Paper deep dive
SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification
Alan Tang, Lifeng Wang, Gang Wu, Tao Zhang, Yantao Jia, Xiaofeng Zhu
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Agent skills encode operational procedures and domain expertise as reusable knowledge assets, yet their distribution in plaintext exposes them to unauthorized copying and leakage. However, practical mechanisms for skill ownership verification and leakage tracing remain underdeveloped. Watermark embedding before distribution offers a potential solution, but structured, compact skill instructions impose stringent requirements for factual and procedural accuracy. To address these challenges, we introduce SkillMarker, a KGW-based watermarking method that jointly targets functionality preservation and strong watermark embedding. SkillMarker unifies quality-constrained rewriting with signal-oriented candidate search. The former separates essential knowledge from flexible expression to preserve instruction fidelity; the latter explores alternative expressions to obtain a stronger watermark signal under preservation constraints. We release an open-source toolkit that integrates watermark embedding, quality auditing, and detection to support the protection of agent skills. SkillMarker targets ownership verification and leakage tracing in distributed skill ecosystems, where content may be copied in whole or in part, or incorporated into other skills.
Tags
Links
- Source: https://arxiv.org/abs/2610.15725v1
- Canonical: https://arxiv.org/abs/2610.15725v1
Trouble viewing inline? Open PDF directly →
Full Text
41,284 characters extracted from source content.
Expand or collapse full text
October 10, 2026 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification Alan Tang 1 , Lifeng Wang 1,2 , Gang Wu 1 , Tao Zhang 1 , Yantao Jia 1,* , and Xiaofeng Zhu 1 1 Huawei Inc. 2 Harbin Institute of Technology, Shenzhen Agent skills encode operational procedures and domain expertise as reusable knowledge assets, yet their distribution in plaintext exposes them to unauthorized copying and leakage. However, practical mechanisms for skill ownership verification and leakage tracing remain underdeveloped. Watermark embedding before distribution offers a potential solution, but structured, compact skill instructions impose stringent requirements for factual and procedural accuracy. To address these challenges, we introduce SkillMarker, a KGW-based watermarking method that jointly targets functionality preservation and strong watermark embedding. SkillMarker unifies quality-constrained rewriting with signal-oriented candidate search. The former separates essential knowledge from flexible expression to preserve instruction fidelity; the latter explores alternative expressions to obtain a stronger watermark signal under preservation constraints. We release an open-source toolkit that integrates watermark embedding, quality auditing, and detection to support the protection of agent skills. SkillMarker targets ownership verification and leakage tracing in distributed skill ecosystems, where content may be copied in whole or in part, or incorporated into other skills. 1. Introduction Agent skills package domain expertise into reusable instructions and resources that agents load on demand to specialize their behavior with- out modifying model weights (Li et al., 2026a; Zhang et al., 2025). This encoded knowledge makes skills valuable assets for organizations and developers, while their reusable format allows that expertise to be deployed across tasks. How- ever, distributing skill instructions in plaintext makes them easy to copy, redistribute, or incor- porate into other skills. These risks motivate watermarking skill text be- fore distribution to support ownership verification and leakage tracing, including when only frag- ments of the original skill remain. We therefore ask: Can we watermark the skill for owner- ship verification and leakage tracing without compromising its functionality? However, embedding a watermark into struc- tured, compact skill instructions with stringent accuracy requirements poses two coupled chal- lenges. C1: Preserving skill functionality dur- ing watermarking. Skill instructions encode precise operational requirements, so even minor changes to resource references, decision condi- tions, or required actions can change agent behav- ior. Their structured format and stringent accu- Figure 1|Plaintext skills expose valuable domain expertise to unauthorized copying and leakage. SkillMarker offers ownership verification and leakage tracing. * Corresponding author. We provide a watermarking platform: https://alantang7-skillmark.hf.space/ arXiv:2610.15725v1 [cs.CR] 11 Oct 2026 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification racy requirements leave limited room for water- mark embedding through rewriting. C2: Embed- ding a strong watermark under limited rewrit- ing freedom. Compact skill instructions offer few opportunities to strengthen the watermark signal. Accuracy constraints further restrict alternative expressions: a weak logit bias may produce lit- tle watermark signal, while a stronger bias can change essential instructions. We introduce SkillMarker, a KGW-based water- marking method for agent skill ownership