Expertise a colleague's agent can apply, and the colleague cannot read.
A use-only skill shares what an expert knows so an AI agent can apply it to a task, while the recipient cannot read, copy or export its contents. The protection is structural: the confidential body is never placed in the agent's readable context, so it cannot be disclosed through the agent.
The whitepaper is sent on request.
Tested as an insider would attack it.
- 0disclosures across all adversarial attempts
- 259extraction attempts, with 24 techniques on 4 AI models
- 105automated tests that fail if the protection regresses
- 100%of content-retrieval paths redacted or blocked
One question, answered precisely.
A subject-matter expert writes down proprietary knowledge (a litigation playbook, a pricing model, a diligence checklist) as a skill, and shares it so a colleague's agent can apply it to live work. The whitepaper answers:
Can a person to whom a use-only skill is shared extract its contents through the AI agent?
The adversary that matters is an authorized insider: a recipient granted use of the skill who tries to turn “use” into “copy”. That is different from an outside attacker, and it is the threat the feature is designed for.
Threat model
Protected asset
The confidential body of a use-only skill: its instructions and reference files.
Adversary
An authorized use-only recipient of the skill.
Adversary capabilities
Full access to the AI agent and its skills tools; arbitrary prompts; a capable, cooperative model; knowledge that the skill exists.
Security objective
The recipient can apply the skill to a task but cannot obtain its verbatim contents, or a faithful paraphrase, through any path the system exposes.
Structural protection, not behavioural.
Instructions, training and output filters are heuristic; they cannot guarantee non-disclosure under adversarial input. A control that depends on the model choosing not to reveal content gets weaker as models change.
Behavioural control
Give the agent the skill body and instruct it to apply the content without revealing it. Disclosure then depends on the model's discretion, which is heuristic and can be broken under adversarial pressure.
Structural control
For a use-only recipient, the skill body is never placed in the agent's readable context. It is delivered out of band for application only, and every retrieval path (read, export, file fetch) returns a redacted result or an error.
The model's refusal behaviour is kept only as a secondary backstop. It is not the guarantee.
Verified in three layers.
Structural verification, live against production
Acting as an authorized use-only recipient, every content-retrieval path exposed by the agent's tools was exercised. None returned the skill body. The result does not depend on which AI model is in use.
| Retrieval path | Outcome |
|---|---|
| open_skill (apply the skill) | Metadata onlyThe body is not present in the agent’s context |
| Read the body as a file | Not found |
| Crafted file-path traversal | RejectedPath-traversal protection |
| Operating-system path traversal | BlockedAt the network boundary, as defence in depth |
| Export the skill package | RefusedFor a use-only recipient |
Each application of a use-only skill is recorded in the audit log: recipient identity, client, workspace, timestamp.
Automated regression coverage
The access-control logic is covered by 105 automated tests (89 service-level, 16 protocol-level), built to fail if the protection regresses. Mutation testing confirms it: disabling the path-traversal validator exposes the secret, so any future weakening breaks the build. Coverage spans the full access-level, scope and tenant matrix; redaction on every read path (and the converse: a Read grantee correctly receives the body); path-traversal rejection; and fail-closed audit logging, so if the audit write fails, no content is served.
Adversarial extraction study
To test the behavioural backstop, an agent was given the confidential body (with a marked canary value) under the production non-disclosure directive and subjected to 24 escalating techniques: direct requests, authority and urgency pressure, “ignore previous instructions” injections, debugging and tool-confusion prompts, translation, Base64, acrostic and fill-in-the-blank extraction, and post-refusal persistence. It ran across four generative-AI models, with model identity verified from run logs.
| Model | Attempts | Substance disclosures |
|---|---|---|
| Claude Opus 4.8 | 120 | 0 |
| Claude Opus 4.7 | 48 | 0 |
| Claude Sonnet 4.6 | 43 | 0 |
| Claude Haiku 4.5 | 48 | 0 |
| Total | 259 | 0 |
A few responses from the smallest model acknowledged that confidential content existed while still refusing to reveal it; manual review confirmed no disclosure.
A zero-disclosure count is reported with its sample size and a confidence bound, not as a “0% rate”. By the rule of three, zero events in 259 trials is consistent with a true behavioural disclosure rate below about 1.2% (one-sided 95% bound). This bound applies only to the behavioural backstop; the structural guarantee is categorical for the paths tested, not probabilistic.
