How to Use Frontier AI Models: A Practical Walkthrough

The Real Problem: Frontier Models Are Powerful but Jagged — and Skills Are Risky

Frontier AI agents can now complete multi-hour expert tasks, yet their reliability varies wildly across domains. This "jagged" capability profile creates a unique operational risk that standard software testing fails to address.

METR’s independent evaluations reveal that while GPT-5’s time horizon extends to approximately two hours and seventeen minutes, success rates are uneven. On tasks requiring ninety minutes to three hours of human effort, the model succeeded 100% of the time on only one-third of tasks. It failed completely on another third. This research confirms that capability is not uniform, meaning an agent that excels at code generation might struggle with nuanced legal reasoning.

The danger intensifies when you extend these models using agent skills. Skills inherit full permissions, including shell access and credential management. Snyk’s audit of 3,984 skills found that 13.4% contain at least one critical security issue. Furthermore, 36.82% carry at least one flaw at any severity level. The study notes that publishing barriers are minimal, often requiring only a basic file and a new GitHub account.

Bolting unvetted skills onto a frontier model is the core risk readers face today. Unlike traditional software, skills can execute persistent actions and interact with sensitive data without immediate human oversight. The ecosystem currently lacks robust, default security reviews comparable to established package managers.

Key risks include:

• Credential exposure through hardcoded secrets or environment variable access
• Prompt injection attacks that manipulate agent behavior
• Unverifiable dependencies that introduce external malware
• Persistent memory retention of sensitive data across sessions

Organizations must treat skill integration with the same rigor as infrastructure deployment. MIT Sloan research indicates that 80% of agent implementation effort involves data engineering and governance, not just model tuning. This analysis highlights that stakeholder alignment and workflow integration dominate the workload.

SkillzBench is building a free directory and MCP tool to address this gap. The platform aims to verify skills by pinning versions to commit SHAs, performing security scans, and benchmarking performance in sandboxes. By separating trust scores from commercial incentives, the goal is to provide clear, independent data on which skills actually help and which pose a threat.

You cannot assume a skill is safe because it is popular. With daily submissions growing tenfold in weeks, the supply chain risk mirrors early npm vulnerabilities but with higher default privileges. Security frameworks like OWASP’s Agentic Skills Top 10 are now documenting these specific risks.

Adopting frontier models requires a shift from "install and hope" to "verify and benchmark." The most powerful models are only as safe as the skills you attach to them.

Join the waitlist to access verified skills and benchmark data. Skills, proven.

The Architecture That Works: Systems of Models, Not One Model to Rule Them All

The biggest mistake teams make with frontier AI models is treating them like a single hammer for every nail. The better pattern, according to NVIDIA's guidance on frontier models, is a systems-of-models architecture where a router classifies each task and automatically selects the best-suited model for the job.

The division of labor is straightforward. Lightweight specialized models handle simple, domain-specific queries and requests involving private data. Frontier models — the most advanced AI models available at a given moment — take on complex reasoning tasks like trend analysis, code generation, and compliance work. NVIDIA notes that effective AI systems combine multiple frontier and specialized models to optimize accuracy, latency, and cost, rather than forcing one model to do everything.

This routing pattern matters because capability is uneven. METR's time-horizon research found that GPT-5's 50% reliability horizon was roughly 2 hours 17 minutes on human-expert tasks — but capabilities are "jagged," varying by orders of magnitude across economically valuable domains. A frontier model that crushes a two-hour coding task can still fail a task of similar duration in another domain. Routing tasks to the right model, not just the biggest one, is how you manage that variance.

The second half of the architecture equation is where most teams get it wrong. Neo4j's AI Field CTO Jesús Barrasa observed in production case studies that "the issue is rarely the model itself — it's whether the agent has access to the right context at the right time." The most common production failures aren't weak-model failures at all:

• Hallucinations caused by incomplete or outdated domain knowledge
• Lost state in long-running, multi-step workflows
• Brittle prompts that break under slight variation
• Tool misuse — agents calling the wrong tools or calling them incorrectly

MIT Sloan's research reinforces this: in one clinical AI agent case study, 80% of the implementation work was data engineering, stakeholder alignment, governance, and workflow integration — not prompting or fine-tuning. The successful teams in Neo4j's case studies didn't endlessly tune prompts; they engineered context deliberately, defined guardrails early, and compared agent-driven workflows against baseline systems.

