Skill-as-API: Confidential Multi-Agent Coordination for Agentic Software Engineering
The paper proposes Skill-as-API, a protocol for multi-agent software-engineering workflows where agents can expose callable skills without sending the underlying prompt, implementation, or proprietary logic across the coordination channel. Its main idea is to move confidentiality into the protocol boundary—only metadata like name, description, schemas, and trust tier are public while the skill body stays closure-captured locally—which is cleaner than post-hoc filtering, though the prototype evidence is still fairly limited: an XMTP Python implementation, latency measurements, and a small pull-request-review case study rather than a broad security or usability evaluation.
Abstract
AI coding agents are evolving from solitary tools into collaborative teammates that discover and invoke one another's specialized skills. But the coordination channel itself can leak a skill's intellectual property. Protocols such as MCP and A2A run implementations server-side, yet they still publish each skill's description and typed schemas to every peer, offer no way to hide a skill's existence, and cannot guarantee that a wrapped system prompt stays off the wire. Application-layer privacy filters help, but act only after the model has decided to emit sensitive text. We take a complementary, protocol-layer route: Skill-as-API, a coordination protocol whose public view of a skill is limited to its name, description, typed input/output schemas, and trust tier. The skill body is closure-captured in the owner's process and never crosses the wire. Four layers add access control and narrow the prompt-injection surface structurally rather than by filtering content. We provide an open-source Python implementation over XMTP with 1.8-2.9 s cross-continent hot-reconnect latency, and a software-engineering case study in which three agents coordinate a pull-request review while each retains ownership of its proprietary analysis prompts.