Getting Started With Coding & Refactoring With Agent Skills: A 2026 Workflow Guide

The AI Coding Paradox: Near-Universal Adoption, Collapsing Code Quality

You've probably felt it: your team writes more code than ever with AI, yet the codebase somehow feels harder to change. That contradiction isn't your imagination — it's now measurable.

By every survey, AI coding adoption is near-universal. Stack Overflow's 2025 survey found 84% of developers use or plan to use AI tools, while JetBrains puts work adoption at 90% and DORA reports the same figure, up 14 points year over year. The throughput gains are real: daily AI users merge 2.3 pull requests per week versus 1.4 for non-users, a 60% advantage.

But the quality data tells a darker story. GitClear's analysis found that refactoring rates collapsed from roughly 24% of code changes in 2021 to under 10% by 2024, while copy/paste code rose from 8.3% to 12.3%. Duplicate code-block frequency jumped about eightfold year over year in 2024. Developers are shipping faster, but they're duplicating instead of consolidating — the exact opposite of what healthy codebases need.

The perception gap makes it worse. Even as these churn metrics deteriorate, 59% of DORA respondents believe AI is improving code quality. Meanwhile, trust in AI accuracy fell to 29% in 2025, down 11 points from 40% the year before. Developers increasingly suspect the output they're accepting at volume.

The numbers behind that suspicion are sobering:

• 45% of AI-generated code contains a security vulnerability, per Veracode testing across 80 coding tasks and 100+ models.
• 26.1% of analyzed agent skills contain at least one vulnerability, per a large-scale academic study of 31,132 skills.
• 13.4% of skills scanned in Snyk's audit carry at least one CRITICAL issue.

This is the paradox at the heart of 2026 development: near-universal adoption colliding with collapsing code quality and eroding trust. The tools aren't going away — Claude Code work adoption alone rose from about 3% to 18% globally in under a year. What's missing is discipline: codified standards for how agents should refactor, and verification of what those agents produce.

That's where skills-based workflows come in. Agent skills — SKILL.md instruction packages that agents load on demand — let you encode your refactoring standards as explicit, auditable instructions rather than hoping the model improvises well. And because a quarter of third-party skills carry vulnerabilities, vetting what you install matters as much as what you write. SkillzBench is building a free answer to both problems: a directory that will pin every skill version to a commit SHA, security-scan each one, and benchmark skills in a sandbox so you can see whether a skill actually helps before it touches your codebase.

The rest of this guide shows you how to build that discipline into your own workflow — starting with the fundamentals.

What Agent Skills Are (and Why They Beat Prompt Copy-Paste for Refactoring)

A skill is just a folder: a required SKILL.md file with name and description in YAML frontmatter, plus optional scripts, references, and assets directories. Anthropic published that structure as an open standard in December 2025, and it now runs across Claude.ai, Claude Code, and the Agent SDK.

The magic is progressive disclosure, which loads in three levels: metadata at startup, the full SKILL.md body only when a task matches, and bundled files only as needed. That keeps many skills available with a small context footprint, per the standard's documentation.

Bundled scripts matter most for refactoring. Anthropic's own rationale: sorting a list via token generation costs far more than running a sorting algorithm. So skills can ship deterministic linters, formatters, and test runners the agent executes without loading into context.

Compare the three paradigms honestly:

• Skills carry procedural knowledge — how your team refactors.
• MCP governs tool access, and it rebounded for enterprise governance after early token-cost criticism.
• Subagents handle parallel, specialized work.

The community debate is unresolved. Simon Willison called skills "maybe a bigger deal than MCP," while skeptics counter that they're just prompt text — see the 816-point Hacker News thread. Anthropic positions them as complementary.

Authoring your first refactoring skill follows Anthropic's guidance: run agents on representative tasks, observe gaps, then build incrementally. Keep descriptions precise, since metadata drives triggering, and split unwieldy instructions into referenced files.

Vet before you install. An academic study of 31,132 skills found 26.1% contain at least one vulnerability, and script-bundling skills are 2.12x more likely to be vulnerable — so prefer instruction-only skills where possible. SkillzBench is building a free directory and MCP connector that will pin versions to commit SHAs, security-scan, and benchmark skills in a sandbox, so you can test before you trust.

