On this page
A signed skill directory is not the whole running skill. ClosureBound binds authority to the complete dependency closure—and checks it again when an external effect becomes durable.
Research status: Preprint. Original research date: 2026-09-05.
Authors: Genliang Zhu, Chu Wang.
Overview
An agent skill can depend on files, packages, tools, models, and remote services that sit outside its signed root directory. Those dependencies can change recursively or load only when the skill runs, allowing the operational system to drift while root-level evidence still looks valid.
ClosureBound resolves this heterogeneous dependency graph into a typed closure, binds each grant to its exact root and effect ceiling, then re-resolves both closure and state at operation time. A durable effect is admitted only when one joint witness satisfies every bound; alternate paths to the same effect cannot amplify authority.
Core contributions
Operational identity
Defines an agent skill by its typed transitive dependency closure rather than by a manifest or signed directory alone.
Operation-time witness
Re-resolves closure and state at durability, normalizes equivalent operation surfaces, and requires one witness to satisfy every bound.
Mechanized invariants
Formalizes non-inheritance, non-amplification, freshness, and path invariance, then exercises them through lifecycle fixtures, kernel contracts, mutants, and state exploration.
Public-skill audit
Audits 549 public Skills to measure how rarely bundled dependencies are explicitly declared and where paths resolve outside skill roots.
Evidence and scope
This is an arXiv preprint and a reference-monitor design, not a claim of production readiness. Its guarantees assume complete mediation and dependency discovery, authenticated freshness, sound effect normalization, cryptographic binding, and authoritative linearization. It does not establish program equivalence or remote-service honesty, and the public-skill study is a lexical audit rather than an estimate of exploitable prevalence.
Original research
Accentrust research overview · Read the preprint · SSRN record
The date above belongs to the original research record. The publication date shown by this blog records when this overview was added to Figena. Research claims retain the scope and assumptions of the linked paper; listing the work here does not establish production availability.