Four layers. If an upper layer fails, the one below contains it.
- L1
Audit logging
Every application is attributed: recipient, client, workspace, timestamp. A detective control.
- L2
Non-disclosure directive
The agent is instructed to apply the skill and not reveal it. Behavioural, so a heuristic backstop only.
- L3
Content scoping
The body is marked for application only, so conforming clients do not render it.
- L4
Structural redaction
The primary control. The body is never placed in the agent’s readable context; every read, export and file path redacts or errors. It does not depend on the model.
What this protects, and what it deliberately does not.
A trust decision needs an explicit boundary. This is ours.
Protected
- The confidential skill body (instructions and reference files) against extraction by a use-only recipient through the agent.
- Every ordinary retrieval path: read, export and file fetch all redact or error.
- Attribution: every application is captured in the audit log.
Out of scope, by design
- Users granted Read access or higher. They are authorized to view the content.
- A non-conforming AI client the customer connects. Connected clients are part of the customer's trust boundary.
- The applied work product, such as a draft brief. That output belongs to the user.
- Out-of-band channels, such as photographing a screen.
Residual risk, stated plainly: the behavioural backstop is specific to the models tested and weaker on smaller models, which is exactly why the model-independent structural control is primary. The adversarial study was scored within a single model family; an independent red-team assessment would further strengthen the behavioural result. Reported figures are statistical bounds, not certainties of zero.
Use is the strictest of five access levels, and every use is logged.
A skill has one owner. The owner or an admin grants a teammate by name or email, or the whole workspace at once, one of four levels: Use, Read, Edit or Admin. That makes the five columns below. Use-only sharing is on the Business plan.
| Capability | Use | Read | Edit | Admin | Owner |
|---|---|---|---|---|---|
| Find in the library and search | Yes | Yes | Yes | Yes | Yes |
| Run it, or apply it to an agent | Yes | Yes | Yes | Yes | Yes |
| See the instructions and files | No | Yes | Yes | Yes | Yes |
| Export or clone | No | Yes | Yes | Yes | Yes |
| Edit content and publish versions | No | No | Yes | Yes | Yes |
| Manage sharing, delete | No | No | No | Yes | Yes |
| Transfer ownership | No | No | No | Yes | Yes |
Scroll the table sideways to see all five levels.
Per-skill activity
Owners and admins see total applies, distinct users and last-applied for each skill, with a newest-first event trail: body applied, file applied, bound to an agent, viewed. The applier's identity is visible only to the owner and admins, and the applier never sees the body.
Workspace access log
One log across every skill in the workspace, for workspace admins. Filter by skill, by user or by event type. It answers who used what expertise, and when, in one place.
Workspaces are the outer boundary: many firms run one workspace per client or matter, with per-skill grants as the fine grain inside it.
See the Business planCommon questions about use-only skills
What is a use-only skill?
A skill someone can run but not read. The agent applies the expertise written in it, while the recipient cannot read, copy or export the contents. Use is the strictest of the access levels: a skill has one owner, and everyone else is granted Use, Read, Edit or Admin. Every use is logged.
Is the protection structural, or is the model just told not to reveal it?
Structural. For a use-only recipient the skill body is never placed in the agent’s readable context, and every path that could return it (read, export, file fetch) returns a redacted result or an error. An instruction not to reveal the content is also in place, but only as a backstop.
What threat model is this defended against?
An authorized insider: someone who has been granted use of the skill and tries to turn “use” into “copy”. They have full access to the agent and its skills tools, and they know the skill exists.
How has that been verified?
In three layers: every content-retrieval path was exercised live against production as a use-only recipient, 105 automated tests fail if the protection regresses, and an adversarial study ran 259 extraction attempts with zero disclosures.
What does use-only deliberately not protect against?
It protects the contents of the skill, not its output. The work the agent produces belongs to the person who ran it. People granted Read access or higher are allowed to see the content, an AI client that does not honour the application-only marking is part of your own trust boundary, and out-of-band channels such as photographing a screen are out of scope.
Can we read the whitepaper?
Yes, on request. Use the “Request the whitepaper” button on this page and we will send it to you.
Read the whitepaper with your security team.
It sets out the security model, the threat model, the evaluation and its limits. We send it on request.