instruction fidelity; the latter explores alternative expressions to obtain a stronger watermark signal under preservation constraints. We release an open-source toolkit that integrates watermark embedding, quality auditing, and detection to support the protection of agent skills. SkillMarker targets ownership verification and leakage tracing in distributed skill ecosystems, where content may be copied in whole or in part, or incorporated into other skills. Across four datasets, SkillMarker negligibly affects downstream task performance on average. In our copy-paste tests, window-based detection consistently identifies copied passages containing as few as 1,536 consecutive tokens. Even after merging with one or three background skills, SkillMarker retains watermark detection rates of 72.2--77.8%.
Figures & tables
Figure 1: Plaintext skills expose valuable domain expertise to unauthorized copying and leakage. SkillMarker offers ownership verification and leakage tracing.
Figure 2: Overview of SkillMarker. (1) Quality-constrained rewriting preserves protected content, such as code and API identifiers, while rewriting editable spans. (2) Signal-oriented candidate search ranks candidate rewrites by the green-token rate and uses lower perplexity to break ties. (3) Reconstruction preserves protected content, followed by independent quality auditing and detection in suspect text.
Figure 3: Watermarking largely preserves downstream task performance. We test watermarked skills on four datasets, comparing task performance, token usage, and task time against original skills and a no-skill baseline.
Figure 4: Copied passages containing as few as 1,536 consecutive tokens are consistently detected in our tests. We insert watermarked passages into unwatermarked text and compare full-text and window-based detection. Window-based detection identifies every tested contiguous 1,536-token copy under both background lengths.
Figure 5: Detection windows also locate the copied content. In the same copy-paste tests, contiguous 1,536-token passages achieve 98.0–99.1% localization recall. We report token-level precision and recall as copied length and fragment count vary; scattered fragments are harder to localize.
Figure 6: Watermarks remain detectable after limited skill merging. We merge a target skill with zero, one, or three background skills and compare single-window and multi-scale detection. Watermarked targets measure detection rates; unwatermarked targets measure false positives.
Figure 7: Ablation of five components. We compare instruction quality and watermark strength.
Figure 8: Protected content remains unchanged during watermarking. We compare original and watermarked excerpts of observability-and-instrumentation , showing preserved literal content and rewritten prose that carries the watermark.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Figure 9: Protected content remains unchanged during watermarking. Extended original and watermarked excerpts of observability-and-instrumentation show preserved literal content and rewritten prose that carries the watermark.
Key Laboratory of High Confidence Software Technologies, Ministry of Education, Peking University, Beijing, China · Northwestern Polytechnical University, Xi’an, China