What are AI agent skills, and how do they work?

What an agent skill is, how an agent decides when to use one, how skills differ from prompts and tools, and why vetting them matters.

The basics

A newsroom wants every AI-drafted story to follow its house rules: no dashes, a fixed caption format, tags from an approved list. Without skills, someone pastes those rules into every conversation and hopes nothing gets dropped. With a skill, the rules live in one file that the agent picks up by itself whenever the job is a news story.

An AI agent is a system in which a language model decides its own next steps and uses tools in a loop to reach a goal. A skill is a package of know-how the agent can pull in for one kind of task. Under the open Agent Skills standard, published at agentskills.io, a skill is a folder that must contain a file named SKILL.md. That file opens with a short header giving the skill a name and a description, followed by the instructions themselves, written in Markdown, a plain text format that uses simple symbols for headings and lists. The folder can also hold scripts the agent may run, reference documents and templates.

Think of a pilot's checklists. A pilot does not read every checklist before take-off. They know which checklists exist and what each is for, and they pull out the engine fire checklist only when an engine catches fire. Skills give an agent the same arrangement: a short index it always carries, and detailed procedures it opens only when needed.

The format was developed by Anthropic for its Claude products and then released as an open standard, in December 2025, so that other companies could adopt it. Several have. Google, for example, began replacing Gems, the custom assistants in its Gemini app, with skills in October 2026, starting with its Workspace office apps on 5 October and the Gemini app on 13 October.

How it works

The standard describes three stages, a design it calls progressive disclosure.

1. Discovery. When the agent starts up, it loads only the name and description of each installed skill. That is enough to know what is available without filling up its memory.

2. Activation. When a request matches a skill's description, the agent reads that skill's full instructions.

3. Execution. The agent follows the instructions, running any bundled scripts or opening reference files only if the task calls for them.

The reason for this staging is the context window: the limited amount of text a model can consider at once. Loading every instruction for every skill up front would crowd out the actual task. Staging lets an agent keep dozens of skills on hand while paying for only the ones in use.

This puts a lot of weight on the description. It is the only part of a skill the agent sees before deciding whether to use it, so a vague description means a skill that never triggers, or triggers at the wrong moment.

Skills are easy to confuse with three neighbouring ideas.

• A prompt is a one-off instruction typed into a single conversation. A skill is saved, reusable and loads itself when relevant.

• A tool is a function the agent can call to do something, such as search the web or send an email. A skill is knowledge about how to do a job well, which may include when and how to use certain tools.

• MCP (Model Context Protocol) is a standard for connecting agents to outside systems such as databases or business software. MCP gives an agent access; a skill teaches it what to do with that access. A connector might let an agent post to a publishing system, while a skill spells out how a story must be formatted before it goes live.

Why it matters

Consistency. A team writes its process down once, and every task that matches gets the same treatment. Changing the process means editing one file rather than retraining people or rewriting prompts.

Portability. Because skills follow a published format, a skill built for one agent can in principle run in another tool that supports the standard. In practice, products differ in what permissions they grant and which optional features they support, so a skill should be tested wherever it will be used.

Security. A skill runs with whatever access the agent already has, which can include files, passwords and the ability to run commands. That makes skills a new kind of software supply chain risk, in the same family as installing a browser extension or a code library from a stranger. A 2026 study by researchers including Yi Liu examined 98,380 skills from community sharing sites and confirmed 157 as malicious. It sorted them into two groups: data thieves, which try to steal credentials such as passwords and access keys, and agent hijackers, which plant instructions that steer the agent into doing the attacker's bidding. A single actor was behind just over half of the confirmed malicious skills. The Open Worldwide Application Security Project (OWASP), a nonprofit that publishes widely used security guidance, has drafted a list of the ten biggest risks for agent skills, with malicious skills and supply chain compromise ranked as critical.

Common misconceptions

A skill is just a saved prompt.

Partly. A skill does contain instructions, but it loads itself when a task matches, it can bundle scripts and files, and an agent can draw on several skills in the same task.

Skills make the model smarter.

A skill does not change the model's weights, the numbers it learned during training. It shapes behaviour by putting the right instructions in front of the model at the right time. It cannot give an agent access to anything its tools and permissions do not already allow.

Skills and MCP are competing standards.

They solve different problems and are often used together: one connects, the other instructs.

A skill is harmless because it is only text.

For an agent, text is instruction. A malicious paragraph in SKILL.md can be as dangerous as malicious code. Install skills only from sources you trust, read them before use and limit what the agent is allowed to touch.

More skills means a more capable agent.

Every installed skill adds its description to the agent's working memory, and overlapping skills can give conflicting directions. A small set of well-described skills tends to behave more predictably than a large, loosely curated one.

What's next

As of 31 October 2026, four questions shape where skills go.

• Governance. The standard is open to outside contributions, which helps adoption but raises the risk of incompatible versions.

• Vetting. Sharing sites are adding malware scanning, but signing skills and proving where they came from is still at an early stage.

• Company control. Businesses need ways to list which skills their agents use, approve new ones and roll back bad updates.

• Self-written skills. Some agent products let the agent draft or revise its own skills, which raises the question of who reviews those changes.