The report
SkillLifeBench evaluates how tool-using agents react when skills are installed, updated or retired during a workflow. One finding concerned agents that selected a patched skill in their plan yet continued executing an older callable handle already loaded in the environment. The model's recorded choice and the runtime's actual behavior diverged.
The experiment does not demonstrate a live attacker exploiting every agent that uses skills. Its value is narrower and more concrete: version-selection accuracy does not prove version-execution integrity. A successful update response can coexist with a stale function reference, old process state or cached tool manifest. The benchmark paper and case record track the distinction between intended selection and observed execution.
A regression should record the digest and version of the tool that actually executed, invalidate old handles when a skill is replaced and verify that later actions cannot call retired code. An update notification that only changes the agent's list of available skills does not necessarily revoke previously loaded executable authority.