Tag: security

How I revised agent workflows to preserve decisions, failed checks, and unfinished work—and what limited checks across Codex, Claude, and Antigravity actually showed.

Two recent preprints make the practical case for quarantining, pinning, reviewing, and testing third-party agent skills before installation.

Why standard code review misses capability escalation in skill manifests, and how to wire a pre-merge conftest policy gate and post-merge SLSA provenance chain that actually work — correcting three common mistakes in the recipes that circulate online.

A repo-ready operating contract for agent skills that prevents prompt bundles from drifting into unsigned, over-permissioned, unreviewed production dependencies.

Capability is no longer the hard question about AI agents. What the agent is permitted to do, and whether it will do it successfully, are. Here is why that distinction matters architecturally.