Coding With Agents in TypeScript: Setup, Skills and Pitfalls in 2026

The Shift: From Autocomplete to Delegation — and Why It's Breaking Old Habits

The developer’s role in 2026 has fundamentally inverted. You no longer type code; you delegate tasks to autonomous agents that run for hours.

This shift is no longer theoretical. Andrej Karpathy reported flipping his workflow from 80% manual coding to 80% agent-driven work within a single month. The terminal is the new primary interface because it treats context as scarce and keeps feedback loops atomic.

Productivity gains are now measurable and significant. TELUS teams using Claude Code shipped code 30% faster, saving over 500,000 hours in the process. Similarly, Rakuten leveraged an agent to implement a complex vLLM feature in 12.5 million lines of code in just seven hours.

However, the core challenge has moved from prompt writing to harness design. The model is just the engine; the harness is the vehicle.

Chat-level prompting skill is now a commodity. What differentiates success is the architecture surrounding the model. This includes tools, context management, sub-agents, and deterministic checks.

The "harness" determines performance as much as the model weights themselves. Benchmarks show that swapping the wrapper moves results as much as swapping the underlying model. Aaron Tay argues that prompt engineering is the wrong mental model for 2026.

You must master a new abstraction layer. This layer involves:

• Context management and memory strategies
• Sub-agent orchestration and work decomposition
• Deterministic validation and security permissions
• Model routing for cost and speed efficiency

Success now depends on this architectural judgment, not just the ability to write a good prompt. The agent is the worker; the harness is the manager.

This distinction is critical because the ecosystem is expanding rapidly. Skills are executable artifacts, not just text instructions. They carry permissions and risks.

With 26.1% of agent skills containing vulnerabilities, the harness must include robust security vetting. You cannot blindly load third-party tools without understanding their impact on your environment.

The harness is the product. It defines what the agent can see, do, and verify. Without deliberate design, you are just guessing.

SkillzBench is building a free directory and MCP connector to help you verify these skills before you deploy them. We focus on security scanning and benchmarking to ensure your harness remains secure.

The old habits of copy-pasting prompts will not save you. The new skill is designing the environment where the agent operates.

Invest in the harness. Test your tools. Verify your skills. The agent will do the work, but you must build the safety net.

This is the reality of 2026: delegation is the norm, and harness design is the differentiator.

The Hidden Pitfalls: Vulnerable Skills, Supply-Chain Attacks, and Decision Fatigue

The most dangerous sentence in agent coding in 2026 is "it's just a markdown file." As Information Retrieval professor Jimmy Lin puts it, the markdown in a SKILL.md file is code, executed by a non-deterministic engine — and the numbers behind that framing are sobering.

A large-scale arXiv study of 31,132 agent skills found that 26.1% contain at least one vulnerability, spanning 14 distinct patterns across prompt injection, data exfiltration (13.3%), privilege escalation (11.8%), and supply-chain risks. Worse, 5.2% show high-severity patterns strongly suggesting malicious intent. Skills that bundle executable scripts are 2.12x more likely to be vulnerable than instruction-only skills (p<0.001).

The threat stopped being theoretical in January 2026. The ClawHavoc campaign planted 341 malicious skills — roughly 12% of the ClawHub registry — delivering the Atomic Stealer (AMOS) macOS infostealer, which rented for $500–1,000/month and targeted API keys, wallet keys, SSH credentials, and browser passwords. Snyk's Liran Tal called it "the first major supply-chain threat to AI agent ecosystems in and around the Skills spec, and it won't be the last."

The structural problem makes it worse. Skills inherit the agent's full permissions, ship with no cryptographic signing, and tools like OpenClaw run with full host access by default. The arXiv authors call for "capability-based permission systems and mandatory security vetting." Until those exist, teams should:

• Treat every SKILL.md as executable code, not documentation
• Prefer instruction-only skills over executable-script bundles (2.12x riskier)
• Pin skills to reviewed versions rather than floating "latest"
• Scan before enabling — SkillzBench is building commit-SHA pinning, security scanning, and sandboxed benchmarking into its free skills directory and MCP connector for exactly this reason

Security isn't the only bottleneck. Smartsheet research found that 80% of AI-generated content is edited before finalization — and decision fatigue degrades review quality as the day wears on. As Smartsheet CPTO Pratima Arora notes, "the hours haven't changed, but the density of work has." Smart teams now front-load judgment into requirements and guardrails, and back-load it into security checks, rather than relying on per-commit spot reviews.