The Supply-Chain Problem: Why 1 in 4 Skills Is a Liability

Before you install a single skill, you need to confront an uncomfortable reality: roughly 1 in 4 skills circulating in the open ecosystem carries a security flaw. This is not a hypothetical concern — it is a measured, documented supply-chain problem that mirrors the early days of npm and PyPI.

A large-scale academic study analyzing 31,132 skills found that 26.1% contain at least one vulnerability, with 13.3% enabling data exfiltration and 5.2% showing high-severity patterns strongly suggesting malicious intent. An independent audit by Snyk found that 13.4% of skills carry at least one CRITICAL issue, and confirmed 76 malicious payloads — with 8 still live at publication.

The attack surface is unusually wide because skills inherit full agent permissions: shell access, file system read/write, credentials in environment variables, and messaging ability. Publishing requires only a SKILL.md file and a one-week-old GitHub account — no code signing, no security review, no sandbox by default. In February 2026, researchers documented the first coordinated malware campaign targeting coding agents through 30+ malicious skills.

Here is a practical vetting checklist to run before installing anything:

• Install from trusted, curated sources only — Anthropic's own security guidance recommends auditing every skill's file contents, dependencies, and network instructions before use.
• Read the SKILL.md frontmatter and body line by line. Look for instructions that trigger outbound network calls, read environment variables, or write outside the project directory.
• Inspect bundled scripts/ directories manually. Skills that bundle executable code are 2.12x more likely to contain vulnerabilities, so prefer instruction-only skills whenever the task allows.
• Check for hardcoded secrets. The Snyk audit found 10.9% of skills contain hardcoded credentials — a silent exfiltration risk.
• Pin every skill version to a specific commit SHA so an upstream update cannot silently swap in malicious code.

The OWASP Agentic Skills Top 10 framework documents ten critical risk categories across major AI agent platforms and is worth reading alongside any security review you run.

SkillzBench is building exactly this layer of defense into its free skills directory: every listing will be pinned to a commit SHA, security-scanned, license-checked, and benchmarked in a sandbox before it reaches your agent. The trust score runs 0–100 from security, quality, license, maintenance, and community signals — and money never touches the score.

Treat every third-party skill as untrusted code until you have verified it yourself. The ecosystem is growing faster than its guardrails, and the cost of a careless install is measured in compromised credentials and exfiltrated data.

A Safe 2026 Refactoring Workflow: Discover, Verify, Benchmark, Equip

You have a skill folder. Your team has refactoring standards scattered across wikis, code reviews, and one senior engineer's head. Here is how to turn that into a workflow that actually holds up in 2026 — without importing someone else's vulnerabilities.

Start by codifying your team's refactoring standards as skills. Anthropic's own authoring guidance says to begin with evaluation: run your agent on representative tasks, observe where it drifts, and build skills incrementally to close those gaps. This matters because GitClear's code-quality research shows refactoring rates collapsed from roughly 24% to under 10% between 2021 and 2024 while copy/paste code rose — a disciplined, skills-based approach is the counterweight.

Structure those skills for scale from day one. Split unwieldy SKILL.md files into referenced documents that load only when a task matches, keep mutually exclusive contexts separate, and clarify whether bundled scripts should be run or merely read. That last point is not cosmetic: a large-scale academic study found skills bundling executable scripts are 2.12x more likely to contain vulnerabilities, so prefer instruction-only skills where possible.

Run skills locally when third-party APIs are involved. Claude.ai's sandbox can only install from PyPI, NPM, and github.com, so skills that need external services require a CLI agent like Claude Code running locally, with credentials passed via environment variables. Then measure results on representative tasks, with and without the skill, before rolling anything out team-wide.

Your vetting checklist for any third-party skill:

• Pin the version — you should know exactly which commit you're running.
• Audit file contents, dependencies, and any network instructions before install.
• Prefer instruction-only skills over script-bundling ones.
• Benchmark in a sandbox before trusting a skill in production code.

The stakes justify the discipline. Snyk's ToxicSkills audit found 13.4% of scanned skills carry at least one CRITICAL issue, and daily skill submissions jumped tenfold in a matter of weeks — publishing requires nothing more than a SKILL.md and a week-old GitHub account.

This is where SkillzBench comes in. Its free directory and MCP connector are being built to do this vetting for you: pinning every skill version to a commit SHA, security-scanning, and benchmarking each skill in a sandbox with the same model — publishing the Lift in percentage points so you can see whether a skill actually helps. The waitlist is open now, and everything — directory, MCP connector, benchmarks, alerts — will be free.