Skill frameworks for AI coding agents are exploding in popularity. As of July 2026, Superpowers has roughly 256,000 GitHub stars, Matt Pocock's skills have roughly 176,000, and Agent Skills has roughly 79,000. All three promise to make AI agents write better code by feeding them structured Markdown instructions.
But there is a fundamental problem that deserves more attention than it gets: the behavioral control layer in these frameworks is plain English written in Markdown files (what literary types call "prose"). Not code. Not configuration. Not compiled rules. Just natural-language sentences that the agent reads and interprets. Ambiguous, probabilistically interpreted, context-sensitive sentences. And the industry is calling that engineering.
This article is about why that matters, what the real failure modes are, and what actual guardrails would look like.
What Is the Control Plane?
In traditional software, the control plane is the layer that governs how a system behaves: configuration files, type systems, access control policies, deployment pipelines, CI/CD gates. These mechanisms share a common property. They are deterministic. A type checker either passes or fails. A CI pipeline either succeeds or errors. The behavior is reproducible and independently verifiable.
AI agent frameworks introduce a new kind of control plane. Instead of configuration files or type systems, they use prose instructions: SKILL.md files, system prompts, AGENTS.md files, CLAUDE.md files. The agent reads these instructions and decides what to do.
This is not a minor implementation detail. It is a fundamental shift in how behavioral control works. And it has consequences that the framework creators have not fully addressed.
The Core Problem: Prose Is Probabilistic
When you write an instruction like You MUST write tests before implementation in a skill file (for example), the agent does not execute that instruction the way a compiler executes a type annotation. It interprets the instruction probabilistically. The same instruction might produce different behavior on different runs, in different contexts, or after the agent has read additional context that reframes its understanding of what "tests" means or what "implementation" means.
This is not speculation. Anthropic's own SWE-bench documentation acknowledges that agent performance "can vary significantly based on this scaffolding, even when using the same underlying AI model." The scaffolding is the prose. The variation is the probabilistic interpretation.
Three specific failure modes follow from this.
1. Semantic Drift
Over a long-running session, the agent accumulates context. Earlier instructions get pushed further back. New context reframes old instructions. The agent's interpretation of "write tests first" in step 1 might differ from its interpretation in step 47, not because the instruction changed, but because the surrounding context changed.
No current framework addresses this at the instruction level. The instruction is prose. There is no mechanism that detects when the agent's interpretation has drifted from the original intent.
2. Goal Reinterpretation
Agents expand scope. You ask for a bug fix. The agent decides the surrounding code also needs refactoring. You ask for a new endpoint. The agent decides the existing API contract should be updated. These are not hallucinations in the traditional sense. They are rational reinterpretations of an ambiguous goal, executed confidently without confirmation.
Anti-rationalization tables (used in Agent Skills) attempt to address this by pre-rebutting common excuses. But the rebuttals are also prose, interpreted by the same probabilistic system. You have not removed the drift. You have added more prose to argue with it.
3. Correlated Verifier Failure
This is the sharpest problem, and the hardest to dismiss.
Most agent frameworks include a verification step. The agent runs tests, reviews code, or checks output against criteria. But if the verification step is also an LLM reading prose instructions, your verifier is subject to the same drift as the actor. You have not built a guardrail. You have built two drifters checking each other.
"Correlated" here means the actor and verifier share the same failure modes: the same model, the same prompt context, or the same misinterpretation of the goal. When that happens, they will agree on a wrong answer. The verifier fails in the same direction as the actor, so it never catches the error. This is a known problem in LLM-as-judge evaluation, which has documented reliability issues when the judge and the judged share biases.
Does This Mean Prose Control Is Useless?
No. And this is where it is important to reject both extremes.
Deterministic enforcement is a purity test that traditional engineering does not meet either. Code review is a human-interpreted process. QA testing is fallible. CI pipelines catch what they are configured to catch, not what they should catch. Feature flags can be misconfigured. None of these are formally verified. We use them because they shift the probability of catching errors in the right direction, not because they provide mathematical guarantees.
Skill frameworks do the same thing, at a different layer. If a TDD skill shifts the probability of the agent writing tests from low to high, that is a meaningful improvement. It is not a guarantee. But neither is human code review compliance. The question is whether the probability shift justifies the token overhead, and that question has not been answered empirically.
The honest claim is narrower: prose-based control is useful but insufficient for production systems. It shifts probability distributions in useful directions. It does not provide guarantees.
What Anthropic Actually Recommends
Anthropic's own
SOCIAL SHARE CARD GENERATOR