verifi- cation (Kirchenbauer et al., 2023). To address C1, we propose quality-constrained rewriting, which preserves protected content and constrains ed- itable spans to preserve essential operational re- quirements. To address C2, we propose signal- oriented candidate search, which explores alter- native expressions and selects candidates with stronger watermark signals among those that pass preservation checks. SkillMarker enables developers to verify skill ownership by embedding a keyed watermark before publishing a skill and later testing suspect text for a watermark signal. It also enables them to trace skill leakage by assigning distinct keys to distributed versions and testing suspect text for a watermark signal that can help identify its source version, including when instructions are copied in whole or incorporated into other skills. To support these applications, we also develop a toolkit that integrates watermark embedding, quality auditing, and detection. In summary, our contributions are threefold: •We propose SkillMarker, a KGW-based method that combines functionality preservation and strong watermark embedding for skill ownership verification and leakage tracing. •We study skill watermark performance under copy-paste and skill-merging scenarios, examin- ing how these operations affect the watermark signal in reused content. •We develop an integrated toolkit for watermark embedding, quality auditing, and detection, sup- porting the assessment of both watermark signal strength and instruction fidelity. 2. Method 2.1. Problem Setup and Overview Let푥denote the Markdown body of an original skill. We introduce a watermark key 푘 for water- mark embedding and detection. We seek a water- marked skille푥that preserves the instructions in푥 while carrying a watermark signal associated with 푘. A detector later tests suspect text for this sig- nal, including when only part of the distributed skill is present. Watermark embedding uses a language model with access to its output logits; detection requires the tokenizer and watermark configuration, but no model inference. For a vocabularyV, write a token sequence as푤 1:푛 . At generation step푡, the input context and preceding generated tokens determine a next- token distribution 푃 푡 through a softmax over the model’s output logits. The watermark key푘and preceding token푤 푡−1 determine a green list퐺 푡 and its complement, the red list푅 푡 = V \ 퐺 푡 ; 훾 ∈ (0,1)controls the nominal green-list fraction, and훿 >0 controls the logit bias. We use푄 푡 for the resulting watermarked distribution. The set 퐸 ⊂ Vcontains tokens exempt from logit bias and scoring. For any scored text,Idenotes its eligible token positions,푁=|I|their count, and 퐺 their green-token count. Figure 2 provides an overview of SkillMarker. We first separate protected content from editable spans and generate candidate rewrites under preservation constraints. We assess watermark signal strength using the green-token rate and linguistic fluency using perplexity (PPL) (Bengio et al., 2003). Among candidates that pass preser- vation checks, we select those with higher green- token rates, using lower PPL to break ties. We then reconstruct the watermarked skill with pro- tected content unchanged. The toolkit provides independent quality auditing and supports both full-text and window-based watermark detection. 2.2. Quality-Constrained Rewriting Protecting literal content. To embed a water- mark, we apply a logit bias that favors green-list tokens during rewriting. Without preservation constraints, rewriting can change executable code and invalidate a skill. For example, changing>= 2 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification Figure 2|Overview of SkillMarker. 1 O Quality-constrained rewriting preserves protected content, such as code and API identifiers, while rewriting editable spans. 2 OSignal-oriented candidate search ranks candidate rewrites by the green-token rate and uses lower perplexity to break ties. 3 OReconstruction preserves protected content, followed by independent quality auditing and detection in suspect text. to>in the following code block changes when the retry limit is enforced: if attempts >= 3: raise RuntimeError Code and numerical thresholds allow little rewrit- ing freedom, whereas surrounding prose often al- lows alternative expressions. We therefore parse the original skill and designate code, structural delimiters, and recognized literals as protected content that must remain unchanged. Regions with unresolved structure are also protected. We split the remaining prose into editable spans and protect tokens that cross the boundary of pro- tected content. Editable spans below a threshold on the original token count remain unchanged. We rewrite one editable span at a time and then reconstruct the skill with protected content in its original order. Preserving instruction fidelity. Preserving pro- tected content alone does not preserve a de- cision rule: changingall conditionsto any conditionchanges behavior even if every threshold remains unchanged. We use in-context learning to make preservation constraints within editable spans concrete. The rewriting prompt combines explicit preservation instructions with paired input and rewrite examples. These ex- amples show how to change wording