A Glossary of the Agent Ecosystem (Skills, MCP, A2A, Evals)

The Jargon Wall: Why the Agent Ecosystem Feels Unreadable

You can't scroll through a tech feed today without tripping over "AI agents," yet the moment someone asks which agents, which protocols, and which skills, the room goes quiet. The ecosystem has exploded — Anthropic's Model Context Protocol alone has racked up 97 million downloads, and the skills ecosystem has grown past 100,000 skills — but the vocabulary lives scattered across vendor blogs, GitHub READMEs, and dense protocol specs. There is no plain-English map.

That wouldn't matter if the terms were just labels. They're not — they describe four distinct architectural layers, and confusing them is how teams end up with agents that can't connect, can't collaborate, or worse, can't be trusted. Here is the framing this glossary uses throughout:

• Skills — what an agent knows how to do: instruction packages (SKILL.md files) that load expert-level capability on demand
• MCP — how an agent reaches tools and data outside itself
• A2A — how agents talk to other agents
• Evals — how you measure whether any of it actually works

The boundaries are cleaner than the jargon suggests. As one ecosystem map puts it: inter-agent communication is A2A; tool invocation is MCP. Google introduced A2A explicitly as a complement to MCP, not a competitor, with 50+ launch partners in April 2025. Skills and Evals fill the remaining gaps — capability and measurement.

But there is a reason this glossary is urgent rather than academic. A large-scale academic study analyzing over 31,000 skills found that 26.1% carry at least one vulnerability, spanning prompt injection, data exfiltration, privilege escalation, and supply-chain risks. The Cloud Security Alliance goes further, warning that "the SKILL.md file is the new package.json. And it's already compromised."

Three lines of natural language in a skill file can instruct an agent to read your SSH keys and POST them to an external endpoint — no code signature to detect. If you're adopting agents at work, you're already exposed to this attack surface whether or not you know the terminology. SkillzBench is being built precisely to close that gap — a free, independent directory that verifies, benchmarks, and connects skills via a free MCP tool — so the definitions below come with the security context the spec documents leave out.

The Four Building Blocks, Decoded: Skills, MCP, A2A and Evals

Behind every working AI agent sits a surprisingly small stack of building blocks. Four terms dominate the conversation — Skills, MCP, A2A and Evals — and understanding where one ends and the next begins is the difference between a capable agent and a chaotic one.

Agent Skills are instruction packages: a SKILL.md file containing YAML metadata and Markdown guidance, sometimes bundled with scripts and resources. They work like giving someone a recipe card instead of making them memorize an entire cookbook — instructions, not code. Agents load them through "progressive disclosure," so thousands of skills can sit ready without exhausting the context window. Anthropic released the specification as an open standard in October 2025, and Claude Code, Codex CLI and Gemini CLI now all support it. That portability is a feature — and a risk: academic research analyzing 31,132 deduplicated skills found 26.1% contain at least one vulnerability, with skills bundling executable scripts 2.12× more likely to be dangerous. That's the gap SkillzBench is being built to close, with independent verification, sandbox benchmarking and a free skills directory.

MCP (Model Context Protocol) is the agent-to-tool layer — how an agent actually calls external systems. Open-sourced by Anthropic in November 2024, it has reached 97 million downloads and effectively won its layer. Its boundary is clean: MCP handles tool invocation, nothing more.

A2A (Agent2Agent) fills the layer MCP explicitly excludes: agents talking to other agents. Google launched it in April 2025 with 50+ partners, framing it as a protocol that complements MCP rather than competes with it. The rule of thumb: MCP = tools, A2A = agents.

Evals are the measurement discipline that proves any of this works. OpenAI's agent-building guidance is blunt: set up evals to establish a performance baseline before deploying, then optimize for cost and latency once accuracy targets are met. Without a baseline, you can't tell whether a skill, tool or second agent actually helped.

The clean summary:

• Skills — on-demand expertise, loaded as instructions when needed
• MCP — the agent-to-tool connection layer
• A2A — agent-to-agent communication and delegation
• Evals — the proof layer, measuring whether any of it works

Each block has one job. Agents built that way — with verified skills, bounded tools and measured results — are the ones that hold up in production.

