Zero knowledge isn't magic; it's math you can verify. But when Tencent Cloud announced SkillPay, a platform where autonomous AI agents pay each other for 'skills'—like API calls to image generators, code reviewers, or data filters—they left out one critical detail: how do you verify that the skill was actually executed correctly? The press release is a classic PR artifact: all vision, no substance. As a zero-knowledge researcher who has spent years auditing smart contracts and building cryptographic proofs, I see a gap big enough to route a flash loan attack through. Let me spell it out.
The Hook: A Press Release with Zero Proof
On the surface, SkillPay is brilliant: a marketplace where an AI agent is broken into modular skills that can be rented or sold. Agent A wants to verify a legal document. It pays Agent B’s "LegalReviewSkill" via SkillPay. Agent B’s skill runs, returns the result, and the payment settles. The vision is an internet of agents, each monetizing their inner loops. But the announcement glosses over the fundamental question of trust. How does Agent A know that Agent B actually ran the skill? Not just returned a canned response? How does SkillPay prevent double-spending of results? How does it handle disputes? The article admits these are open problems, but typical marketing claims a "trustless environment" without revealing the mechanism. I don't trust a project until I've compiled its contracts and run the tests on a local testnet. Tencent Cloud hasn’t even released a whitepaper, let alone code.
Context: The Agent Economy and Its Verification Problem
Skills are the atomic units of an agent economy. Think of them as microservices for agents. SkillPay is supposed to be the App Store for agents—handling discovery, billing, and settlement. But here’s the rub: an agent is a black box. When one agent calls another’s skill, the calling agent (and its human owner) have no visibility into the execution environment. Was the skill executed on a trusted execution environment (TEE)? Was it executed on a blockchain? Or was it just a simple HTTP request that could be faked? The value of the skill is in the output, but the trust is in the process. This is a classic communication versus verification problem. In traditional finance, we use escrows and audits. In crypto, we use smart contracts and zero-knowledge proofs. SkillPay, as described, seems to rely on a centralized payment channel—essentially, Tencent Cloud’s servers act as the sole arbiter of truth. That’s not an Agent economy; it’s a feudal system where the platform holds the keys.
Core: Code-Level Analysis and Trade-Offs
Let’s dig into the technical architecture that would be required to make SkillPay secure. Based on my experience dissecting Uniswap V2’s AMM invariants and debugging signature malleability in Gnosis Safe, I can outline the three plausible approaches Tencent Cloud could take, along with their trade-offs.
Approach 1: Centralized Verifier (The Weakest Link)
The simplest implementation: SkillPay acts as a trusted proxy. Agent B’s skill runs in Tencent Cloud’s sandbox, the result is signed by a Tencent-controlled key, and payment goes through. This is a glorified API gateway with billing. The AMM model hides its truth in the invariant, but here the invariant is trust in Tencent. From a security perspective, this is trivial to implement but fails the "trustless" test. A malicious insider at Tencent could forge results. A compromised key could drain the entire system. Moreover, if Agent B’s skill is not hosted on Tencent Cloud (e.g., on-premise or another cloud), the verification becomes impossible. This approach centralizes risk and defeats the purpose of an open agent economy.
Approach 2: On-Chain Verification via Smart Contracts
Tencent Cloud could deploy a blockchain— either a permissioned chain (e.g., Tencent Chain) or a public chain (e.g., Ethereum L2) —to record skill executions. Each skill invocation becomes a transaction. The skill provider submits a commitment (hash) of the input and the contract enforces payment only if the output matches a pre-negotiated condition. This is similar to how Chainlink oracles work. But there’s a catch: you need to define what constitutes a "correct" output. For a deterministic skill (e.g., image resize), the output is easy to verify. But for a non-deterministic skill (e.g., "generate an image of a dragon"), there’s no ground truth. The contract would have to rely on subjective arbitration, which reintroduces the trust problem. Gas costs on public chains would also kill the micro-payment model unless you use an L2 (but then you need a DA layer). I've run gas simulations for zkSync and Arbitrum; the overhead is non-trivial for high-frequency agent calls.
