How to Use Agentic Engineering: A Practical Walkthrough

Why Agentic Skills Are Worth Building — and Why the Ecosystem Is Risky

Agentic engineering is delivering the productivity gains the AI hype cycle promised — and importing a supply-chain security problem at the same time. That tension defines the moment: the opportunity is real and measurable, but the ecosystem you'll build on is dangerously young.

Start with the payoff. A study across 1,000 organizations found a 39% increase in weekly code merges after an agent became the default workflow — with no rise in revert or bugfix rates. Experienced workers benefited most, and the winning habit was plan-first prompting: structuring the task before invoking the agent.

Now the problem. A large-scale analysis of 31,132 agent skills found that 26.1% contain at least one vulnerability, spanning prompt injection, data exfiltration, privilege escalation, and supply-chain risks. A separate Snyk audit of 3,984 skills found 13.4% carry at least one critical security issue, including 76 confirmed malicious payloads — credential theft, backdoors, exfiltration.

The structural issue is that skills execute with implicit trust. Publishing one requires only a SKILL.md file and a GitHub account — no code signing, no security review, no default sandboxing. Snyk's researchers compare it to the early days of npm and PyPI, "except with unprecedented access to credentials, file systems, and APIs." Meanwhile, daily submissions grew from under 50 in mid-January 2026 to over 500 by early February — a 10x surge in weeks.

The numbers behind that risk surface:

• Skills bundling executable scripts are 2.12x more likely to contain vulnerabilities than instruction-only skills.
• Hardcoded secrets appear in 10.9% of audited marketplace skills — and in 32% of confirmed malicious samples.
• 100% of confirmed malicious skills contain malicious code patterns, and 91% also use prompt injection to prime the agent into executing it.
• 17.7% of marketplace skills fetch untrusted external content — the classic indirect prompt injection vector.

So the challenge for anyone building skill packs is two-sided. You need to capture the 39%-style productivity lift by encoding proven, plan-first workflows into reusable SKILL.md packages. But you also need to treat security vetting as a build step, not an afterthought — because the ecosystem has already crossed 100,000 skills with no gatekeeping to speak of.

That's the gap SkillzBench is being built to close: a free, independent directory where every skill is version-pinned, security-scanned, license-checked, and benchmarked in a sandbox — so "does this skill actually help?" and "is this skill safe?" become answerable questions instead of guesses. The rest of this walkthrough shows you how to build skills that survive both questions.

The Core Method: Plan-First Task Structuring, Not Generic Prompt Engineering

The single biggest productivity lever in agentic engineering isn't a clever prompt — it's what you do before you type one. When researchers tracked a rollout across 1,000 organizations, the workers who accepted the most agent output weren't the best prompt writers. They were the ones who structured the task first: objectives, alternatives, steps.

This finding aligns with how IBM's experts define what an agent actually is. Maryam Ashoori characterizes today's "agents" as LLMs plus rudimentary planning and tool-calling — not autonomous systems. If an agent is fundamentally a planning-and-delegation engine, then your job is to supply the plan. Generic prompt engineering (tweaking wording, adding persona tricks) optimizes the wrong variable.

The study's data supports this: experienced workers were 5–6% more likely to accept agent-generated code per standard deviation of work experience. Researchers conclude that expertise improves the ability to delegate — veterans know what agents can and cannot do, so they hand over well-shaped tasks. More than a third of all agent prompts involved planning, explaining, or diagnosing rather than writing features.

Here's the practical bridge: a proven plan-first prompt is exactly what a skill pack encodes. A SKILL.md file is essentially a reusable plan — objectives, constraints, and steps written once, loaded on demand. Instead of re-structuring a task every session, you package the structure. A good plan-first skill covers:

• The objective and success criteria, stated before any tool use
• Alternatives considered, so the agent doesn't re-derive bad paths
• Explicit steps and verification points the agent must follow
• What the agent must never do (fetching untrusted content, executing remote code)

One design decision matters more than everything else: keep the skill instruction-only. A large-scale analysis of 31,132 skills found that skills bundling executable scripts are 2.12x more likely to contain vulnerabilities than instruction-only skills (OR=2.12, p<0.001). Scripts expand the attack surface — Snyk's audit found 100% of confirmed malicious skills contained malicious code patterns, and 91% paired them with prompt injection to slip past reviewers.