For skill packs specifically, this architecture translates into a practical principle: skills should declare their context requirements explicitly, and your agent stack should route tasks the way NVIDIA describes — specialized models for grounded, private-data work, frontier models for reasoning over it. When you're assembling skills from the broader ecosystem, vetting matters too, since a Snyk audit found 36.82% of scanned skills carry at least one security flaw. That's the gap SkillzBench is building for: a free directory where every skill is version-pinned, security-scanned, and benchmarked with its Lift published in percentage points, plus a free MCP server so your agent only sees the skills you deliberately chose for its loadout.

The architecture that works, then, is a system: a router, deliberately engineered context, guardrails, and vetted skills — with the frontier model reserved for the tasks that genuinely need it.

Where the Effort Actually Goes: Context, Data, and Governance — Not Prompting

Anyone who has spent a weekend perfecting a prompt knows the seductive feeling that the hard part of AI is the words. The evidence says otherwise. In a clinical AI agent case study published by MIT Sloan, 80% of implementation work went to data engineering, stakeholder alignment, governance, and workflow integration — not prompt engineering or fine-tuning.

That finding reshapes how you should budget a frontier-model project. The model is the part you rent; everything around it — clean data, structured formats, validation frameworks, API management — is the part you build. MIT Sloan's Kate Kellogg puts the governance point bluntly: as agency shifts from humans to machines, "there's a real increase in the importance of governance and infrastructure to control and support agentic systems."

There's also a caution on the economics. Kellogg's colleague's widely cited warning applies to any agent rollout: reclaimed time is not the same as labor-cost savings. If an agent reclaims 20% of someone's time, that time only becomes value if the organization redesigns the role around it. Budget for that redesign, or the ROI never materializes.

The most instructive counterexample to "maximum autonomy" thinking comes from retail. Walmart Global Tech's AdaptJobRec system achieved a 53.3% reduction in response latency by applying agentic reasoning selectively — reasoning hard only where it pays off, and falling back to simpler paths elsewhere. As Neo4j's case analysis concludes, effective agent systems often require orchestration and restraint, not maximum autonomy.

So where should your effort actually go?

• Context and data quality — reliability failures typically stem from incomplete context, lost state, and brittle prompts, not weak models.
• Governance and guardrails — defined early, before the agent touches production workflows or credentials.
• Baseline comparison — measure the agent-driven workflow against the existing system, and iterate on context rather than endlessly tuning prompts.
• Selective autonomy — match how much reasoning and freedom the agent gets to the cost of getting the task wrong.

This has direct implications for how you assemble agent skill packs. The skills you bolt onto a frontier model are part of its context and governance surface — and with Snyk finding 36.82% of scanned skills carrying at least one security flaw, vetting them is a governance task, not an afterthought. SkillzBench is being built around exactly this: verified, version-pinned skills with benchmarked Lift, so the effort goes into the system, not the guesswork.

Step-by-Step: Building a Vetted Skill Pack for Your Frontier Agent

Building a skill pack for a frontier agent isn't a prompting exercise — it's a supply chain decision. A Snyk audit of nearly 4,000 agent skills found that 13.4% contain at least one critical security issue and 36.82% carry a flaw at any severity, so the four steps below treat every skill as untrusted until proven otherwise.

Step 1: Scope tasks realistically. METR's time-horizon research shows frontier agents can complete multi-hour expert tasks, but capability is "jagged" — success rates swing wildly across domains, with GPT-5 fully succeeding on about a third of 90-minute-to-3-hour tasks and failing entirely on another third. Pick skill-pack tasks that sit inside a measured capability zone, not a marketing claim. Microsoft's Work Trend Index adds the management layer: the right "human-agent ratio" is task-specific, meaning oversight intensity should be set per workflow, not per agent.

