A skill compiler lifts Claude Code pass rates from 21% to 33% — and catches a missing safety guard in 95% of real-world skills

Notes on SkCC: Portable and Secure Skill Compilation for Cross-Framework LLM Agents (arXiv:2605.03353) — Yipeng Ouyang, Yingjiao Xiao, Yuhao Gu, Xianwei Zhang · May 2026

Note published July 25, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

AI-assisted notes · reviewed by SkillFed Skill security

SkCC treats SKILL.md as source code, not the final artifact. A syntax parser lowers the raw markdown into a typed abstract syntax tree; an IR builder then normalizes that tree into SkIR, a strongly-typed intermediate representation capturing a skill's procedures, permissions, input/output schemas, constraints, and MCP dependencies independent of any target framework. Before anything gets emitted, a static Security Optimizer runs four passes over the IR — structural validation, permission auditing, pattern-based injection of missing safety constraints like timeouts, loop bounds, and destructive-operation guards, and risk-tier classification. From there, four emitters render the same hardened IR differently per framework: Claude gets XML-tagged sections, Gemini switches to YAML once nesting passes a depth threshold, Kimi keeps full markdown, Codex gets XML-tagged markdown to dodge JSON's token overhead. Parsing and static analysis run once per skill no matter how many targets follow, which is why adaptation cost moves from O(m×n) — m skills times n frameworks, each pair hand-rewritten — to O(m+n).

On SkillsBench — 89 tasks run against 225 skills pulled from four community repositories, spanning Claude Code, Codex CLI, Gemini CLI, and Kimi CLI — compiled skills lifted Claude Code's pass rate from 21.1% to 33.3% and Kimi CLI's from 35.1% to 48.7%; Gemini CLI barely moved. Compilation itself averaged under 9ms per skill across all four targets combined. The security pass found something to flag in 94.8% of a separate 233-skill corpus, most often missing HTTP timeout or retry limits and unbounded loops. Runtime token consumption dropped 10-46% depending on framework and skill complexity. A follow-up ablation then swapped the Kimi-optimized compiled format onto two other models, GLM and DeepSeek, run through a different harness — the gain that was statistically significant for Kimi (p=0.0063) vanished for both, confirming that format gains track a specific model rather than one markdown dialect being universally better.

Key numbers

Claude Code pass rate, compiled vs. original	21.1% → 33.3%
Kimi CLI pass rate, compiled vs. original	35.1% → 48.7%
Community skills flagged by the security pass	221 of 233 (94.8%)
Mean compilation latency, all 4 frameworks	8.93ms across 225 skills
Runtime token savings across frameworks	10-46%

What this means for skill authors

The framing worth sitting with is the division of labor: skill semantics live in the IR, format optimization lives in the emitter, and an author writes the skill exactly once. That's the same split LLVM made for hardware targets two decades ago, now applied to the fact that Claude, Gemini, and Kimi each reward a different markup dialect for identical instructions. It turns "skill portability" from a documentation problem — write markdown clear enough for any framework to parse — into a compilation problem with a measurable artifact, the IR, sitting between author intent and framework output.

The ablation matters more than the headline pass-rate jump. A format tuned for one model's preferences didn't transfer to two others run through a different harness — evidence that "better formatting" isn't a single target to hit, and that any system rewriting skills for portability needs per-target backends, not one canonical markdown style everyone converges on.

The security numbers land closer to home for anyone running a skill catalog. Automated, pre-execution scanning of a real community corpus flagged something worth fixing in the overwhelming majority of skills — missing timeouts, unbounded retry loops, destructive database calls with no confirmation step. That's exactly the class of gap dual-tool scanning exists to catch before a skill reaches a vetted catalog, and it's a data point for treating skill review as mandatory infrastructure rather than an author courtesy.

Skills related to this research

axiom-optimize-build This skill audits Xcode projects to pinpoint build performance issues across settings, scripts, type checking, and compiler flags. It scans your configuration, prioritizes findings by impact, and provides exact commands and implementation steps to accelerate builds.★ 1,095 understand Understand scans your codebase and builds an interactive knowledge graph stored as JSON, letting you explore your project's architecture and component relationships through a visual dashboard. Configure analysis scope with language preferences, exclusion patterns, and auto-update settings.★ 76,455 understand-figma This skill connects to your Figma file via the REST API to map its structure—pages, screens, components, instances, and design tokens—into an interactive knowledge graph. The result appears as a searchable, explorable dashboard within your existing environment.★ 76,455 understand-knowledge understand-knowledge processes three-layer knowledge bases (raw sources, wiki markdown, schema) to extract entities, resolve wikilinks, and cluster topics into an interactive graph. It detects the Karpathy wiki pattern, dispatches LLM agents to find implicit relationships, merges results with deterministic extraction, and outputs a navigable knowledge graph dashboard.★ 76,455

Related notes

References

Ouyang, Y., Xiao, Y., Gu, Y., & Zhang, X. (2026). SkCC: Portable and Secure Skill Compilation for Cross-Framework LLM Agents. arXiv:2605.03353.
Lattner, C., & Adve, V. (2004). LLVM: A compilation framework for lifelong program analysis & transformation — the single-IR, multi-backend compilation model SkIR builds on.
Lattner, C., et al. (2021). MLIR: Scaling compiler infrastructure for domain-specific computation — cited as the modern extension of IR-based compilation to domain-specific pipelines.
Chen et al. (2026). SkVM — prior JVM-style compilation architecture for agent skills, cited as SkCC's closest predecessor (semantic capability compilation without format adaptation or security enforcement).
Snyk (2026). Security audit of community agent skills — cited as the motivating finding that roughly 37% of a sample of ~3,984 community skills contain vulnerabilities.