while pre- serving the original language, facts, conditions, negations, numerical values, and technical iden- tifiers. Preservation checks reject incomplete or empty candidates, unauthorized layout or syn- tax changes, and changes to protected content. Independent quality auditing then assesses lan- guage, semantics, completeness, and usability without exposing watermark scores to the review- ers. Downstream task performance is evaluated separately. Grouping token variants. Watermark embed- ding can favor token variants that disrupt for- matting. For example, a hard watermark that blocksnamebut permits_namecan produce an unwanted underscore and change Markdown for- matting. A logit bias can likewise favor a token variant without excluding the original token. We therefore assign consistent green-list membership to token variants. Our implementation groups to- kens that differ only in leading spaces or periods and assigns them a shared representative’s green- list membership; literal-underscore variants re- main subject to preservation checks. Specifically, we sample a keyed subset of⌊훾|V|⌋vocabulary IDs and assign each representative’s membership to all tokens in its group. The resulting green-list size need not equal훾|V|, so훾remains a nominal parameter. Exempting formatting tokens. Applying a logit bias to Markdown symbols can favor for- matting changes that disrupt skill structure. We therefore exclude designated formatting tokens from the logit bias. Together with special and reserved control tokens, they form퐸. Following soft KGW (Kirchenbauer et al., 2023), we modify 3 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification the remaining logits by 푄 푡 (푣)= 푃 푡 (푣) exp ( 훿1푣∈ 퐺 푡 \ 퐸 ) Í 푢∈V 푃 푡 (푢) exp ( 훿1푢∈ 퐺 푡 \ 퐸 ) . (1) Tokens in푅 푡 remain available, allowing the model to select strongly preferred expressions. Exempt tokens receive no logit bias and contribute no watermark signal. 2.3. Signal-Oriented Candidate Search Exploring alternative expressions. Strict preservation constraints can encourage copying the original text without changes, leaving little room for additional watermark signal. Increasing 훿alone may instead favor an inaccurate expres- sion. We therefore use beam search (Sutskever et al., 2014) to explore alternative expressions under the same preservation constraints. It selects likely continuations under푄 푡 in Eq.(1), producing completed candidates for each editable span. Selecting on reconstructed text. A candidate’s generated token sequence can change when its text is joined to adjacent content. Scoring that sequence alone may therefore favor a watermark signal absent from the watermarked skill. We insert each candidate into the current skill and tokenize the complete reconstructed text. For the current editable span,Icontains only nonexempt tokens wholly inside its output boundaries and having a preceding token. Each token’s green-list membership is determined using its actual pre- ceding token, even when that token is protected or exempt. The candidate’s green-token rate is 푟= 퐺 푁 , 퐺= ∑︁ 푡∈I 1푤 푡 ∈ 퐺 푡 .(2) We compute conditional PPL over each can- didate’s generated tokens under the rewriting prompt to assess linguistic fluency. PPL is the exponential of the mean token negative log- likelihood under 푃 푡 . For editable span푖, letC 푖 contain candidates that pass the preservation checks and have푁 >0. We select 퐶 ∗ 푖 ∈ argmax 퐶∈C 푖 푟(퐶),−PPL(퐶) ,(3) using lexicographic order: higher green-token rates take priority, and lower PPL breaks ties. If C 푖 is empty, we preserve the original editable span and record a fallback. We process editable spans in their original order and score the saved wa- termarked skill after reconstruction. This local selection does not guarantee the highest green- token rate for the complete skill. 2.4. Watermark Detection Suspect text may contain copied instructions mixed with unrelated content, and the positions of protected content may be unavailable. We therefore support both full-text and window- based detection using only the suspect text and watermark configuration. Window-based detec- tion uses sliding windows to detect watermark signals within suspect text. The detector tok- enizes the full suspect text once and reconstructs 퐺 푡 from푘and each observed preceding token, using the same token-variant grouping as water- mark embedding. It excludes퐸and the first token. Without the positions of protected content, all re- maining positions are eligible, including content that may have been protected during watermark embedding. For푁 >0, we report the green-token rate퐺/푁 and the KGW statistic 푧= 퐺− 훾푁 √︁ 푁훾(1− 훾) .(4) The detector computes the nominal upper-tail probabilityPr[Binomial(푁, 훾) ≥ 퐺]. For window- based detection, it scores overlapping windows of the same tokenization, preserving each token’s preceding token in the full suspect text, and ap- plies a Bonferroni correction across the scanned windows. Repeated contexts and shared green- list membership can violate the binomial null as- sumptions; these probabilities therefore require independent calibration before being interpreted as empirical false-positive guarantees. 