Tsinghua Unveils Two Breakthrough Papers on LLM Agent Skills

Agent Skills are becoming essential components for LLM agents, but two critical challenges arise: how to make skills grow stronger with use rather than accumulate disorder, and how to ensure the installed skills are safe.

Tsinghua University recently released two papers that address these challenges. The first paper, GSE , argues that skill evolution should not be a series of local patches; instead, the entire skill library must be treated as an interconnected graph for global optimization.

It constructs a Skill Relation Graph (SRG) that explicitly maps dependencies, sharing, and conflicts among skills, allowing affected neighboring skills to evolve together when one skill changes.

It clusters multiple execution traces that reflect the same capability gap, abstracting them into higher‑level reusable skills instead of leaving fragmented project‑specific pieces.

It employs replay verification to re‑run generalized skills on historical cases, admitting only those that do not regress, thereby preventing over‑fitting and behavioral back‑sliding.

Experimental results show substantial gains: on bug‑triggered test generation, recall improves by 31.8%–180.0% over the strongest baseline, precision rises by 6.1%–34.1%, and false‑positive precision improves by 15.4%–96.4%. In an industrial deployment on a strong enterprise‑grade bug‑triage agent, GSE lifts F1 from 0.43 to 0.71, a 61.4% increase, while using the fewest execution tokens (593 K vs. 613 K–620 K for other methods) and adding only 12.28% overhead during evolution.

The second paper, SkillSentry , tackles skill safety. It observes that suspicious code does not always equal malicious behavior, so it introduces a controlled experiment pipeline:

From a skill description, it derives an ability contract that specifies permissible actions.

It builds an adaptive honey‑world containing only the minimal bait resources needed to trigger a specific behavior.

It performs four paired executions—running the same task with and without the skill in both the normal world and the honey‑world.

Only when the effect occurs exclusively with the skill, can be traced to the skill code, and exceeds the contract, is the behavior flagged as a violation.

On standard benchmarks, SkillSentry achieves 99.5% recall, mixed‑benchmark F1 scores of 96.08%/96.43%, and a false‑positive rate of 4.15%, dramatically lower than the baseline’s 53.68%. Against deliberate code‑rewriting escape attacks, it attains an average F1 of 92.95% versus 80.07% for the strongest baseline, and reduces false positives from 31.73% to 8.18%.

The trade‑off is speed: each skill requires 119.47 seconds and consumes 37.53 million input tokens for 200 skills, whereas static scanning finishes in 2–3 seconds. Nonetheless, SkillSentry works across different model backbones (Qwen, Kimi, Doubao, etc.), maintaining >97% recall on the HarmfulSkillBench.

In conclusion, skills must be governed by an evolution‑plus‑verification mechanism to preserve quality, and dynamic causal verification is essential before publishing third‑party skills. These two gates determine whether the skill ecosystem can scale reliably.

论文标题: Learning Globally Reusable Skills for Coding Agents
论文ID: 2608.06153v1

论文标题: SkillSentry: Adaptive Honey Worlds for Dynamic Safety Testing of Agent Skills
论文ID: 2608.03485v1
GitHub: https://github.com/nizhangli062-jpg/SkillSentry-Adaptive-Honey-Worlds-for-Dynamic-Safety-Testing-of-Agent-Skills