On agent configuration, skill distribution, and the supply chain underneath them: what is happening in the ecosystem and what it means in practice. Subscribe via RSS.
The July 2026 AsyncAPI npm compromise passed trusted publishing and provenance checks. What those checks actually proved, and what they never claimed to.
Read →A July 2026 paper built the first dependency graph across 1.4 million agent skills, and found most carry no declared dependency metadata at all.
Read →Microsoft's Agent Framework made SKILL.md a stable, two-language API this month, and what that does and does not mean for anyone managing skills.
Read →The Model Context Protocol drops server sessions for a stateless core and writes down a deprecation policy for the first time. Here is what changes.
Read →Six months of disclosures converged on the same mitigations for agent skills. Here is what pinning and content hashes buy, and what they plainly do not.
Read →Claude Code and Codex read the same SKILL.md format but look for it in different places, and handle rules completely differently. The targets key makes one manifest install for both.
Read →Composition concatenates skills into one generated SKILL.md, carries their supporting files along, and regenerates whenever an input changes. Here is what it does and where the edges are.
Read →A .claude/skills directory has every property we spent twenty years teaching people to avoid in dependency management. Here is the case for a manifest and a lockfile.
Read →