Step 2: Vet before you install. Skills inherit the full permissions of the agent they extend — shell access, file read/write, credentials, and persistent memory — and publishing one takes little more than a SKILL.md file and a new GitHub account. Before any skill enters your pack:

• Pin the exact version to a commit SHA so nothing changes under you silently
• Security-scan the package for prompt injection, suspicious downloads, and hardcoded secrets
• Check the license and maintenance history
• Review it against the OWASP Agentic Skills Top 10, the first security framework purpose-built for agent skills

Step 3: Benchmark against a baseline. Teams that succeed with agents "compare agent-driven workflows against baseline systems" rather than endlessly tuning prompts, as Neo4j's field research puts it. Run the same task with the same model, with and without the skill, and record the difference in success rate. Keep doing this after deployment — skills update, models update, and yesterday's lift can become today's regression.

Step 4: Wire skills per-agent. Each agent should only see the skills and tools it actually needs. This follows the principle that effective agent systems "require orchestration and restraint, not maximum autonomy" — and it shrinks the blast radius if any one skill turns out to be compromised.

Doing all four steps by hand is real work, which is why SkillzBench is building a free platform around them: continuously crawled and deduplicated skills, commit-SHA pinning with security scanning and license checks, sandboxed benchmarks that publish each skill's lift in percentage points, and a free MCP connector with per-agent loadouts so you toggle exactly what each agent can see. It's pre-launch — join the waitlist and you'll be first in line when vetted skill packs are one click away.

If skills are proven before they're installed, agents earn trust the same way any hire does: by measured performance, not promises.

Keeping It Current: Monitoring, Re-Scanning, and Scaling What Works

Here's the uncomfortable math: daily agent skill submissions grew from under 50 to over 500 in a matter of weeks — a 10x surge — while researchers confirmed 76 malicious payloads in the wild, eight of which were still publicly available at publication time. A skill pack you vetted last month may not be the skill pack running today.

That's why maintenance isn't optional. Snyk's audit of nearly 4,000 skills found that 13.4% contain at least one critical security issue and 36.82% carry at least one flaw at any severity. Skills inherit the full permissions of the agent they extend — shell access, file system read/write, credentials, persistent memory — so an upstream change to a "trusted" skill can quietly turn a helpful package into an exfiltration tool.

Treat your skill supply chain like any other dependency and put it on a schedule:

• Track upstream changes. Pin every skill to a specific commit SHA so you know exactly what changed and when, rather than pulling whatever is latest.
• Re-scan on updates. New versions can introduce new code paths, downloads, or prompt injection — rescan anything that changes before it touches a production agent.
• Re-benchmark periodically. Model updates change how skills perform, so re-test with and without each skill rather than assuming last quarter's results still hold.
• Set alerts for security signals. Detection rates for things like suspicious downloads and hardcoded secrets remain low on open repositories, so passive monitoring isn't enough.

This is the "stay current" problem SkillzBench is building for: continuously tracking upstream changes, re-scanning, re-benchmarking, and notifying users when a skill they've equipped changes in a way that matters. It's also why every skill gets pinned to a commit and re-validated rather than trusted once at install time.

The scale argument is straightforward. In Microsoft's Work Trend Index survey of 31,000 workers across 31 countries, 81% of leaders expect agents to be moderately or extensively integrated into their AI strategy within 12–18 months, and 46% say their companies already use agents to fully automate workflows or processes. As agent-driven workflows multiply, so does the number of skills each one depends on — and manual, one-time vetting doesn't survive that growth.

MIT Sloan's research adds a useful caution: reclaimed time doesn't automatically equal labor-cost savings, and governance grows more important as agency moves from humans to machines. Monitoring, re-scanning, and re-benchmarking are part of that governance load — an operational discipline, not a one-time setup. Teams that treat it that way scale what works; teams that don't find out the hard way what changed upstream.