Approach 3: Zero-Knowledge Proofs (The Most Elegant)
The ideal solution: each skill execution is accompanied by a ZK proof that the computation was performed correctly according to the skill’s code. Agent B would run the skill, generate a succinct proof (e.g., a SNARK or STARK), and submit it to SkillPay. The proof verifies in milliseconds without revealing the input or output. Payment is released upon proof verification. This is what I call the "ZK invariant." But this requires that skills are expressed as arithmetic circuits or at least in a ZK-friendly language (e.g., Cairo or custom DSLs). The overhead of proof generation is enormous—minutes to hours for complex models. A 38-year-old ZK researcher in Shenzhen might have the patience, but a production agent calling a language model at 10 req/s will not. Tencent Cloud would need to offer hardware acceleration (e.g., FPGA or ASIC) for proof generation, which is capital-intensive. The trade-off: you get full verifiability, but you sacrifice speed and generality.
Based on my 2020 deconstruction of Uniswap V2, I know that even simple invariants can hide game-theoretical pitfalls. The SkillPay team must consider the economic security of their verification mechanism. Without proof, agents can cheat. With centralized proof, they might still cheat if the platform is compromised. With ZK proofs, they need to standardize the skill language. It’s a classic trilemma.
Contrarian: The Real Security Blind Spot Isn’t the Tech—It’s the Incentives
Most critics will focus on the cryptographic verification. But the bigger blind spot is the principal-agent problem. In an agent economy, each agent acts on behalf of a human (or another agent). The skill creator is an agent too. Let’s say I develop a "CreditScoreCheck" skill that determines loan eligibility. I have an incentive to make the output look favorable for certain inputs to boost my skill’s popularity. If Agent A calls my skill to evaluate a borrower, I can collude with the borrower to return a high score. The platform cannot detect this because the computation is a black box. Even with ZK proofs, the proof only shows that the computation was performed as programmed—not that the program was honest. This is the oracle problem. In my 2021 Axie Infinity forensics, I found a similar vulnerability: the breeding fee calculation had an edge case that allowed infinite token generation. The code was correct for 99% of cases, but the edge case was exploitable. Here, the "code" of a skill can be written to pass verification but behave maliciously under specific conditions. The platform would need a combination of reputation systems, slashing, and continuous verification with random challenges. The article mentions none of this.
Another contrarian angle: the most likely attack vector isn’t a cryptographic break but a business logic exploit. The pricing mechanism itself. SkillPay apparently allows variable pricing, possibly usage-based. If a skill cost is calculated based on execution time, an attacker could craft an input that forces an infinite loop (or very long computation) to drain the payer’s budget. Without a gas limit or timeout enforced at the protocol level, this is a recipe for disaster. I've seen similar attacks in Ethereum smart contracts where the delegatecall pattern allowed reentrancy. The code doesn't lie, but it misleads when the incentives are misaligned.
Furthermore, the press release states that SkillPay is built on Tencent Cloud’s existing infrastructure. That means the payment layer is likely WeChat Pay or a Tencent-bank integration. This brings in regulatory risks. If an agent makes a payment, who is legally liable? The agent owner? The skill provider? Tencent Cloud? Cross-border payments become a nightmare. The article’s analysis correctly flags this as a high-impact, low-probability risk, but from a security perspective, the regulatory ambiguity is a silent kill switch. I don’t trust a project until I've run its compliance tests through a sandbox—and here the sandbox doesn’t exist.
Takeaway: The Only Verifiable Future is a ZK-Infused One
Tencent Cloud’s SkillPay is a bold vision, but it’s built on sand without a verification foundation. The market is a bull market for agent narratives, and investors are pouring money into anything AI. But technical reality will hit soon. The question is not whether SkillPay can work—it can, in a limited, centralized form. The question is whether it can scale into a trustless ecosystem that truly empowers agents. Based on my years of auditing and building ZK systems, I predict one of two outcomes: either Tencent Cloud will invest heavily in a ZK-proving layer within the next 12 months, or they’ll pivot to a more modest "API marketplace with billing" and abandon the agent-to-agent story. The GitHub repo is the early signal. Since the announcement, there’s no public code, no whitepaper, and no testnet. Silence is the best security protocol, but sometimes it’s just hiding the lack of a protocol.
I’ll be watching. I’ve already started sketching a Python simulation of a ZK-based skill verification system to test the gas costs and latency. If Tencent Cloud doesn’t provide a verifiable mechanism, someone else will—and that someone else will win the agent economy. Math doesn't care about marketing budgets.
Zero knowledge isn't magic; it's math you can verify. Tencent Cloud better start writing the math.
