Skip to content

SkCC: Portable and Secure Skill Compilation for Cross-Framework LLM Agents

🕒 Published (v1): 2026-05-05 00:00 UTC · Source: HuggingFace · link

Why this paper was selected

Portable skill compilation across LLM agent frameworks; cross-framework interoperability

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

SkCC is a compiler for LLM agent skills (SKILL.md files) that introduces a strongly-typed intermediate representation (SkIR) to decouple skill semantics from framework-specific formatting, enabling write-once, deploy-anywhere portability across heterogeneous agent frameworks (Claude Code, Codex CLI, Gemini CLI, Kimi CLI). It also enforces compile-time security via an Anti-Skill Injection mechanism, achieving pass rate gains of up to +13.5pp and sub-10ms compilation latency.

Problem

Agent skill artifacts (SKILL.md) are authored as format-agnostic Markdown but LLM performance is highly sensitive to structural format — up to 40% variation from format alone. Supporting \(m\) skills across \(n\) frameworks naively requires \(O(m \times n)\) manual rewrites. Simultaneously, Snyk audits find 37% of 3,984 community skills contain security vulnerabilities, yet no systematic compile-time enforcement exists. Both problems share the same root: the assumption that a single static file can serve all frameworks and all threat models.

Method

SkCC operates as a four-phase compilation pipeline, analogous to classical compiler architecture (LLVM IR as inspiration):

  1. Syntax Parser: Separates YAML frontmatter (metadata) from Markdown body, lowering both into an unambiguous AST.
  2. IR Builder: Transforms the AST into SkIR — a strongly-typed IR with typed semantic categories (procedures, permissions, schemas, constraints). A nested-data detector flags schemas with nesting depth exceeding a threshold, which downstream emitters consult for format selection.
  3. Security Optimizer (four sequential analyses):
  4. Structural Validation: Rejects malformed skills (missing fields, unresolvable MCP dependencies) at compile time.
  5. Permission Auditing: Flags overly broad access grants against a security baseline.
  6. Anti-Skill Injection: Scans procedure text for dangerous patterns (unsafe HTTP, unbounded loops, destructive DB operations, fragile HTML parsing) and injects safety constraints directly into the SkIR — format-agnostically and format-preservingly.
  7. Security Classification: Assigns tiered security levels (low/medium/high/critical), with critical skills blocked from automatic execution.
  8. Target Emitter: Polymorphic emission layer renders optimized SkIR into framework-native formats — XML semantic layering for Claude, XML-tagged Markdown for Codex, Markdown+conditional YAML (depth ≥ 3) for Gemini, full Markdown for Kimi. A routing manifest (~50 tokens/skill) supports progressive disclosure at agent initialization.

Phases 1–3 execute once per skill; the optimized SkIR is shared across all \(n\) emitters, reducing complexity from \(O(m \times n)\) to \(O(m + n)\).

Key Contributions

  • Identifies format sensitivity as a first-class deployment concern in agent skill ecosystems, distinct from retrieval-quality problems.
  • Proposes SkIR: a strongly-typed intermediate representation that decouples skill authoring from framework-specific formatting.
  • Anti-Skill Injection: compile-time security mechanism that automatically embeds safety constraints into SkIR, ensuring they survive format translation to all target frameworks.
  • Reduces cross-framework adaptation complexity from \(O(m \times n)\) to \(O(m + n)\) via a polymorphic emission layer.
  • Demonstrates extensibility: supporting a new framework requires only a new Emitter implementation, leaving Phases 1–3 unchanged.

Results

  • Pass rate on SkillsBench (89 tasks, Pass@1):
  • Claude Code: 21.1% → 33.3% (+12.2pp, +58% relative)
  • Kimi CLI: 35.1% → 48.7% (+13.5pp)
  • Codex CLI: 22.2% → 22.2% (+0pp, modest mean reward gain of +0.066)
  • Gemini CLI: 38.5% → 42.3% (+3.8pp, mean reward +0.019)
  • Average improvement across frameworks: +7.0pp pass rate; +26.6% average relative improvement vs. Liu et al. (+20.6%) and SkVM (+15.3%).
  • Gain mechanism: On Claude Code, 6 of 7 net-positive tasks flipped from reward=0 to reward=1; on Kimi CLI, 13 tasks flipped from complete failure to complete success.
  • Compilation latency: sub-10ms per skill.
  • Anti-Skill Injection: 94.8% proactive trigger rate across 225 community skills.
  • Token savings: 10–46% runtime token reduction across frameworks.
  • YAML emission at nesting depth ≥ 3 yields 51.9% vs. 43.1% pass rate for Gemini.

Limitations

  • SkillsBench covers only 89 tasks — limited diversity for generalization claims.
  • Codex CLI shows no pass rate improvement, suggesting format-tolerant models do not benefit from structural compilation.
  • Anti-Skill Injection's 94.8% trigger rate implies a ~5.2% miss rate for dangerous patterns; no analysis of false negatives.
  • Security classification thresholds and injection rule tables are heuristic and may not cover novel vulnerability classes.
  • Comparison against Liu et al. uses different baseline pass rates (40.1% vs. 21.1% for Claude), suggesting non-comparable evaluation setups that complicate direct benchmarking.
  • No evaluation of compilation across a broader set of agent frameworks beyond the four tested.

Relevance to Harnesses / Meta-Harnesses

SkCC is architecturally a meta-harness layer: it sits above individual agent frameworks and manages skill lifecycle (authoring → compilation → routing → execution) across a heterogeneous fleet, directly mirroring what a meta-harness does for agent orchestration. The progressive disclosure routing manifest (emit ~50 tokens/skill at init, load on demand) is a concrete harness-level design pattern applicable to any multi-framework orchestrator managing large skill libraries. The Anti-Skill Injection mechanism demonstrates that compile-time enforcement — rather than runtime guardrails — is a viable and superior security posture for harnesses that compose untrusted community artifacts. For researchers tracking meta-harnesses, the \(O(m+n)\) complexity reduction via IR-based decoupling is a transferable architectural principle for any system managing \(m\) tools or prompts across \(n\) execution backends.