Can AI Agents Actually Handle Docs? What Skills Can and Cannot Do in 2026

The Docs Problem: Agents Got Hands, Not Judgment

Agents are everywhere, but the work that matters most still stalls. Active agents in Microsoft 365 grew 15x year-over-year, yet the same organizations report that document work — filling PDF forms, following company procedures, handling contracts — remains stubbornly manual.

The gap isn't capability. Anthropic's own engineering work shows a PDF skill can give an agent the ability to manipulate documents it could previously only read, addressing a known limitation where agents understood PDFs but couldn't directly change them. What's missing is judgment: the knowledge of which procedure applies, which clause matters, and when to stop and ask a human.

Agent skills arrived as the fast fix. Anthropic published the open spec in December 2025, and by June 2026 roughly 40 products supported it, from Codex to Cursor to Gemini CLI. But adoption outran vetting, and the result is a confusing question every adopter now faces: do these things actually help?

The evidence says yes — conditionally. Curated skills raised agent pass rates by an average of 16.2 percentage points across 84 tasks, with healthcare gaining 51.9 points. The catch is what happens without curation:

• 26.1% of 31,132 analyzed skills contain at least one vulnerability, per the first large-scale security study of the ecosystem.
• Skills bundling executable scripts are 2.12x more likely to be vulnerable than instruction-only ones.
• Monolithic "everything in one document" skills actually reduced agent performance by 2.9 points, while 2–3 focused skills delivered +18.6.

That contradiction is the whole story of 2026. Skills work when they're focused and vetted, and backfire when they're sprawling or unvetted — which is precisely the gap SkillzBench is being built to close, with verification, commit-SHA pinning, and sandboxed benchmarking that publishes Lift separately from ratings. Until that judgment layer matures, treat every skill like an open-source package: useful, but not trustworthy by default.

What Skills Can Do: The Case for Curation

If you only read the headlines, agent skills sound like magic: drop a SKILL.md file into your agent's folder and watch it suddenly handle documents like a seasoned professional. The evidence says something more nuanced — skills work, but only when they're focused, curated, and vetted.

The strongest case for curation comes from benchmark data. According to a 2026 ecosystem report, curated skills raised agent pass rates by an average of 16.2 percentage points across 84 tasks and 11 domains. The gains were largest in domains that demand real organizational expertise: healthcare agents gained a remarkable 51.9 points when equipped with the right skills.

Focus matters just as much as quality. The same research found that 2–3 targeted skills delivered +18.6 points, while monolithic "everything in one document" skills actually reduced agent performance by 2.9 points. In other words, more skill is not better skill — a cluttered agent is a worse agent.

Document handling is where this becomes tangible. Anthropic's own engineering documentation describes how its PDF skill gives Claude the ability to manipulate PDFs directly — filling out forms, for example — addressing a known limitation where Claude could understand PDFs but not act on them. That's the difference between an agent that can read your paperwork and one that can process it.

What makes a skill actually work in practice? The evidence points to a consistent pattern:

• Narrow scope: 2–3 targeted skills beat one sprawling instruction package (+18.6 pp vs. −2.9 pp)
• Domain depth: skills shine where organizational expertise is scarce — healthcare, legal, finance
• Concrete abilities: bundled scripts and resources give agents capabilities they otherwise lack, like form manipulation
• Progressive disclosure: metadata loads at startup, full instructions load only when relevant, keeping context lean

But honest readers deserve the counterpoint. LlamaIndex's real-world testing found that skills were rarely invoked and often didn't yield substantially better results than a plain documentation MCP server. Their conclusion: the choice between skills and MCP tools is less about what each technology can do and more about the use case. Skills are natural-language instructions the model must interpret — which leaves them open to misinterpretation and hallucination, unlike deterministic MCP tool calls.

Both findings can be true at once. Outcomes depend heavily on skill quality and use case, and that's precisely the judgment problem the ecosystem hasn't solved: roughly 1.9 million public skills exist, and the average one scores just 6.2/12 on quality. Discovery is no longer the bottleneck — vetting is.

That's the gap SkillzBench is being built to close: a free directory where every skill is security-scanned, version-pinned, and benchmarked with its Lift published in percentage points, so you can see which skills actually help before your agent ever loads one. Curation works — the numbers prove it. The next step is making curation something you don't have to do alone.

ctaText: Skills, proven. See which ones actually lift agent performance — browse and benchmark free on SkillzBench. socialProofText: Join the SkillzBench waitlist to get Lift scores and security vetting for every skill — free, independent, and ad-supported.

