How Many Skills Can an Agent Have?

The Skill Gold Rush: Why Everyone Is Asking This Question

Agent skills are multiplying faster than anyone expected — and nobody has published a maximum. A curated repository now spans 70+ contributing organizations including Anthropic, Microsoft, OpenAI, Google, Stripe, and NVIDIA, while daily submissions on one marketplace jumped from under 50 to over 500 in just a few weeks.

That's a 10x increase in weeks, according to Snyk's marketplace audit. The SKILL.md format is cross-platform, so the same package runs on Claude Code, Codex, Cursor, Gemini CLI, and chat-app agents alike.

The problem isn't scarcity — it's triage. With thousands of skills circulating and no stated ceiling, the real question is how many you should actually install on any one agent.

The honest answer is uncomfortable:

• Vendors describe capacity as "effectively unbounded" because of progressive disclosure — only ~100 tokens of metadata load per skill at startup.
• Independent benchmarking shows 16 of 84 tasks got *worse* when skills were added — more skills is not automatically better.
• Roughly 26% of analyzed skills carry at least one vulnerability, so every install adds attack surface.
• Skills that bundle executable scripts are 2.12x more likely to contain vulnerabilities than instruction-only skills.
• No source states a hard maximum — the ceiling is set by curation quality, not architecture.

Those numbers reframe the question entirely. It's not "how many can I install?" but "how many can I trust?" — and the research gives you no shortcut to answering it.

This is exactly the gap SkillzBench is building to close: a free, independent directory where every skill is pinned to a commit, security-scanned, license-checked, and benchmarked so you can see measured Lift before you equip an agent. The directory, the benchmarks, and the MCP connector are all free — and the waitlist is open now.

The Architectural Answer: Effectively No Limit

If you're wondering whether your agent will hit a ceiling at 10 skills, or 50, or 500 — the short answer from the people who built the architecture is: no. The number of skills an agent can hold is not capped by design; it's capped by judgment.

The reason is a design principle called progressive disclosure. Rather than stuffing every skill's full instructions into the agent's context window, skills load in three tiers. According to Anthropic's engineering team, an agent pre-loads only a skill's name and description at startup, reads the full SKILL.md file only when a task matches, and pulls in bundled files only as needed. The result, in Anthropic's words, is that "the amount of context that can be bundled into a skill is effectively unbounded."

Google describes the same three-tier architecture — discovery, activation, execution — and quantifies the overhead. Per Google Cloud's documentation, each installed skill costs roughly 100 tokens of metadata at startup, and because skills "only consume the context window when triggered, allowing you to install dozens of skills with minimal overhead," there is no meaningful architectural penalty for a large library.

In practice, that means:

• Every skill costs only ~100 tokens at startup, regardless of how large its full instructions are.
• Full instructions load only when a task actually matches the skill's description.
• Bundled scripts and reference files are read on demand, never up front.
• The ecosystem reflects this: a curated community repository tracks skills from 70+ contributing organizations, including Anthropic, Microsoft, OpenAI, Google, and Stripe.

So the technical answer to "how many skills can an agent have?" is: as many as you want. Architecture is not the constraint. What constrains a skill library is everything the architecture doesn't solve — whether each skill actually helps, and whether it's safe to run. Independent research has already shown both questions matter: benchmarking work found that adding skills made 16 of 84 tested tasks worse, and a large-scale analysis found 26.1% of skills carry at least one vulnerability.

That gap — between "you can install unlimited skills" and "you should install vetted ones" — is exactly what SkillzBench is being built to close: a free directory where every skill is security-scanned, version-pinned, and benchmarked with and without the skill, so the number you install is a curation decision, not a gamble.

Why More Skills Can Make Your Agent Worse

Most teams assume that piling more skills onto an agent will make it more capable. The data says the opposite.

The most rigorous test of skill efficacy to date is SkillsBench, a benchmark covering 86 tasks across 11 domains and 7,308 agent trajectories. Curated skills lift average pass rates by 16.2 percentage points, which sounds like an unqualified win. But the same study found that 16 of 84 tasks actually got worse when skills were added. The gains are uneven, ranging from +4.5pp in Software Engineering to +51.9pp in Healthcare, and the downside is real.

The pattern matters more than the average. SkillsBench researchers concluded that focused skills with 2–3 modules outperform comprehensive documentation. Smaller models equipped with the right skills can match larger models running without any. And self-generated skills, written by the agent itself, provide no benefit on average. Models cannot reliably author the procedural knowledge they benefit from consuming.

What this means in practice:

• More skills does not equal a better agent. Diminishing and negative returns kick in fast.
• Focused, single-purpose skills beat sprawling multi-module ones.
• Self-authored skills are a waste of context window on average.
• Each installed skill adds attack surface, and roughly 26% of skills in the wild carry at least one vulnerability.
• The practical ceiling is set by curation quality, not by token budgets.

