SkillZip Pro: Execution-Aware Dynamic Compression of Progressively Loaded Skills for Self-Evolving Agents
Xiaofan Bai, Chao Liu, Hongqiang Lin, Di Wu, Mingli Song, Xuan Jin, Xipeng Cao, Yuhong Li
cs.AI
2026-08-31
SkillZip Pro compresses progressive skill bundles as a graph, saving 38.1% deployed text and 10.4% run tokens; unprotected 71% compression drops accuracy 88% to 70%.
A production agent skill is a directory, not a prompt. The root SKILL.md loads on activation; references, schemas, scripts, and nested subskills open only when the current path needs them. That is the progressive-loading contract already used by Claude Code and Codex.
Older compression objectives miss the bill. Root-only methods leave most shipped bytes untouched and can copy rare branches into the always-loaded root. Flattening the directory into one document then compressing it destroys loading boundaries: once the routing sentence is rewritten, files still sit on disk and the agent can no longer reach them. The authors' earlier SkillZip compiled a single document. SkillZip Pro compiles the bundle as a resource graph.
A skill is a rooted directory graph. Four costs are kept separate: catalog metadata, the activated root, tokens loaded on one path, and total deployed bytes. The objective sums them with a λ=0.05 weight on deployment, so a disk win cannot dominate a slower common path. Proposition IV.1 is blunt: promoting a rare fragment into the root raises expected path cost unless the deployment term pays for it.
Two pillars. Cross-file compression deletes units already guaranteed by the root or a signed environment contract (host entailment); factors repeated fragments only inside the activation scope that loads them, never into a sparse root; and moves long, explicitly guarded branches into on-demand capsules with a one-line dispatcher left behind. Routing preservation locks the routing table, rereads the materialized directory, and ships the verbatim bundle if any required file became unreachable.
Every deletion carries a witness. W1 is literal containment. W2 is a deterministic coverage gate. W3 is a temperature-0 checker, and two deletions may not witness each other. Interface contracts (output schemas, label whitelists, worked examples) stay one contiguous verbatim span. Code, data, and assets are byte-locked.
When to compress and where the output lives are independent. One-Shot rebuilds the graph; Continual repairs the patch closure and, on failure, publishes the patched source rather than rolling back to the previous compressed bundle. Persistent rewrites the canonical directory; Transient leaves that directory untouched and builds a per-run execution view.
The executor is unmodified Qwen3.6-Plus. On three self-evolved bundles, SkillZip Pro scores 0.952 (BFCL), 0.394 (math), 0.333 (spreadsheet), average 0.560, against the uncompressed evolved bundle at 0.905 / 0.364 / 0.354, average 0.541. The human-written skill still leads math and averages 0.564. Versus the evolved bundle, shipped tokens fall from 2,649 to 2,112 (19.7% less), the root from 212 to 196 (7.3%), and mean path tokens from 588 to 500 (14.3%). Root-only SkillZip cuts the root 27.8% and barely touches deployment; routing fidelity is 0.000. Flat concatenation saves 63.8% of shipped tokens, keeps 0.241 of instruction lines, and also scores 0.000 on routing.
On 102 held-out tasks, paired bootstrap against the evolved bundle, SkillZip Pro reaches 0.480 success, +0.010, 95% interval [-0.029, +0.059]. It is the only compressor that clears the pre-registered quality bar. Required-resource recall is 0.755 versus 0.795 uncompressed; irrelevant load is 0.193 versus 0.171; reachable files rise from 6.3 to 10.3 because of shared modules and capsules. Instruction-line retention is 0.986, repeated text removed is 0.736, routing stays 1.000.
On growing skill libraries, Continual mode with repacking cuts shipped tokens 48.1% and per-run tokens 28.2%, using 3.31 compressor calls per round against 10 for a full rebuild, and 0.068s against 0.234s. On real evolved libraries, published runs save 34.7% shipped tokens versus 25.0% for the strongest still-faithful baseline.
The production moderation skill is the sharp case. The root is about 20,000 tokens, with three on-demand references and a locked risk map, about 13 reasoning rounds per audit, 100 live tasks. Unprotected compression saves 71.4% / 75.8% of the bundle and drops accuracy from 88.00% to 70.00% / 62.00%, with false positives rising from 10 to 29 / 35. W1/W2 only save 13.8%. Restricted W3 reaches 32.7%. Opening W3 inside the repeatedly loaded root (v3) saves 38.1% deployed tokens and 10.4% end-to-end tokens over 200 paired sessions, at 89.00% accuracy and 9 false positives, against same-session uncompressed scores of 92.00% and 91.00%. The static load model predicted about 3% per-run saving; a shorter root is amplified across rounds. Persistent mode without the audit renames a public subskill: discoverability and standalone success both hit 0.000.
If you already ship directory-shaped skills, compressing only SKILL.md is a quiet failure mode: files remain, the agent cannot select them. SkillZip Pro's deployment claim is narrower and more useful: the harness does not change, the output is an ordinary directory, and a failed audit republishes the source. The 71% versus 38% gap is the industrial lesson. The safe ratio is set by witness strength, not by a target percentage.
This is incremental systems work, not a new agent algorithm. Continual mode matches a full rebuild with about one third of the model calls, which is the setting that matters once a skill starts writing patches to itself.
Faithfulness is a structural contract, not every implicature a given model may have used. Without traces, uniform leaf weights can mis-price capsules and shared modules when traffic shifts. On the Chinese production bundle, an English-only deterministic extractor marked 7 of 264 instruction units as required. BFCL's held-out split is 21 questions, so 0.952 versus 0.905 is a few items. SkillReducer was run without its evaluation-guided candidate search, so that baseline is incomplete. λ=0.05 is a stated default, not a fit. The authors also say the quiet part: "evaluation-free" describes the compressor, not the evidence bar for publishing it.