SkillTrace: Multi-Trace Provenance Auditing for LLM-Agent Skill Reuse

What happened

arXiv 于 2026-08-07 发布论文《SkillTrace: Multi-Trace Provenance Auditing for LLM-Agent Skill Reuse》，编号 2608.05204，归属 cs.AI 领域。

论文摘要指出，LLM 智能体生态正围绕「可复用技能」快速成长；这些技能是混合模态的软件包，包含元数据、自然语言指令、代码、工具、引用及操作配置等成分。

论文提出名为 SkillTrace 的多轨迹溯源审计（multi-trace provenance auditing）方法，用于对 LLM 智能体的技能复用过程进行来源追踪与审计。摘要其余部分在素材中被截断，完整内容原文未提供。

Analysis and impact

这项工作的核心价值在于把「溯源（provenance）」这一传统软件供应链概念引入 LLM 智能体技能生态。可复用技能本质上是一种混合模态的软件制品——既包含可执行的代码与工具，又包含自然语言指令和元数据，这使其比传统代码库更难追踪：一段技能被某个智能体调用后，可能被改写、组合、再发布，来源信息容易在传播中丢失。

SkillTrace 的「多轨迹」设计（multi-trace）暗示其追踪的不只是单一调用链，而是技能在多个智能体、多次复用之间形成的复杂传播网络。对开发者而言，这意味着可以审计一个智能体实际依赖了哪些第三方技能、是否存在被篡改或投毒的风险；对企业而言，技能复用带来的合规与安全审查有了可落地的技术抓手；对普通用户而言，则间接提升了所使用智能体行为的可解释性与可信度。

从生态演进角度看，随着技能市场（skill marketplace）逐步成型，溯源审计很可能成为与代码签名、依赖锁定同等重要的基础设施能力。该论文发表于 2026 年 8 月，正处于这一趋势的早期阶段。

Uncertainty and limits

素材仅提供论文摘要的前半部分，SkillTrace 的具体技术实现（如追踪机制、数据采集方式、评估基准与实验结果）均未披露，无法判断其精度、性能开销或适用规模。相关素材中的其他条目（同态加密、Claude Code hooks、Toast 1、Qwen3.8-27B 等）与本论文主题无直接关联，未用于解读。

References

arXiv · cs.AI ↗

Original source text

arXiv:2608.05204v1 Announce Type: new Abstract: LLM-agent ecosystems are rapidly growing around reusable skills: mixed-modality packages of metadata, natural-language instructions, code, tools, references, and operational workflows. As skills become marketplace artifacts, auditing their reuse is no longer the same problem as ordinary code clone detection. Existing detectors target single-modality source code or whole-package similarity, yet skill reuse evidence is distributed across authored text, implementation fragments, and operational structure. As a result, they can miss reuse that preserves only one part of a skill. We present SKILLTRACE, a multi-trace provenance auditing framework for LLM-agent skill reuse. SKILLTRACE extracts three provenance traces: Expression, Implementation, and Operational. It represents the Operational Trace as a Skill Operational Graph (SOG) that captures activation, procedure, and resource-flow structure. An LLM assists only the Operational-trace extraction, once at ingestion; at audit time SKILLTRACE compares cached traces deterministically, calibrates each trace against same-function strict negatives, and reports which trace supports a reuse decision. On SKILLTRACE-BENCH, with 820 transformed reuse positives over 100 marketplace anchors and 751 negative controls, SKILLTRACE achieves AUROC 0.938 and F1 0.898. A 36,446-skill wild audit further shows that trace-attributed evidence surfaces actionable reuse review queues beyond repository-level baselines.