Agents18d ago
Skill Constellations: The First Supply Chain Audit of 2.19M GitHub Agent Skills Reveals Vulnerability Propagation Patterns
Modern AI coding agents such as Claude Code, Codex, and terminal assistants routinely execute agent skills—instructions and executable scripts bundled in SKILL.md specifications—with full local user privileges. Developers share these skills primarily by copying files across repositories, inadvertently forging a shadow software supply chain without centralized registries, semver tagging, or provenance tracking. A seminal empirical audit by Fahd Seddik (arXiv:2610.11169) introduces Skill Constellations, constructing the first dated copy network of agent skills derived from git provenance across 2,193,119 skill adoptions on GitHub. The investigation demonstrates that a minuscule set of root repositories generates nearly all downstream copies, yet GitHub star counts correlate poorly with true lineage sources. Critically, downstream copies almost never adopt upstream security patches. By fitting a predictive copy network model, auditing just the top 100 identified root repositories halts 14.9% of subsequent high-risk skill adoptions (compared to a negligible 0.5% when inspecting the top 100 starred repos), proving the urgent necessity for decentralized package ecosystems to adopt versioned references over loose copies.
Agents27d ago
UIUC Proposes Meta-Skills for Agent Harness Design in Test-Time AI4AI: 12% Performance Gain Without Weight Updates
Agent efficacy relies heavily on execution environments (harnesses) in addition to reasoning capability. UIUC researchers led by Heng Ji propose a test-time AI-for-AI (AI4AI) framework where a Builder agent learns 'Meta-Skills' to construct custom execution environments for a frozen Target agent. Learned from execution feedback, these principles guide when and what support resources to provide. Across Harness-Bench and NewtonBench, meta-skill harnesses improve macro-average performance by 8.95 percentage points over baseline and 12.02 points over direct skill delivery, paving the way for autonomous system-level self-improvement.
Tooling5d ago
Anthropic donates the Agent Skills open standard to the Linux Foundation’s Agentic AI Foundation, after 70+ agent platforms adopted it with 1M skills published and nearly 280M installs
On 2026-10-22 Anthropic said it is donating Agent Skills, the open standard that teaches agents a task through a folder with a SKILL.md file, to the Agentic AI Foundation (AAIF) under the Linux Foundation, the same neutral home it gave MCP. The donation covers the Agent Skills name and logo, the GitHub organization and the agentskills.io domain. Anthropic says more than 70 agent platforms, including ChatGPT, Cursor, GitHub Copilot and VS Code, have integrated the standard since December 2025, with 1 million skills published and nearly 280 million installs. Engineers from Anthropic, Google, OpenAI and others will maintain it as individuals.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.