3. Experiments 3.1. Experimental Setup We report updated SkillMarker results on four datasets spanning everyday/general and profes- sional scenarios. For everyday/general scenarios, 4 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification 0 25 50 75 100 Performance (%) ↑ -2.61% -2.01% -0.95% +0.93% Everyday / General Scenarios Professional Scenarios Δ vs. Original Skill 0 450 900 1350 1800 Mean tokens (K) ↓ +14.1% +29.3% +23.9% -3.3% agent-skillsawesome-skillsmarketingskillsskill-use-bench 0 75 150 225 300 Median time (s) ↓ -9.2% -5.4% +23.9% -25.5% No SkillOriginal SkillWatermarked Skill Figure 3|Watermarking largely preserves downstream task performance. Downstream task performance, token usage, and runtime with no skill, original skills, and watermarked skills in everyday/general and professional scenarios. agent-skills(Osmani, 2026) covers routine software engineering workflows, including plan- ning, code review, testing, and debugging, while awesome-skills(sickn33, 2026) provides a broader collection for writing, document pro- cessing, information retrieval, and data analysis. For professional scenarios,marketingskills (Haines, 2026) focuses on marketing workflows such as content strategy, search engine optimiza- tion, advertising, and conversion optimization; skill-use-bench(Han et al., 2026) provides executable tasks requiring specialized procedures, including software development, document pro- cessing, and scientific computation. We com- pare three settings: no skill, the original skill, and the watermarked skill. The updated runs use DeepSeek-V4-Flash through Open Code, with one DeepSeek-V4-Flash judgment per case. To reduce evaluation leakage and cross-setting con- tamination, we remove expected outputs from agent prompts and check each prompt for their absence; expected outputs remain available only to the judge. Grading files are kept off disk during agent execution and restored temporarily for sub- sequent scoring. We identify copies of the target skills using content fingerprints, remove them and their supporting resources from the evaluation environment, and restore only the skill version required by the current setting. Original and wa- termarked versions are never exposed simultane- ously, and automatic skill discovery is disabled for the no-skill baseline. Each case runs in a separate temporary working directory, which is cleaned afterward to prevent artifacts from carrying over between cases. Execution traces are audited for unintended target-skill access, and contaminated baseline runs are rerun after cleanup. 5 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification 3.2.Downstream Performance and Resource Usage Figure 3 reports pooled check pass rates, mean total token usage, and median runtime from the updated three-arm evaluation. Token counts in- clude input, cached input, and output (K = 1000). Bars use a common zero baseline. Short dashed lines mark each dataset’s no-skill performance. Labels on watermarked results show changes rel- ative to the original skill before watermarking, expressed as percent changes for all three met- rics. All relative-change labels use neutral gray. Error bars show 95% percentile confidence inter- vals from 10,000 bootstrap replicates that resam- ple skills within each dataset, retaining all their available cases and using the same skill draws across settings. These intervals reflect hetero- geneity among the saved skills and cases, rather than variability from repeated agent runs or re- peated judgments. Forskill-use-bench, we use 142 scored tasks per setting, exclude two skipped tasks, and aggregate resource usage over available records. Watermarking largely preserves downstream task performance: watermarked skills change performance by−2.61% to+0.93% relative to original skills across four datasets and re- tain their gains over the no-skill baseline. On skill-use-bench, pass rates are 59.85% be- fore watermarking and 60.41% afterward. Origi- nal skills improve performance over no-skill runs by 8.49–40.30%. Mean total tokens increase by 14.1–29.3% on the first three datasets but de- crease by 3.3% onskill-use-bench. These means are sensitive to the long-tailed distribu- tion of run token counts. Median runtime de- creases foragent-skills,awesome-skills, andskill-use-bench, and increases for marketingskills. Runtime is reported for ref- erence, as machine and service load, execution periods, and concurrency can affect wall-clock measurements. Our assessment of functionality preservation relies on task performance rather than these timing differences. The absolute val- ues are provided in Table 1 in Appendix A. 3.3. Watermark Robustness We consider two skill-reuse scenarios: copying watermarked content into an unwatermarked text (copy-paste) and combining multiple skills (skill merging). We report detection under both sce- narios and localization under copy-paste. 