What Happened
GitHub published a practical approach to agent skills: versioned directories built around a SKILL.md file that holds repeatable instructions. A single skill source can be packaged for Claude Code, Cursor, and GitHub Copilot, with CI checking that generated client files remain in sync. Skills do not provide tools, credentials, or permissions; those come from each execution environment. The example also uses a separate, reviewable manifest for project context rather than embedding discovered details in the skills [2].
The same workflow introduces Proof Agent as an independent GitHub Actions reviewer. It compares a coding agent’s changes with the original request and reports PASS, FAIL, or PARTIAL with evidence from changed files. Its review is static: it does not run tests. A FAIL can block merging when the check is required [2].
Other GitHub changes affect the surrounding development workflow: secret scanning now detects Cloudflare service tokens; enterprise public-monitoring alerts have direct links; and hosted GitHub Actions runners will stop supporting ARM32 jobs on Linux and Windows by December 8, 2026 [3][4][5]. The available VS Code Insiders item contains no release details, so it does not establish a feature change. The notes likewise do not substantiate new releases for Windsurf, Replit, Sourcegraph, JetBrains, or Continue.dev [1].
Why It Matters to Businesses
Portable instructions can reduce duplicated setup across coding assistants, but portability of instructions is not portability of execution. Differences in available tools, repository access, and permissions still affect what an agent can do. An independent review check adds evidence at the pull-request boundary, while tests and human approval remain necessary to establish that a change works and meets business intent [2].
Kimbodo Engineering Perspective
We would treat skills as versioned developer guidance, not as a security control. Keeping business context in a separate manifest makes it easier to inspect what an agent was told and update instructions without silently changing project facts. A static reviewer is useful for catching a mismatch between a request and a diff, but it should not be presented as proof of runtime correctness [2].
How We Would Implement It
- Maintain reviewed SKILL.md files as the source of truth; generate client-specific files for the assistants in use and fail CI when generated files drift [2].
- Test each client setup for skill recognition, references, available tools, and the evidence it produces. Keep discovered project context in a reviewable manifest [2].
- Require the independent diff-review check alongside automated tests, repository rules, and human review. Configure whether a FAIL blocks merging according to the repository’s risk level [2].
- Audit Actions workflows for ARM32 dependencies before the hosted-runner retirement, and enable the relevant secret-scanning alerts where available [3][4].
Risks, Costs and Security
Packaging and validating skills across clients adds CI and maintenance work; required review checks can also slow merges when findings need investigation. Do not put credentials in skills or assume the same permissions across assistants. Cloudflare token detection improves exposure visibility, but alerts still need an owner and a response process. Teams relying on hosted ARM32 execution must plan an alternative before support ends [2][3][4].
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Application Development practice, or Estimate My AI Application.