The Fine Print: The Security Reality Behind 'Just Instructions'

Skills are sold as harmless recipe cards, yet independent audits keep finding malware inside the kitchen. That gap between marketing language and measured reality is where the entire trust problem lives.

The pitch is simple: a skill is "instructions, not code," like handing someone a recipe card instead of making them memorize a cookbook. That framing is technically accurate and dangerously incomplete, because the same packages can bundle executable scripts alongside the prose.

The numbers across independent studies land in a range no one should ignore:

• A large-scale academic analysis found 26.1% of skills carry at least one vulnerability across prompt injection, data exfiltration, privilege escalation, and supply-chain patterns.
• A separate audit put the figure at 36.82% of skills containing security flaws, with 280+ documented leaking API keys and PII.
• NSFOCUS's sample of roughly 700 skills found 21.1% with serious risks, led by code execution.

Different samples and methods explain the spread; the honest takeaway is a 21–37% band. The paradox resolves cleanly: skills bundling executable scripts are 2.12x more likely to be vulnerable, so the risk concentrates exactly where "just instructions" stops being true. Three lines of natural language in a SKILL.md file can instruct an agent to read a private key and POST it outward, with no eval() and no detectable signature. Cato CTRL documented the endpoint in December 2025, when a benign-looking "GIF Creator" skill silently delivered MedusaLocker ransomware. OWASP formalized the Agentic Skills Top 10 in March 2026, and the study authors call for mandatory vetting before the vector is further exploited.

Trustworthy distribution does exist. Trail of Bits runs a curated, licensed skills repository — roughly 40+ skills across nine categories, with documented real findings rather than vague assurances. That is the contrast that matters: unvetted marketplace aggregation versus versioned, reviewed, attributable packages. SkillzBench is building toward that second model, with verification, sandboxed benchmarking, and a free MCP connector so agents only see the skills you deliberately choose. The waitlist is open.

How to Vet and Equip Agents Without Becoming a Security Team

The numbers behind agent skills should make anyone pause before clicking "install." One large-scale academic analysis found 26.1% of analyzed skills contain at least one vulnerability, and a separate audit cited by the Cloud Security Alliance put the figure at 36.82%, with 280+ skills documented leaking API keys and PII. Download counts tell you nothing about any of this — at one point, 5 of the top 7 most-downloaded skills on a major registry were confirmed malware.

So what does sensible vetting look like without hiring a security team? Start with four checks before loading any skill:

• Version pinning: confirm the skill is pinned to a specific commit, not just a floating "latest" tag, so upstream changes can't silently alter what your agent runs.
• Licensing: verify the license actually permits your intended use — well-run collections like Trail of Bits' skills repository publish this openly.
• Security scanning: look for evidence of scanning for prompt injection, data exfiltration, and supply-chain patterns. Skills with executable scripts are 2.12× more likely to be vulnerable, so scripts deserve extra scrutiny.
• Measured performance: ask whether the skill actually improves results, not just whether it exists.

That last check is where benchmarking comes in. The practical method mirrors what OpenAI recommends for agents generally: establish a baseline first. Test your agent on a representative task without the skill, then again with it — same model, same prompts, sandboxed environment — and compare. If accuracy doesn't move, the skill is dead weight at best and attack surface at worst.

This is the gap SkillzBench is being built to close. It's a free, independent directory of agent skills with a verification pipeline that pins every version to a commit SHA, checks licenses, runs security scans, and benchmarks each skill in a sandbox — with and without it, same model — publishing the Lift in percentage points so you can see what a skill actually contributes. A trust score from 0–100 combines security, quality, license, and maintenance signals, and Lift is always shown separately so ratings never blur the performance data.

On the equipping side, the principle is least privilege. Rather than giving every agent access to every tool, SkillzBench is building a free MCP connector with per-agent loadouts: you toggle which skills and tools each agent can see, and the agent only sees what you chose. Combined with a single agent given a focused set of well-defined tools — an approach OpenAI's agent guide endorses — this keeps your exposure small and auditable.

None of this requires becoming a security team. It requires treating skills the way good engineers treat dependencies: pinned, licensed, scanned, and measured before they touch production.

ctaText: Join the SkillzBench waitlist to get early access to the free verified skills directory, benchmarks, and MCP connector. socialProofText: SkillzBench is free forever — the directory, the MCP connector, and every benchmark, with no paid placement influencing scores.