3.3.1. Copy-Paste Setup. We select three skills, from each source, we copy 256, 512, 1024, 1536, or 2048 tokens into an unwatermarked text containing 1024 or 4096 tokens before insertion. We vary the num- ber of inserted fragments over1,2,4,8. Within each condition, fragmentation splits the same copied content while preserving its total length and order. Three fixed seeds per source control the selection of copied fragments and insertion positions, yielding 360 watermarked documents and 360 paired unwatermarked controls. Detection and localization. We scan each saved and re-tokenized document without access to the true insertion positions, using 1024-token windows with a stride of 256 tokens and a per- window significance threshold of푝 ≤0.01. To evaluate localization, we merge all significant windows into the predicted region퐴and take the union of the inserted fragments as the true region 푇. Overlapping windows count each token posi- tion only once. Localization precision and recall are Precision= |퐴∩ 푇| |퐴| , Recall= |퐴∩ 푇| |푇| . (5) When no window is significant, recall is zero and precision is undefined. Each plotted condition includes three seeds for each of the three sources: we first average within each source and then av- erage the three sources with equal weight. Preci- sion uses only runs with valid predictions; if any source has no valid prediction, the corresponding cell is marked N/A. Results. Figure 4 compares full-text and window-based detection. Longer copied frag- ments generally increase detection rates, while window-based detection helps detect watermark signals diluted by the unwatermarked text. For 6 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification Figure 4|Window-based detection improves detection of diluted watermark signals, while fragmentation weakens its advantage. Full-text and window-based watermark detection after copying skill content into unwatermarked text with varying copied lengths and fragment counts. Copied length (tokens) Figure 5|Longer copied fragments generally improve localization recall, whereas fragmentation reduces localization quality. Token-level localization precision and recall after copying skill content into unwatermarked text with varying copied lengths and fragment counts. example, when 2048 tokens are inserted con- tiguously into a 4096-token unwatermarked text, window-based detection reaches 100%, com- pared with 77.8% for full-text detection. Split- ting the same content into eight fragments re- duces window-based detection to 77.8%. Figure 5 shows that longer copied fragments also generally improve localization recall, whereas fragmenta- tion reduces the localized fraction of the inserted content. For the same 2048-token copy into a 4096-token unwatermarked text, contiguous in- sertion yields 70.6% precision and 100% recall; eight fragments yield 36.8% precision and 56.2% recall. These results demonstrate detection and 7 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification localization of copied content for the selected skills with strong watermark signals. Dispersed fragments can remain detectable even when they are only partially localized. 3.3.2. Skill Merging Figure 6 shows that watermark evidence remains detectable after merging a target skill with a lim- ited number of background skills. With one, two, or four total input skills, multi-scale union detec- tion achieves detection rates of 91.7%, 72.2%, and 77.8%, respectively, compared with 58.3%, 47.2%, and 44.4% for single-window detection. Adding background skills reduces detection rel- ative to the single-input setting, consistent with watermark dilution by unwatermarked content. This decline is not strictly monotonic for multi- scale detection, but both detectors retain lower detection rates with background skills than with- out them. Multi-scale detection helps recover some of the remaining evidence under this dilu- tion. Both methods have the same observed false- positive rates on unwatermarked controls: 0.0%, 11.1%, and 16.7% for one, two, and four input skills. The increasing false-positive rates indicate that reliable detection under greater background noise also requires calibration. 3.4. Structured Skill Case Study Figure 7 compares selected excerpts from observability-and-instrumentation, watermarked with Qwen3-8B using an English prompt and default protection. Protected spans remain exactly unchanged, and the saved full text yields nominal푝=4.62×10 −9 . Long protected blocks show only their opening lines; omission marks separate non-contiguous ex- cerpts. Original generation defects are retained, so this case illustrates literal preservation and detection, without establishing semantic or functional equivalence. 4. Related Work 4.1. Watermarking Generation-time watermarking. KGW and Unigram-Watermark bias token selection using context-dependent and fixed vocabulary parti- tions, respectively (Kirchenbauer et al., 2023; Zhao et al., 2024). Other approaches use tour- nament sampling (SynthID-Text), sentence-level rejection sampling (SemStamp), or optimal trans- port (textGrain) (Dathathri et al., 2024; Hou et al., 2024; Li et al., 2026b). SWEET and STONE protect low-entropy positions and syntactic code tokens, respectively (Kim et al., 2026; Lee et al., 2024), while AgentMark watermarks planning decisions (Huang et al., 2026). Generation-time watermarking is typically deployed on the model- provider side to attribute generated outputs. Skill- Marker instead enables skill developers to embed watermarks into reusable instructions before dis- tribution, independently of the models that later execute them. Post-hoc watermarking. PostMark inserts semantically selected words, REMARK-LLM en- codes binary signatures, and SrcMarker ap- plies semantics-preserving code transforma- tions (Chang et al., 