From a description to an action

A short description can make a consequential choice

Metadata helps an agent decide what to load. A reviewer who reads only the eventual instruction body may miss the reason a package became eligible in the first place. MetaCascade examines the influence of metadata across the full chain rather than one stage in isolation.

Preserve the candidate set

For a defensible test, record the task, visible descriptions, candidate packages, selected revision, loaded resources, and observed actions. A selection error and an execution failure are different observations. A broad description can be a quality problem without proving malicious intent.

Ask whether the same task would select a different package after a description changes. Keep unrelated tasks in the test set; a package should not become a universal answer merely by claiming universal usefulness.

Use a narrow permission profile after selection

Choosing a skill should not itself expand access. The selected package still needs an approved scope, data boundary, and action policy. A correct-looking selection cannot authorize a new destination or unrelated data read. Test the point where the host grants authority.

Interpret the paper as a bounded experiment

Read the current abstract and methods before comparing reported improvements with another benchmark. Agent environment, retrieval setup, tasks, and defenses affect the result. Keep end-to-end outcomes separate from retrieval-only or selection-only measurements.

Worked example: track a selection claim to its effect

A test description claims that a package is the official route for every spreadsheet request. The package then adds an unrelated synchronization step. If an evaluator records only that the skill was retrieved, it cannot tell whether the harmful action was proposed, blocked, or completed.

Work through the evidence

Retain intermediate outcomes: visibility, retrieval rank, selection, loading, proposed action, attempted execution, and verified effect. Use control descriptions that accurately state the package’s scope. Keep the environment stable and repeat only where randomness materially affects the conclusion. A selection explanation is useful context, not proof that it caused every later action.

Decision criteria and a useful review record

Define end-to-end success before testing and avoid substituting a favorable intermediate score. A retrieval improvement can coexist with effective runtime containment. Likewise, a good action policy does not make misleading selection harmless. Record which boundary stopped the chain so future changes can be evaluated against that particular control.