Cost walls compound the strain. Per Turing College, 50% of learners on a Max 6× team plan hit model limits weekly — and Anthropic itself acknowledged in March 2026 that Claude Code users exhaust limits faster than expected. Agent coding works — but only with vetted skills, deliberate harness design, and restructured review.

The Solution: Treat Skills as Code and Build a Real Harness

The fix starts with a mental shift: a skill isn't a prompt, it's a program. As information retrieval professor Jimmy Lin puts it, "The markdown in a SKILL.md file is code" — just code executed by a non-deterministic engine instead of a compiler. That reframe changes everything about how you should treat skills you didn't write yourself.

If skills are code, then classic software discipline applies:

• Vet and scan every third-party skill before enabling it, the same way you'd audit a new npm dependency.
• Prefer instruction-only skills over bundles that ship executable scripts, which are 2.12x more likely to contain vulnerabilities.
• Pin skills to reviewed versions so an upstream change can't silently alter what your agent executes.
• Route human judgment to where it counts: requirements and guardrails upfront, security validation at the end — not per-commit spot checks that breed decision fatigue.

The urgency isn't hypothetical. A large-scale empirical study found 26.1% of agent skills contain at least one vulnerability, and January 2026's ClawHavoc campaign compromised roughly 12% of a skills registry with an infostealer targeting API keys and SSH credentials. Snyk's Liran Tal called it the first major supply-chain threat to the skills ecosystem — and predicted it won't be the last. This is exactly the gap SkillzBench is being built to close: pinning every skill to a commit SHA, security-scanning, and sandbox-benchmarking each one, all free, so you can see a skill's Lift before it ever touches your agent.

The same discipline applies to the harness around your coding agent. Because swapping the wrapper moves benchmark results as much as swapping model weights, harness design is where the real leverage sits — and it pays in tokens, not just quality. Techniques like path-scoped rules, trimming CLAUDE.md, and routing sub-agents to lower-power models (a practice Simon Willison advocates explicitly) can cut Claude Code costs by 77–91%. CLI commands average around 200 tokens versus 32,000–82,000 for equivalent MCP operations, so keeping routine work CLI-native matters too.

For TypeScript teams, there's a code-first path: Google's Agent Development Kit for TypeScript defines agent logic, tools, and orchestration directly in TypeScript, giving you version control, automated testing, CI/CD integration, and end-to-end type safety — the same rigor you'd apply to any production code. Agent behavior stops being an untestable blob of instructions and becomes reviewable, diffable, testable software.

Treat skills as code, harness the agent deliberately, and move your scarce human judgment to the edges of the loop. That's the difference between an agent that quietly drains your budget and one that compounds your team's output. If you want a head start, SkillzBench's free skills directory and MCP connector are being built to make vetted, benchmarked skills a default rather than a gamble — join the waitlist to follow along.

Your TypeScript Agent Setup: A Practical Checklist

A good agent setup is less about picking the right model and more about building the right harness. Benchmark data shows swapping the wrapper around a model moves results as much as swapping the model weights themselves, so deliberate configuration matters more than most teams assume.

Start with a CLI agent and scope its permissions tightly. Tools like Claude Code and Cursor CLI work on "delegation over suggestion" — agents run autonomously for hours, edit dozens of files, and execute shell commands. Grant write access only to the directories that need it, and define your allowed dependencies and guardrails before you delegate anything, not after. This front-loads the judgment that industry reporting shows is the real bottleneck: 80% of AI-generated content gets edited before finalization, and per-commit spot reviews lead to decision fatigue.

