Agents18d ago
Skill Constellations: The First Supply Chain Audit of 2.19M GitHub Agent Skills Reveals Vulnerability Propagation Patterns
Modern AI coding agents such as Claude Code, Codex, and terminal assistants routinely execute agent skills—instructions and executable scripts bundled in SKILL.md specifications—with full local user privileges. Developers share these skills primarily by copying files across repositories, inadvertently forging a shadow software supply chain without centralized registries, semver tagging, or provenance tracking. A seminal empirical audit by Fahd Seddik (arXiv:2610.11169) introduces Skill Constellations, constructing the first dated copy network of agent skills derived from git provenance across 2,193,119 skill adoptions on GitHub. The investigation demonstrates that a minuscule set of root repositories generates nearly all downstream copies, yet GitHub star counts correlate poorly with true lineage sources. Critically, downstream copies almost never adopt upstream security patches. By fitting a predictive copy network model, auditing just the top 100 identified root repositories halts 14.9% of subsequent high-risk skill adoptions (compared to a negligible 0.5% when inspecting the top 100 starred repos), proving the urgent necessity for decentralized package ecosystems to adopt versioned references over loose copies.
Release14d ago
Claude Code 2.1.299 adds idle compaction for 200K+ token sessions before cache expiry and fixes sandboxed writes into --plugin-dir
Anthropic released Claude Code 2.1.299 on Oct 14. A new default compacts a 200K+ token terminal conversation after about 54 idle minutes, before its one-hour prompt cache expires, so the next message doesn't reprocess everything; tune it with CLAUDE_CODE_IDLE_COMPACT_MIN_TOKENS or turn it off with "idleCompaction": false. The release also fixes sandboxed shell commands being able to write into a --plugin-dir folder whose code Claude Code reloads outside the sandbox, and adds --disallow-tools to claude plugin eval.
Tooling5d ago
Anthropic donates the Agent Skills open standard to the Linux Foundation’s Agentic AI Foundation, after 70+ agent platforms adopted it with 1M skills published and nearly 280M installs
On 2026-10-22 Anthropic said it is donating Agent Skills, the open standard that teaches agents a task through a folder with a SKILL.md file, to the Agentic AI Foundation (AAIF) under the Linux Foundation, the same neutral home it gave MCP. The donation covers the Agent Skills name and logo, the GitHub organization and the agentskills.io domain. Anthropic says more than 70 agent platforms, including ChatGPT, Cursor, GitHub Copilot and VS Code, have integrated the standard since December 2025, with 1 million skills published and nearly 280 million installs. Engineers from Anthropic, Google, OpenAI and others will maintain it as individuals.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.