2024; Yang et al., 2024; Zhang et al., 2024). RedAct watermarks released agent traces through selective rewriting and be- havioral signals (Xu et al., 2026); SkillTrace au- dits skill reuse through expression, implementa- tion, and operational traces (Chen et al., 2026). These methods establish watermarking and prove- nance auditing for existing artifacts, but semantic preservation in general text or released traces does not by itself establish instruction fidelity in skills. Skill protection must preserve operational requirements while embedding watermarks that provide sufficient evidence for attribution after reuse. SkillMarker addresses this joint require- ment in distributed skill text; reliability studies of copy-paste attacks (Kirchenbauer et al., 2024) motivate its evaluation under copy-paste and skill merging. 4.2. Text Steganography Neural Linguistic Steganography conceals re- coverable messages through arithmetic cod- ing (Ziegler et al., 2019); zero-width characters offer invisible encoding but must survive redis- tribution. ICW induces output patterns through instructions, including covert triggers in modi- fied documents (Liu et al., 2026). Its signal is carried by subsequent model outputs, whereas SkillMarker embeds watermarks directly into the 8 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification Figure 6|Watermarks remain detectable when merged with a limited number of background skills, although added background content weakens detection overall. Detection rates for watermarked inputs and false-positive rates for unwatermarked controls when merging one, two, or four input skills. Figure 7|Protected text is preserved while editable prose carries watermark evidence. Original and watermarked excerpts from observability-and-instrumentation. distributed skill. Linguistic steganography focuses on concealed message recovery. Neither objec- tive by itself establishes attribution of copied or merged skill instructions under strict functionality constraints. SkillMarker instead supports own- ership verification and leakage tracing through statistical watermark signals under preservation constraints. 5. Conclusion We present SkillMarker, a KGW-based method for protecting distributed agent skills through quality-constrained rewriting and signal-oriented candidate search. Across four datasets, water- marked skills largely preserve downstream per- formance, with relative changes of−2.61% to +0.93% and dataset-dependent token overhead. Window-based detection improves detection of copied content diluted by unwatermarked text, while fragmentation weakens detection and lo- calization. Watermarks remain detectable after merging with a limited number of background skills, although added background content weak- ens detection overall and elevated control false positives highlight the need for calibration. These findings support watermarking as a practical di- rection for skill ownership verification and leak- age tracing. 9 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification References Y. Bengio, R. Ducharme, P. Vincent, and C. Jauvin. A neural probabilistic language model. Journal of Ma- chine Learning Research, 3:1137–1155, 2003. URL https://w.jmlr.org/papers/v3/bengi o03a.html. Y. Chang, K. Krishna, A. Houmansadr, J. F. Wieting, and M. Iyyer. PostMark: A robust blackbox wa- termark for large language models. In Proceed- ings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 8969–8987. Association for Computational Linguistics, 2024. doi: 10.18653/v1/2024.emnlp-main.506. URL https://aclanthology.org/2024.emnlp-m ain.506/. J. Chen, M. Wang, L. Jiang, J. Ma, X. Deng, X. Du, R. Lin, Y. Feng, L. Du, and J. Wang. SkillTrace: Multi-trace provenance auditing for LLM-agent skill reuse. arXiv preprint arXiv:2608.05204, 2026. URL https://arxiv.org/abs/2608.05204v2. Ver- sion 2. S. Dathathri, A. See, S. Ghaisas, P.-S. Huang, R. McAdam, J. Welbl, V. Bachani, A. Kaskasoli, R. Stanforth, T. Matejovicova, J. Hayes, N. Vyas, M. Al Merey, J. Brown-Cohen, R. Bunel, B. Balle, T. Cemgil, Z. Ahmed, K. Stacpoole, I. Shumailov, C. Baetu, S. Gowal, D. Hassabis, and P. Kohli. Scal- able watermarking for identifying large language model outputs. Nature, 634:818–823, 2024. doi: 10.1038/s41586-024-08025-4. URLhttps: //w.nature.com/articles/s41586-024 -08025-4. C. Haines. Marketing skills. GitHub repository, 2026. URLhttps://github.com/coreyhaines31/m arketingskills. Accessed October 9, 2026. J. Han, Y. Xu, Y. Liao, X. Wang, Z. Jiang, Z. Di, F. Lu, Z. Hu, and Y. Xiao. Skill-use: Can LLMs actually use skills in agentic harnesses? arXiv preprint arXiv:2608.04828, 2026. URLhttps: //arxiv.org/abs/2608.04828. A. Hou, J. Zhang, T. He, Y. Wang, Y.-S. Chuang, H. Wang, L. Shen, B. Van Durme, D. Khashabi, and Y. Tsvetkov. SemStamp: A semantic water- mark with paraphrastic robustness for text gener- ation. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Com- putational Linguistics: Human Language Technolo- gies (Volume 1: Long Papers), pages 4067–4082. Association for Computational Linguistics, 2024. doi: 10.18653/v1/2024.naacl-long.226. URL https://aclanthology.org/2024.naacl-l ong.226/. K. Huang, J. Tan, Y. Wei, W. Li, Z. Zhang, H. Tian, Z. Yang, and L. Zhou. AgentMark: Utility- preserving behavioral watermarking for agents. In Proceedings of the 64th Annual Meeting of the As- sociation for Computational Linguistics (Volume 1: Long Papers), pages 12581–12603. Association for Computational Linguistics, 2026. doi: 10.18653/v 1/2026.acl-long.573. URLhttps://aclantho logy.org/2026.acl-long.573/. J. Kim, S. Park, and Y.