Next, vet every skill before you enable it. Treat a SKILL.md file as executable code, because that's effectively what it is — markdown instructions run by a non-deterministic engine with your agent's full permissions. The stakes are real: a large-scale study of 31,132 skills found 26.1% contain at least one vulnerability, and skills bundling executable scripts are 2.12x riskier than instruction-only ones. In January 2026, the ClawHavoc campaign compromised roughly 12% of a skills registry with macOS infostealers targeting API keys and SSH credentials. Vetting manually is slow, which is why we're building SkillzBench: a free directory that pins every skill to a commit SHA, runs security scans and license checks, and benchmarks each skill in a sandbox to publish its measured Lift. A free MCP connector will let you attach only the skills you've chosen to any agent.

Then replace per-commit human review with deterministic checks and sub-agent verification. Put linting, type checks, and tests in place so the agent gets atomic feedback via exit codes, and follow Simon Willison's advice to route lower-power models into sub-agents for routine tasks. Reserve human judgment for the gates that matter — requirements and guardrails upfront, security and dependability at the end.

Finally, monitor token costs. CLI commands average around 200 tokens, while equivalent heavy MCP operations can burn 32,000–82,000 tokens. Prefer CLI-native operations where feasible, trim context files, and route models deliberately — Claude Code techniques like these can cut costs 77–91%. Usage walls hit even top tiers, so budget before the invoice does.

• Scope agent permissions to specific directories and commands.
• Define allowed dependencies and guardrails before delegating work.
• Vet every third-party skill; prefer instruction-only over script bundles.
• Use deterministic checks and sub-agent verification instead of per-commit review.
• Track token spend per operation and route cheap models to routine tasks.

Want to skip the manual vetting? Browse and test agent skills free on SkillzBench — join the waitlist to get security-scanned, benchmarked skills and a free MCP connector the moment we launch.

Where to Go From Here: Vetting Skills You Can Actually Trust

Every skill you install inherits your agent's full permissions, and there's still no cryptographic signing standard to tell the safe ones from the dangerous ones. That combination makes independent verification less of a nice-to-have and more of essential infrastructure for anyone coding with agents in 2026.

The numbers back this up. A large-scale empirical study found that 26.1% of agent skills carry at least one vulnerability, with data exfiltration present in 13.3% and privilege escalation in 11.8%. Skills that bundle executable scripts are 2.12x more likely to be vulnerable than instruction-only packages. And January 2026 delivered the first major supply-chain attack on a skills registry, when ClawHavoc compromised roughly 12% of the ClawHub registry with macOS infostealers targeting API keys, SSH credentials, and browser passwords.

Manual vetting doesn't scale against that threat. The study's authors call for "an urgent need for capability-based permission systems and mandatory security vetting," and Snyk's Liran Tal warns that ClawHavoc "won't be the last" of its kind. Reading every SKILL.md by hand, pinning versions, and re-checking upstream changes is a full-time job nobody has.

That's the gap SkillzBench is being built to close. It's a free, independent directory of agent skills for Claude Code, Codex, Cursor, Gemini CLI, and chat-app agents, designed around a simple pipeline:

• Discover and dedupe — continuously crawl skills from GitHub so you're not vetting the same package twice.
• Verify — pin every version to a commit SHA, then license-check, security-scan, and quality-judge it.
• Benchmark — test each skill in a sandbox with the same model, with and without the skill, and publish the Lift in percentage points.
• Equip — one free MCP server with per-agent loadouts, so your agent only sees the skills and tools you toggle on.
• Stay current — track upstream changes, re-scan, re-benchmark, and notify you when something shifts.

Two design choices matter most. First, Lift is always published separately from trust scores — a skill can benchmark brilliantly and still carry a poor trust rating, and the two numbers never blend. Trust scores (0-100) draw only on security, quality, license, maintenance, and community signals; money never touches them. Second, the whole thing stays free: the directory, the MCP connector, the benchmarks, and the alerts. Revenue comes from ads around blog articles, never from users.

SkillzBench is pre-launch and actively under construction, so treat this as a heads-up rather than a product tour. If you want early access to verified, benchmarked skills — and an agent that only ever sees what you've chosen — the waitlist is open at skillzbench.com. Your future self, reviewing code at midnight, will thank you.