AI Coding Live News

EDA leader Cadence announced the Maestro AI Model Portfolio on October 26: domain post-trained LLMs, trained decision models and self-improving agent skills that power its AuraStack, ChipStack, InnoStack and ViraStack AI Super Agents as they drive Cadence EDA and SDA tools. Cadence solvers score outputs against engineering constraints to close a reinforcement learning loop. Initial results per Cadence show up to 30% higher quality and up to 5x token efficiency versus a general-purpose foundation model. NVIDIA contributes Nemotron and OpenShell, and the stack runs on Cadence cloud, public cloud or on-premises. The first models reach select early access customers in Q4 2026.

In modern coding agent ecosystems (such as Claude Code, Cursor, Cline, and Antigravity), Agent Skills—specialized instruction files like SKILL.md and CLAUDE.md that dictate project architecture, commands, and rules—are continuously revised by developers alongside source code. Yet the concrete impact of these revisions on agent behavior and inference cost has remained largely unquantified. In a comprehensive empirical audit (arXiv:2610.04832), researchers analyze 2,608 first/last revision pairs across 3,159 Skills to measure the effects of revisions across 21 foundation models and four sandboxed coding agents. The study reveals that 55% of revisions alter specific rules or procedures. Adding a concrete rule raises compliance in single answers by +0.41 across open-weight models, increases required action adherence by +0.23 across sandboxed agents, and improves final task correctness by +0.10 in blind evaluations. Critically, these gains are overwhelmingly driven by rules that specify explicit CLI commands or exact file paths, whereas abstract stylistic guidance offers negligible lift. The paper also documents the performance and token trade-offs of dynamic on-demand skill loading.

Modern AI coding agents such as Claude Code, Codex, and terminal assistants routinely execute agent skills—instructions and executable scripts bundled in SKILL.md specifications—with full local user privileges. Developers share these skills primarily by copying files across repositories, inadvertently forging a shadow software supply chain without centralized registries, semver tagging, or provenance tracking. A seminal empirical audit by Fahd Seddik (arXiv:2610.11169) introduces Skill Constellations, constructing the first dated copy network of agent skills derived from git provenance across 2,193,119 skill adoptions on GitHub. The investigation demonstrates that a minuscule set of root repositories generates nearly all downstream copies, yet GitHub star counts correlate poorly with true lineage sources. Critically, downstream copies almost never adopt upstream security patches. By fitting a predictive copy network model, auditing just the top 100 identified root repositories halts 14.9% of subsequent high-risk skill adoptions (compared to a negligible 0.5% when inspecting the top 100 starred repos), proving the urgent necessity for decentralized package ecosystems to adopt versioned references over loose copies.

@Ryrenz highlights Tencent Zhuque Lab’s open-source AI-Infra-Guard (github.com/Tencent/AI-Infra-Guard): a full-stack AI red-team/scanner with 146+ AI components and 2000+ CVE rules (a recent drop added 155 rules across 40+ components). Beyond infra such as n8n, vLLM, MLflow, and LangFlow, it scans MCP servers and Agent Skills for prompt-injection and unauthorized file-read risks. Apache-2.0; intended for internal use and currently has no auth gate.

@AverageAiBro highlighted slopscan by @jothantranston: a zero-dependency Node CLI that grades a GitHub repo or local folder for AI slop, sketchy agent-skill patterns, and basic hygiene, then prints a shareable S–F score card. Three bars cover AI Slop, Security, and Hygiene; it flags curl pipes in SKILL.md and credential grabs, can export a card image, and fail CI under a score you set. Scans stay local under MIT.

@AverageAiBro highlighted ondrej-merkun/skill-audit, a local scanner for prompt-injection and malware patterns across Claude Code, Codex, Copilot, Cursor, Gemini CLI, Windsurf, Cline, AGENTS.md, installed skills, plugins, and MCP configs. It ships 46 rules with no cloud upload, optional deeper review through localhost OpenAI-compatible models, CI support via --fail-on REVIEW, and a GitHub Action under the @ondrej-merkun/skill-audit npm package.

@DanKornas highlighted AgriciDaniel/claude-obsidian, a local-first knowledge system for Claude Code and compatible Agent Skills hosts that turns sources into linked, cited Obsidian pages while evidence ledgers track authority, freshness, support, and contradictions. The vault stays ordinary Markdown/JSON with capture, retrieval, health checks, and reviewed writes. MIT-licensed; about 15k GitHub stars at verification (v2.2.0).

JetBrains released Rider and ReSharper 2026.2.2 featuring a dedicated AI Agent Setup widget. Developers can visually discover, configure, and authenticate MCP-compliant external tools, databases, and agent skills directly within the IDE.

The Model Context Protocol added a Skills extension (modelcontextprotocol/ext-skills). Servers declare io.modelcontextprotocol/skills; clients discover with skills/list, fetch metadata with skills/get, then load SKILL.md and supporting files via resources/read only when needed, instead of stuffing every skill into context. Spec: modelcontextprotocol.io/extensions/skills/overview.