-S. Han. Marking code without breaking it: Code watermarking for detecting LLM- generated code. In Findings of the Association for Computational Linguistics: EACL 2026, pages 3990– 4002. Association for Computational Linguistics, 2026. doi: 10.18653/v1/2026.findings-eacl.207. URLhttps://aclanthology.org/2026.find ings-eacl.207/. J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, and T. Goldstein. A watermark for large language models. In Proceedings of the 40th International Conference on Machine Learning, volume 202 of Pro- ceedings of Machine Learning Research, pages 17061– 17084. PMLR, 2023. URLhttps://proceeding s.mlr.press/v202/kirchenbauer23a.html. J. Kirchenbauer, J. Geiping, Y. Wen, M. Shu, K. Saiful- lah, K. Kong, K. Fernando, A. Saha, M. Goldblum, and T. Goldstein. On the reliability of watermarks for large language models. In The Twelfth Interna- tional Conference on Learning Representations, 2024. URL https://arxiv.org/abs/2306.04634. T. Lee, S. Hong, J. Ahn, I. Hong, H. Lee, S. Yun, J. Shin, and G. Kim. Who wrote this code? watermarking for code generation. In Proceedings of the 62nd An- nual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 4890– 4911. Association for Computational Linguistics, 2024. doi: 10.18653/v1/2024.acl-long.268. URL https://aclanthology.org/2024.acl-lon g.268/. X. Li, Y. Liu, W. Chen, B. You, Z. Di, Y. He, S. Zheng, K. W. Choe, J. Sun, S. Wang, C. Tao, B. Li, X. Zhao, H. Geng, X. Wu, J. Zhou, X. Chen, H. Xing, Y. Li, Q. Zeng, D. Wang, Y. Wang, R. B. Chaim, P. Jiang, H. Shen, L. Kong, X. Liu, R. Wang, X. Liu, J. Li, X. Lan, Y. Lin, W. Ye, J. He, S. Li, Y. Zhang, Y. Gao, Y. Li, Z. Ma, L. Jing, T. Wang, K. Li, Y. Xue, H. Lyu, Y. He, Y. Tian, S. Wu, B. Wang, Y. Gao, B. Chen, L. Liu, S. Cheng, J. Bao, S. Tong, S. Xu, T. Y. Zhuo, T. Ye, Q. Qi, M. Li, L. Liao, Z. Tan, C. Shi, X. Tang, S. Tankasala, B. Yuan, Y. Qian, J. Tu, C. Wang, Y. Sun, W. Wang, A. Taylor, Z. Yang, C. Guan, Z. Dong, X. Zhang, S. Dillmann, H.-c. Lee, and D. Song. Skillsbench: Benchmarking how well agent skills work across diverse tasks. arXiv preprint arXiv:2602.12670, 2026a. X. Li, G. Wen, X. Chen, Q. Long, A. Jain, F. Joly, M. Lam, Q. Song, and W. Su. textGrain: Entropy- 10 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification calibrated watermarking for language model text. Technical report, OpenAI, Oct. 2026b. URLhttps: //cdn.openai.com/pdf/e9508624-d767-4 1b6-a26d-e34ca798ada6/textgrain-entro py-calibrated-watermarking-for-langu age-model-text.pdf . Technical report, October 5, 2026. Y. Liu, X. Zhao, C. Kruegel, D. Song, and Y. Bu. In- context watermarks for large language models. In The Fourteenth International Conference on Learning Representations, 2026. URLhttps://proceedi ngs.iclr.c/paper_files/paper/2026/h ash/571082ea18d30060177dfcaf662f0e5 -Abstract-Conference.html. A. Osmani. Agent skills. GitHub repository, 2026. URL https://github.com/addyosmani/agent-s kills. Accessed October 9, 2026. sickn33. Agentic awesome skills. GitHub repository, 2026. URLhttps://github.com/sickn33/a gentic-awesome-skills. Accessed October 9, 2026. I. Sutskever, O. Vinyals, and Q. V. Le. Sequence to se- quence learning with neural networks. In Advances in Neural Information Processing Systems, volume 27, 2014. URLhttps://papers.nips.c/paper _files/paper/2014/hash/5a18e133cbf9f 257297f410b7eca942-Abstract.html. S. Xu, Z. He, and Y. R. Fung. RedAct: Redacting agent capability traces for procedural skill protec- tion. arXiv preprint arXiv:2606.10813, 2026. URL https://arxiv.org/abs/2606.10813v3. Ver- sion 3. B. Yang, W. Li, L. Xiang, and B. Li. SrcMarker: Dual- channel source code watermarking via scalable code transformations. In 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2024. doi: 10.1109/SP54263.2024.00097. URLhttps: //ieeexplore.ieee.org/abstract/docum ent/10646683/. B. Zhang, K. Lazuka, and M. Murag. Equipping agents for the real world with agent skills. Anthropic En- gineering, 2025. URLhttps://w.anthropi c.com/engineering/equipping-agents-f or-the-real-world-with-agent-skills . Published October 16, 2025; accessed October 8, 2026. R. Zhang, S. S. Hussain, P. Neekhara, and F. Koushan- far. REMARK-LLM: A robust and efficient wa- termarking framework for generative large lan- guage models. In 33rd USENIX Security Symposium (USENIX Security 24), pages 1813–1830. USENIX Association, 2024. URLhttps://w.usenix.o rg/conference/usenixsecurity24/prese ntation/zhang-ruisi. X. Zhao, P. Ananth, L. Li, and Y.-X. Wang. Provable robust watermarking for AI-generated text. In The Twelfth International Conference on Learning Repre- sentations, 2024. URLhttps://arxiv.org/ab s/2306.17439. Z. Ziegler, Y. Deng, and A. Rush. Neural linguistic steganography. In Proceedings of the 2019 Confer- ence on Empirical Methods in Natural Language Pro- cessing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 1210–1215. Association for Computational Linguistics, 2019. doi: 10.18653/v1/D19-1115. URLhttps://aclanthology.org/D19-111 5/. 