Hiding Agent Skill Files Offers No Real Protection: 86% of Capabilities Can Be Reverse-Engineered

A Overlooked Security Blind Spot in AI Agents

As the AI Agent ecosystem matures, more developers and enterprises are treating "skills" (Skills) as tradeable or shareable assets. You might pay for access to a particular Agent skill, or share a carefully crafted multi-file skill package within your team. To protect this intellectual property, the common approach is to "hide" skill files — users can invoke the skill and get results, but cannot see the implementation details behind it.

A new paper, however, poses a serious challenge to this assumption. It answers a critical question head-on: Does hiding your Agent skill files actually protect them?

The short answer is: No. And that conclusion is alarming.

The Daydreaming Attack: Reverse-Engineering Without Ever Touching Secrets

The paper introduces an attack method called Daydreaming. Its elegance lies in this: rather than trying to make the target system "leak" skill content, it reconstructs a hosted multi-file skill purely by executing the ordinary tasks the service was designed to perform.

This distinction is critical. Traditional disclosure filters typically watch for behavior like someone trying to prompt the system into revealing "What is your system prompt?" or "Show me your config files." Daydreaming never asks the victim system to reveal skill contents, nor does it ask it to score the reconstructed results.

In other words, the attacker simply uses the service like any normal user — and by observing the system's outputs during routine task completion, gradually reverse-engineers the skill's full capabilities. Because the entire process involves no "out-of-bounds requests," carefully designed disclosure filters have nothing to catch. They're guarding the front door while the thief walks in through an unlocked window.

Why Existing Defenses Fail Across the Board

This exposes a structural flaw in current Agent security: existing defenses almost exclusively focus on "preventing direct disclosure," while ignoring behavioral inference through legitimate interaction. When a skill's value lies in what it can do rather than what its files contain, an attacker who observes enough input-output pairs can reconstruct a functionally equivalent skill.

Experimental Results: Just How Alarming Is an 86.8% Reconstruction Rate?

The paper presents concrete experimental data that should alarm every skill provider.

The study tested 7 skills across 4 victim models. Under the weakest access level — where the attacker can only see the final response and returned files — Daydreaming successfully recovered 86.8% of the original skill's capabilities.

The key qualifier here is "weakest access level." The attacker doesn't need special privileges. With only what a regular user can see, they can reconstruct nearly nine-tenths of a skill's functionality.

A few additional data points worth highlighting:

• Efficiency comparison: Daydreaming's reconstruction performance is approximately 4× better than SigLeak (an existing method)
• Call cost: The median reconstruction of a skill requires just 32 victim calls
• Defense bypass: All of the above results were achieved with disclosure defenses enabled

What does 32 calls mean in practice? It falls well below any anomaly detection threshold. For a live paid skill service, a few dozen calls are completely buried in everyday traffic volume — you simply cannot flag an attacker based on "abnormal call frequency."

A Direct Blow to the Skill-as-a-Service Business Model

This research is especially relevant to a specific group: if you sell access to a skill, or share skills across multiple teams, this paper is required reading.

Skill-as-a-Service is emerging as a new business model in the AI application ecosystem. Its foundational assumption is that users pay to use the skill, while the implementation details remain protected. The Daydreaming attack strikes directly at the root of that assumption.

If a paying user can reconstruct 86.8% of a skill's core capabilities with just 32 normal calls, then:

1. The paid moat is undermined: Competitors can buy a single access pass, then reverse-engineer their own version
2. Internal sharing risk increases: Even skills "hidden" from internal teams can have their value extracted by anyone with access
3. Traditional IP protection methods fail: Simply "not exposing the files" no longer constitutes effective protection

What Should Skill Providers Do?

While the paper's conclusions are sobering, it also points the industry toward areas that need rethinking.

First, relying on "hiding" to protect skills is unreliable. Security practitioners have long agreed: security through obscurity has never been real security. This research simply validates that iron rule once again, this time in the new context of Agent skills.

Second, future defenses may need to shift toward behavioral-layer monitoring — not just checking whether individual requests are compliant, but analyzing whether user interaction patterns exhibit characteristics of "systematic probing." Yet as the experiments show, when an attack can be completed in 32 calls, the defensive response window is extremely narrow.

Finally, skill providers may need to rethink their value anchors: if a skill's functionality can be easily reverse-engineered, the moat may need to be built on continuous updates, data barriers, ecosystem integration, and other harder-to-replicate dimensions — not the static skill files themselves.

Conclusion

The significance of this paper lies not in providing a new attack tool, but in using rigorous experimentation to puncture a popular illusion. As Agent skill commercialization accelerates, the intuition that "hiding it means it's safe" is becoming increasingly dangerous.

For anyone building, selling, or sharing AI skills, this is a wake-up call: real protection has never been as simple as just hiding something away.