What Skills Can't Do: The Security and Reliability Gap

For every percentage point skills add to agent performance, there's a darker number hiding in the ecosystem: more than a quarter of them can hurt you. The same packages that teach agents to handle documents can also carry vulnerabilities straight into your workflows.

The most rigorous evidence comes from a large-scale academic analysis of 31,132 skills, which found that 26.1% contain at least one vulnerability, spanning 14 distinct patterns including prompt injection, data exfiltration, and privilege escalation. The risks aren't evenly distributed. Skills that bundle executable scripts are 2.12x more likely to be vulnerable than instruction-only skills — a statistically significant finding (p<0.001) that should make any team think twice before installing a script-heavy skill from an unknown author.

Worse, even careful review isn't always enough. SafeDep's threat model for agent skills describes "deferred supply chain attacks": a script with unpinned dependencies can look perfectly benign during review, then pull down malicious code the moment it runs. As SafeDep puts it, "the code that runs is determined at runtime, not at review time." That's why their guidance — and Anthropic's own recommendation to install skills only from trusted sources — treats skills like any other open-source package requiring the same scrutiny.

There's also a structural limitation that no amount of vetting fixes. Skills are natural-language instructions the model must interpret, while MCP tools are deterministic API calls with fixed schemas. As LlamaIndex's comparison explains, that interpretation step "leaves skills open for misinterpretations and hallucinations." For document work, the practical rule is simple:

• Use MCP tools for deterministic operations — exact API calls where the same input must always produce the same output.
• Use skills for judgment-heavy procedures where domain expertise matters more than precision.
• Vet every skill before installation, and treat script-bundling ones with extra suspicion.
• Pin versions so what you reviewed is what actually runs.

None of this eliminates the need for human oversight. Microsoft's Work Trend Index found that 86% of AI users treat AI output as a starting point, not a final answer — and quality control of AI output (50%) ranks as the single most important human skill. Skills amplify what agents can do; they don't replace review.

That's the gap SkillzBench is being built to close: security scanning, commit-SHA version pinning, and independent benchmarking so that the skills you hand your agent are the ones that actually help — not the one in four that might quietly cause harm.

How to Use Skills on Docs Safely: A Practical Playbook

The gap between a skill that works and one that quietly breaks your workflow comes down to how you install and scope it. The evidence from 2026 points to a short, repeatable playbook.

Start by staying narrow. When researchers tested curated skills, 2–3 targeted skills improved agent pass rates by 18.6 percentage points, while monolithic "everything in one document" skills actually reduced performance by 2.9 points. For document work, that means loading a focused PDF-form skill or a contract-review skill rather than a sprawling general-purpose package. This maps directly to the per-agent loadout model SkillzBench is building, where you toggle exactly which skills each agent can see.

Second, match the mechanism to the task. MCP tools are deterministic API calls with fixed schemas; skills are natural-language instructions the model must interpret, which leaves them open to misinterpretation and hallucination. For anything that must happen exactly the same way every time — renaming a file, filling a known form field, calling a document API — use MCP. For judgment-heavy procedures like "how we review a vendor contract," a skill is the right fit. As one industry analysis puts it, the choice is about the use case, not which technology wins.

Third, vet every skill like an open-source package. That framing comes from SafeDep's threat model, and the numbers back it: a large-scale security study found 26.1% of analyzed skills contained at least one vulnerability, and skills bundling executable scripts were 2.12x more likely to be vulnerable than instruction-only ones. Worse, "deferred supply chain attacks" mean a script that looked benign at review time can turn malicious at runtime through unpinned dependencies. Before installing anything, check at minimum:

• Whether the skill bundles executable scripts or is instruction-only
• Whether versions are pinned to a specific commit, not a floating branch
• The license, maintenance history, and trustworthiness of the source
• Any signs of prompt injection or data exfiltration patterns

Doing this manually is realistic for a handful of skills, not for the roughly 1.9 million public skills now scraped from GitHub, where the average quality score is just 6.2 out of 12. That's the problem SkillzBench is being built to solve — security scanning, commit-SHA pinning, license checks, trust scores from 0–100, and sandbox benchmarks that publish each skill's Lift in percentage points, all free.

Finally, keep a human on the output. Microsoft's research shows 86% of AI users treat AI output as a starting point, and quality control is now the most-cited human skill in AI-augmented work. A skill that lifts pass rates by double digits still doesn't sign your contracts for you. Review the document before it leaves the building.

If you want to put this playbook into practice, join the SkillzBench waitlist to be first in line when the directory, trust scores, and free MCP connector go live.