{"id":"https://openalex.org/W7225449737","doi":"https://doi.org/10.5281/zenodo.24042353","title":"Does a Security Skill Beat a One-Line Reminder? A Blinded, Pre-Registered Test of Agent Skill Files for Safer AI-Generated Code","display_name":"Does a Security Skill Beat a One-Line Reminder? A Blinded, Pre-Registered Test of Agent Skill Files for Safer AI-Generated Code","publication_year":2026,"publication_date":"2026-11-08","ids":{"openalex":"https://openalex.org/W7225449737","doi":"https://doi.org/10.5281/zenodo.24042353"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.24042353","doi":"https://doi.org/10.5281/zenodo.24042353","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24042353","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.24042353","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5159138735","display_name":"Karthik Annadurai","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I181514455","display_name":"International Institute of Information Technology Bangalore","ror":"https://ror.org/05h9eqy10","country_code":"IN","type":"education","lineage":["https://openalex.org/I181514455"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Annadurai, Karthik","raw_affiliation_strings":["International Institute of Information Technology Bangalore"],"raw_orcid":"https://orcid.org/0009-0008-8422-3565","affiliations":[{"raw_affiliation_string":"International Institute of Information Technology Bangalore","institution_ids":["https://openalex.org/I181514455"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5159138735"],"corresponding_institution_ids":["https://openalex.org/I181514455"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.8041999936103821,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.8041999936103821,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.07479999959468842,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.06669999659061432,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ai-coding-agents","display_name":"coding agents","score":0.9300000071525574},{"id":"https://openalex.org/keywords/security-failures","display_name":"security failures","score":0.3569999933242798},{"id":"https://openalex.org/keywords/owasp-top-10","display_name":"OWASP Top 10","score":0.9290000200271606},{"id":"https://openalex.org/keywords/security-checklist","display_name":"security checklist","score":0.7080000042915344},{"id":"https://openalex.org/keywords/code-generation","display_name":"code generation","score":0.44999998807907104},{"id":"https://openalex.org/keywords/gpt-5","display_name":"GPT-5","score":0.8679999709129333},{"id":"https://openalex.org/keywords/token-efficiency","display_name":"token efficiency","score":0.42800000309944153}],"concepts":[{"id":"https://openalex.org/C2776654903","wikidata":"https://www.wikidata.org/wiki/Q2601463","display_name":"SAFER","level":2,"score":0.7172999978065491},{"id":"https://openalex.org/C2779356329","wikidata":"https://www.wikidata.org/wiki/Q922625","display_name":"Checklist","level":2,"score":0.5882999897003174},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5875999927520752},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5228000283241272},{"id":"https://openalex.org/C179518139","wikidata":"https://www.wikidata.org/wiki/Q5140297","display_name":"Coding (social sciences)","level":2,"score":0.47690001130104065},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.39079999923706055},{"id":"https://openalex.org/C2777267654","wikidata":"https://www.wikidata.org/wiki/Q3519023","display_name":"Test (biology)","level":2,"score":0.3107999861240387},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.303600013256073},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.28450000286102295},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.28360000252723694},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.28029999136924744},{"id":"https://openalex.org/C94124525","wikidata":"https://www.wikidata.org/wiki/Q912550","display_name":"Categorization","level":2,"score":0.2517000138759613},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.2515999972820282}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.5281/zenodo.24042353","doi":"https://doi.org/10.5281/zenodo.24042353","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24042353","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.24042354","doi":"https://doi.org/10.5281/zenodo.24042354","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24042354","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.5281/zenodo.24042353","doi":"https://doi.org/10.5281/zenodo.24042353","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24042353","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7171677906","https://openalex.org/W7204451290","https://openalex.org/W7163907095","https://openalex.org/W7201848377","https://openalex.org/W7223014664","https://openalex.org/W7213279899","https://openalex.org/W7224792821","https://openalex.org/W7214353219","https://openalex.org/W7213310941","https://openalex.org/W7202161031"],"abstract_inverted_index":{"AI":[0],"coding":[1],"agents":[2],"often":[3,25],"build":[4],"functional":[5],"apps":[6],"and":[7,53,62,78,141,162,187,228,267],"websites,":[8],"but":[9,30],"implicitly":[10],"leave":[11],"out":[12],"security":[13,43,51,102,160,168,242],"features":[14],"that":[15,241],"were":[16],"not":[17,119,198,261],"requested.":[18],"Agent":[19],"skills":[20],"(packaged":[21],"instruction":[22,246],"files)":[23],"are":[24],"used":[26,229],"to":[27,45,91,136,184,226,255],"combat":[28],"this,":[29],"we":[31],"found":[32],"little":[33],"evidence":[34],"comparing":[35],"them":[36],"with":[37,72,97,166,189],"simply":[38],"adding":[39],"a":[40,50,57,63,79,83,112,159,163],"line":[41],"of":[42,234,250],"advice":[44],"the":[46,87,105,116,123,137,142,149,171,190,205,212,232,251],"prompt.":[47],"We":[48],"built":[49],"skill":[52,65,117,144,206],"tested":[54],"it":[55],"against":[56,215],"one-line":[58],"reminder,":[59,191],"no":[60,146,167,208,235],"guidance,":[61],"public":[64,143],"on":[66,104,128,132],"Codex":[67],"CLI.":[68],"This":[69],"was":[70,89,118],"done":[71],"pre-registered":[73],"rules,":[74],"blinded":[75],"code":[76,266],"review":[77],"feature-fidelity":[80],"check.":[81],"On":[82,111,170],"strong":[84],"model":[85,114],"(gpt-6.1-sol),":[86],"reminder":[88,124,213],"sufficient":[90],"eliminate":[92],"all":[93,202],"critical":[94,101,179],"failures":[95,180],"(runs":[96],"at":[98,258],"least":[99],"one":[100],"failure)":[103],"original":[106],"seven":[107],"prompts":[108,173,204],"(0/35":[109],"runs).":[110],"weaker":[113],"(gpt-5.6-luna),":[115],"detectably":[120],"better":[121,147],"than":[122,148,245],"in":[125,220],"two":[126,156],"rounds":[127],"fresh":[129],"variants,":[130],"or":[131,193],"ten":[133],"probes":[134],"mapped":[135],"OWASP":[138],"Top":[139],"10,":[140],"did":[145,197],"reminder.":[150],"A":[151],"final":[152],"400-run":[153],"phase":[154],"added":[155],"extra":[157],"arms:":[158],"checklist,":[161],"checklist-length":[164],"placebo":[165,196],"content.":[169],"three":[172],"where":[174],"no-guidance":[175],"runs":[176],"sometimes":[177],"passed,":[178],"fell":[181],"from":[182],"23/30":[183],"between":[185],"6/30":[186],"9/30":[188],"checklist":[192],"skill.":[194],"The":[195,237],"help":[199],"(22/30).":[200],"Across":[201],"eight":[203],"showed":[207],"detectable":[209],"advantage":[210],"over":[211],"(27/80":[214],"23/80;":[216],"difference":[217],"+5":[218],"points":[219],"failure":[221],"rate,":[222],"95%":[223],"interval":[224],"\u22129":[225],"+19)":[227],"1.7":[230],"times":[231],"tokens":[233],"guidance.":[236],"checklist-placebo":[238],"contrast":[239],"suggests":[240],"content,":[243],"rather":[244],"length,":[247],"carries":[248],"most":[249],"benefit.":[252],"Preprint;":[253],"submitted":[254],"AGENT":[256],"2027":[257],"ICSE":[259],"2027,":[260],"yet":[262],"peer":[263],"reviewed.":[264],"Data,":[265],"criteria:":[268],"https://doi.org/10.5281/zenodo.23498723":[269]},"counts_by_year":[],"updated_date":"2026-11-09T13:22:03.289127","created_date":"2026-11-08T00:00:00"}