AI agent skills: procedures loaded on demand

On 16 October 2025, US-based Anthropic introduced “Agent Skills” for its Claude assistant: folders of instructions, scripts and resources that the agent loads only when a task calls for them. On 18 December, the company published the format as an open standard. As of 29 October 2026, the standard’s website, agentskills.io, lists more than 40 compatible products, including OpenAI’s ChatGPT and Codex, GitHub Copilot, Google’s Gemini CLI, Cursor and Vibe, the tool from France’s Mistral AI. The word “skill” is now everywhere in AI tooling.

Behind the word lies a simple idea: a skill is a written procedure that the agent reads at the moment it needs it, not a new piece of software. That is what makes it useful in business, and risky when installed without being read.

What to remember (beginner level)

• The definition (United States · Anthropic): a skill is a folder containing at least one SKILL.md file, with a name, a description and instructions, and sometimes scripts, templates or documentation. Format introduced on 16 October 2025.
• The principle (international · Agent Skills): at start-up, the agent reads only the name and description of each skill; it opens the full instructions when the task matches, then any supporting files as needed.
• The open standard (United States · Anthropic): published on 18 December 2025, with central management for administrators on the Team and Enterprise plans and a directory of partner-built skills.
• Other vendors (international · Agent Skills): OpenAI, GitHub, Google, Cursor, JetBrains, Databricks and Snowflake are among the products listed as compatible. The same skill can therefore work across several tools.
• Business uses (United States · Anthropic): ready-made skills for Word, Excel, PowerPoint and PDF, and suggested bundles by role: sales operations, code review, incident response, financial reporting, audit preparation.

Do not confuse (intermediate level)

• A prompt is an instruction given in the conversation: it disappears with it. A skill is reusable. If you keep retyping the same instruction, it is a candidate.
• A tool is an action the agent can perform: read a file, run a command, search the web. The skill says when and how to use it.
• An MCP server (Model Context Protocol) connects the agent to external data and services. Anthropic sums up the difference: MCP provides access to the data, the skill teaches what to do with it.
• A subagent is a separate assistant, with its own context window and its own permissions, that returns a result to the main agent. It can use skills itself.
• A plugin is a distribution package: in Claude Code, it can bundle skills, subagents, automations (hooks) and MCP servers.

The real issue: load little, at the right time (expert level)

The format’s strength lies in progressive loading. According to Anthropic’s documentation, each skill takes about 100 tokens at rest (its name and description), under 5,000 tokens once triggered, and nothing for its supporting files until they are read. A script’s code never enters the context: only its output does. Dozens of skills can therefore be installed without overloading the agent.

This economy has a downside: it is the description, not the user, that decides when a skill activates. An overly broad description “steals” triggers from another skill, and too many active skills degrade selection. Anthropic’s API caps a request at 20 skills. Settings exist: in Claude Code, disable-model-invocation: true restricts a skill to manual invocation, which the documentation recommends for actions with side effects, such as a deployment.

Three points of vigilance

1. A skill can run code. Its scripts run with the environment’s permissions. In Claude Code, they have the same network access as any other program on the machine. The documentation asks users to review the permissions declared by a repository’s skills before running the agent there.

2. Public marketplaces are not vetted. On 5 February 2026, a study (United States · Snyk) analysed 3,984 skills published on ClawHub and skills.sh: 13.4% had at least one critical issue, and 76 contained a confirmed malicious payload, designed notably to steal credentials or exfiltrate data. The Agentic Skills Top 10 project (international · OWASP), still in incubation, ranks malicious skills first among its ten risks; its version 1.0 is expected by the end of 2026.

3. Data can leave. A skill that reads sensitive data and then calls an external address is enough for a leak. On the compliance side, Anthropic states that its skills are not covered by zero data retention arrangements: their definitions and execution data follow its standard retention policy. This belongs in your record of processing activities.

What your skills policy should cover

1. A register: for each skill, its purpose, owner, version, dependencies (MCP servers, packages, external services) and the date of its last evaluation.
2. Separation of duties: the author of a skill is never its reviewer. The review covers every file: instructions, scripts, addresses called, secrets written in plain text.
3. A list of authorised sources: internal skills or skills from identified vendors; any third-party skill goes through a full review before installation.
4. Pinned versions in production: with no version specified, Anthropic’s API uses the latest one. A checksum verified at deployment and a fallback version stop an update from changing behaviour unchecked.
5. Tests before go-live: three to five representative queries per skill, where it should trigger and where it should not, then a run alongside the other installed skills.
6. Technical safeguards: manual invocation for skills that send, publish or deploy, automated scanning where the plan offers it, a log of the skills used.

A skill is installed like software and governed like a procedure.

The question to ask on Monday morning

To your CIO and CISO: “How many skills are running today on our teams’ machines and in their AI tools, who wrote them, and who reviewed them?”