New UC Berkeley paper Daydreaming shows a harder agent-security problem: legitimate task outputs alone can reveal enough behavior to build a portable replacement for a hidden skill.

An attacker does not need your hidden prompt to copy your agent skill: normal task outputs recovered 86.8% of its behavior, so the work interface itself needs protection.

The attack never asks the agent to reveal its prompt, SKILL.md, or files.

It just gives the service chosen customer tasks and learns from the answers.

And the attacker did not need an exact copy of the original skill.

The reconstructed files often matched the originals poorly, yet still reproduced much of the behavior on new tasks.

That is the core problem: a skill can stay secret at the file level while its capability leaks through use.

So if you are selling hosted agent skills, the paper's recommendation is: protect the work path too by reducing unnecessary output detail, exposing fewer execution traces, and limiting or auditing adaptive probing.