The architectural ceiling is generous. Anthropic's progressive-disclosure design loads only ~100 tokens of metadata per skill at startup and reads full instructions only when a task matches, making skill count effectively unbounded in theory. But unbounded capacity is not the same as unbounded usefulness. Quality, not count, is what separates a skill that lifts performance from one that drags it down.

For teams building agents today, the implication is straightforward: treat skills like software dependencies, not like plugins to collect. Pin versions, verify authors, scan for vulnerabilities, and benchmark each skill in isolation before trusting it in production. SkillzBench is building toward exactly this model, a free directory where every skill is version-pinned, security-scanned, and benchmarked with and without the skill so you can see the actual Lift before you install it.

The Hidden Cost of Every Skill You Install

The architecture of agent skills promises infinite scalability, but that design choice hides a significant operational risk. Every new skill you install expands your agent’s attack surface, turning a convenience feature into a potential security liability.

While progressive disclosure ensures agents load only minimal metadata at startup, it does not sanitize the code itself. A comprehensive analysis of 31,132 skills revealed that 26.1% contain at least one vulnerability, indicating that nearly one in four skills poses a direct threat to your infrastructure.

This risk is not evenly distributed across the ecosystem. Skills that bundle executable scripts are 2.12x more likely to harbor vulnerabilities than those containing only static instructions. This disparity highlights the danger of assuming that a skill’s utility outweighs its code complexity.

Security researchers have identified specific attack vectors that exploit these weaknesses. Orca Security demonstrated four distinct attack primitives in skills marketplaces, including silent skill overrides and blind bulk updates. These techniques allow malicious actors to persist code execution even after a skill passes initial security audits.

To understand the scope of this threat, consider the critical issues found in major marketplaces:

• 13.4% of 3,984 analyzed marketplace skills carry critical-level security issues.
• 36.82% of skills contain at least one flaw at any severity level.
• 76 skills have been confirmed to contain active malicious payloads.

These statistics confirm that quantity is not the limiting factor; quality is. OWASP has released the Agentic Skills Top 10, a framework that outlines the most critical security risks across all major AI agent platforms. It serves as a baseline for understanding what "safe" actually looks like in this emerging ecosystem.

Vetting is the true limiting factor for how many skills an agent can safely hold. Without rigorous verification, installing dozens of skills is akin to installing dozens of unvetted dependencies in a production environment.

This is why independent verification matters. SkillzBench is building a free directory and MCP tool designed to address this exact gap. By continuously crawling, deduping, and security-scanning skills, the platform aims to provide a trust score that separates proven utilities from risky liabilities.

The goal is not to limit your agent’s capabilities, but to ensure every capability is secure. As the ecosystem grows, the ability to verify skills before deployment becomes a critical component of any robust AI workflow.

How to Choose the Right Number: Curated Per-Agent Loadouts

If your agent can technically hold dozens of skills, the real question becomes which ones it should hold. The evidence says fewer, better-chosen skills beat a maximal install every time.

Start with the performance data. The SkillsBench benchmark found that focused skills with 2–3 modules outperform comprehensive documentation, and that 16 of 84 tasks actually got worse when skills were added. Curated skills raised average pass rates by 16.2 percentage points overall — but only when they matched the task. The same study found self-generated skills provide no benefit on average, so resist the temptation to let your agent write its own.

That points to a simple playbook for every agent you run:

• Give each agent only the skills relevant to its job — a research agent and a coding agent should not share the same loadout.
• Pin every skill version to a specific commit SHA so an upstream change can't silently alter your agent's behavior.
• Avoid blind bulk updates; security researchers at Orca Security demonstrated how attackers exploit them for persistent code execution.
• Prefer vetted, third-party-reviewed skills over self-generated or unreviewed ones.
• Re-verify periodically — a skill that was safe last month may not be safe now, especially with daily submissions on one marketplace jumping from under 50 to over 500 in weeks.

The vetting step matters more than most teams realize. A large-scale analysis of 31,132 skills found that 26.1% contain at least one vulnerability, and skills bundling executable scripts are 2.12x more likely to be risky. Google Cloud's advice is blunt: treat skills with the same security rigor as any other software dependency.

Doing all of this by hand — crawling GitHub, scanning, benchmarking, tracking upstream changes — is a full-time job. That's the gap SkillzBench is being built to close. It's a free, independent directory that pins every skill to a commit SHA, runs security scans and license checks, and benchmarks each skill in a sandbox with the same model, with and without the skill, publishing the Lift in percentage points so you can see what actually helps. Its free MCP connector is designed around per-agent loadouts: you toggle skills per agent, and the agent only sees what you chose for it. It's currently in pre-launch — you can join the waitlist to get early access.

The takeaway: capacity is not the constraint — curation is. Equip each agent with a small, verified set of skills proven to help, not a pile that might hurt.