InceptumRex

Papers& research

I write two kinds, kept apart: papers, essays for any reader, and research papers, technical work with its analysis and its sources.

no papers yet · 1 research paper
Research paperNº 01Sealed SkillsAlex M. RodriguezPreprint draft, not peer reviewed, v1.0PapersNone out yetEssays for any reader

Kind one

Papers

A paper is an essay or an article: an argument or an explanation written for any reader.

None is out yet.

Kind two

Research papers

A research paper works a technical problem through for specialists: the question, the design or method, the analysis and the sources it rests on.

Research paper · Systems and measurement study

Sealed Skills

Provider-bound encryption for LLM agent skills, and the limits of confidential context.

What it finds

  1. Sealing removes every non-model path to a skill at negligible cost: a 10 KB skill seals and opens in under half a millisecond.
  2. Once a skill is in context, most of it can be extracted: without defences, 72–75% of attack conversations disclosed at least half of a skill's rules.
  3. A guard instruction and a lexical output filter bring that to about 2%, but block 12.5–19% of legitimate replies, because models quote rules while using them.
  4. Sealing protects a skill's artifacts from copying; it does not make its content or function secret.
SIGNED MANIFESTEd25519 signature by the skill owner over everything belowSkill metadataid · version · public descriptionPolicylicence issuer · confidential flagRECIPIENTSProvider AHPKE(CEK)Provider BHPKE(CEK)unwrapsENCRYPTED PAYLOADAES-256-GCM under the CEK, 64 KiB chunksSKILL.mdscripts/reconcile.pyscripts/validate.pyreferences/rules-2026.mdreferences/edge-cases.mdUnreadable without a provider's private key
From the paper's design. Anatomy of a sealed package. Each recipient entry holds the content key wrapped to the public key that provider publishes on its own domain.
Status
Draftpreprint draft, not peer reviewed, v1.0
Question
Can an AI agent skill be encrypted so that only a chosen AI provider can open it, and how much of it can a user still extract through the model?
Approach
A design and prototype (HPKE to a provider-published key, no handshake), then 896 conversations with two open models across eight skills and 24 attacks, a sealing benchmark and a tool-use case study.
References
61, among them RFC 9180 (HPKE), van Wyk et al. 2023 (encrypted prompts), Zhang et al. 2024 (prompt extraction) and the 2026 skill-stealing attacks.