11 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification A. Additional Experimental Details A.1. Absolute Downstream Results Table 1 reports the absolute values underlying Figure 3 for the same settings and datasets. Table 1|Updated downstream task performance and resource usage with no skills, original skills, and water- marked skills across everyday/general and professional scenarios. Everyday / General ScenariosProfessional Scenarios agent-skillsawesome-skillsmarketingskillsskill-use-bench Setting Passed checks↑ (%) Tokens↓ (K) Time↓ (s) Passed checks↑ (%) Tokens↓ (K) Time↓ (s) Passed checks↑ (%) Tokens↓ (K) Time↓ (s) Passed checks↑ (%) Tokens↓ (K) Time↓ (s) No Skill89.83 337.5 219.7 82.93 297.3 55.0 77.64 200.3 45.3 42.66 1066.0 194.0 Original Skill97.46836.6106.492.03772.196.792.75709.875.259.851221.3196.0 Watermarked Skill94.92954.396.690.18998.391.591.86879.693.260.411181.3146.0 A.2. Main Experimental Hyperparameters The main hyperparameters are listed below. Robustness experiments use the frozen English water- marked release; its embedding settings are listed separately from the updated downstream evaluation. ExperimentHyperparameterValue DownstreamAgent / judgeDeepSeek-V4-Flash [1m] / same model Judgments per case1 Bootstrap replicates / seed10,000 / 20261010 Robustness embeddingModel / beam widthQwen3-8B / 5 Green fraction 훾 / logit bias 훿0.75 / 8 Hash key / embedding seed15485863 / 123 Copy-pasteCopied length (tokens)256, 512, 1024, 1536, 2048 Unwatermarked text length (tokens) 1024, 4096 Number of fragments1, 2, 4, 8 Selection / insertion seeds123, 456, 789 Detection window / stride (tokens)1024 / 256 Per-window significance threshold푝≤ 0.01 Skill mergingMerging model / reasoning effort deepseek-flash / high Maximum output tokens65,536 Total input skills1, 2, 4 (one target plus 0, 1, 3 backgrounds) Background selection seeds123, 456, 789 Single-window length / stride (tokens)3952 / 1027 Single-window probability threshold 푝≤ 0.03332253 Multi-scale unionOR of 13 component decisions Copy-paste window tests use nominal probabilities without multiple-testing correction. Merge detector parameters were selected on the same evaluation cohort, without a held-out test set. 12 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification B. Experimental Prompts B.1. Watermark Embedding The English embedding prompt below contains the system instruction and two user–assistant demon- strations. The final user message is replaced by the current editable passage. Role labels and the bracketed input field are presentation annotations; the remaining text is reproduced verbatim from the saved generation configuration. Watermark embedding: English prompt with demonstrations [System] Preserve the original meaning, key facts, conditions, negations, numerical values, technical identifiers, and formatting. You may freely rephrase the remaining wording. Output only the rewritten passage in its original language. [User: demonstration 1] **Core principle**: Automatically write patterns that meet the automatic-write conditions (frequency≥3, consistent fixes, certainty 100%) to skill references; otherwise, retain them as a staged patch. [Assistant: demonstration 1] **Core principle**: Write patterns to skill references automatically only when all automatic-write conditions are met (frequency≥3, consistent fixes, certainty 100%); keep patterns that do not meet these conditions as a staged patch. [User: demonstration 2] Purely visual ALIGN differences in CHECK-8 and CHECK-11 (style compliance) do not block the gate; record them in the report for later improvement. **CRASH/URL issues in CHECK-8 are functional failures** (a page failing to open or crashing is not a "visual issue"); they block the gate and enter the §5 loop. [Assistant: demonstration 2] Record purely visual ALIGN differences in CHECK-8 and CHECK-11 (style compliance) in the report for future improvement; they do not block the gate. **CRASH/URL issues in CHECK-8 are functional failures** (a page failing to open or crashing is not a "visual issue"), so they block the gate and enter the §5 loop. [User: actual input] [CURRENT EDITABLE PASSAGE] B.2. Skill-Merging Instruction For the merging evaluation, the system message contains the instruction below; the user message contains the complete input skills. Skill-merging evaluation prompt [System] Merge the provided skills into one skill. [User] [COMPLETE INPUT SKILLS IN THE RECORDED ORDER] 13 SkillMarker: A KGW-Based Watermarking Method for Agent Skill Ownership Verification C. Extended Structured Skill Case Study Figure 8 retains the earlier nine-excerpt presentation ofobservability-and-instrumentation, complementing the compact view in Figure 7. The skill was watermarked with Qwen3-8B using an English prompt and default protection. The saved mapping records exact preservation of protected spans and full-text nominal푝=4.62×10 −9 . Long protected blocks show their opening lines only; omission marks separate non-contiguous excerpts. Original generation defects are retained, so literal preservation and detection do not establish semantic or functional equivalence. Figure 8|Protected text is preserved while editable prose carries watermark evidence. Extended original and watermarked excerpts from observability-and-instrumentation. 14