Instruction-only design is the safer default. Express the capability as a plan; add scripts only when instructions genuinely can't do the job — and then vet them like production code. If you'd rather start from skills someone else has already built and scanned, SkillzBench is building a free directory and MCP connector for exactly that: discover, verify, and equip skills per agent, with security and quality signals you can check before loading anything.

Grounding and Guardrails: Verifiable Context, Sandboxing, and Security Gates

The most dangerous skill pack isn't the one that crashes — it's the one that quietly produces confident, wrong output while looking perfectly healthy. Two build gates separate reliable skill packs from risky ones: grounding your skills in verifiable context, and vetting everything before it reaches an agent.

Agent output quality tracks the quality of retrieved context. Parallel's analysis is blunt: "When an agent guesses at an API it can't verify, it invents method signatures that don't exist or answers from a version that shipped two years ago." The model can be excellent and the output still wrong.

Stale or ad-filled web context makes this worse. General search results arrive full of navigation, ads, and SEO filler that eat the context window before useful text lands. Pin your skill's references to specific versions and sources rather than letting it improvise from whatever it finds.

Untrusted content is also the main prompt-injection vector. Snyk's audit found 17.7% of ClawHub skills fetch untrusted content — and among confirmed malicious skills, 91% pair prompt injection with malicious code that a human reviewer would normally reject. As Snyk puts it: "The skill author did nothing wrong. The user installed a popular, well-reviewed skill. Yet the agent is compromised."

Practical grounding rules for your own skills:

• Pin dependencies and API versions explicitly in the skill instructions
• Never let a skill pull unverified remote content into the agent's context
• Avoid curl-pipe-to-bash patterns and dynamic fetching of executable content
• Prefer instruction-only skills — bundled scripts are 2.12x more likely to contain vulnerabilities

The numbers make vetting non-negotiable. A large-scale study of 31,132 skills found 26.1% contain at least one vulnerability, and the authors call for "mandatory security vetting before this attack vector is further exploited."

NSFOCUS's three-step mitigation gives you a workable checklist: source skills only from official or verified channels, run them in high-strength sandbox isolation, and apply multi-dimensional scanning — static, dynamic, and dependency auditing — before deployment. OWASP's Agentic Skills Top 10 formalizes the risks across all major agent platforms with evidence-based mitigations.

Guardrails don't need to become bureaucracy. The 1,000-organization study found successful firms relied on lightweight reviews — test coverage, file changes, architectural implications — rather than new oversight layers, and quality held: revert and bugfix rates didn't rise.

Skills, proven. SkillzBench is building a free directory and MCP connector that pins every skill to a verified commit SHA, security-scans it, and benchmarks it in a sandbox — so vetting happens before a skill ever reaches your agent.

Your Build Checklist: From Proven Plan to Deployed, Measured Skill Pack

You cannot simply agentize every task. Not every workflow should be agentized, as much "agentic" work is merely renamed orchestration that yields no new value according to IBM experts. Start by identifying a specific workflow with clear ROI before writing a single line of code.

Once you have selected the target, write a plan-first prompt. A large-scale study found that structuring tasks before invoking the agent is the key skill separating high performers. This approach shifts focus from generic prompt engineering to clear task structuring.

Convert that proven prompt into an instruction-only SKILL.md file. The data is clear: skills bundling executable scripts are 2.12x more likely to contain vulnerabilities than instruction-only packages research indicates. Keep the skill pure. If you must include scripts, treat it as a high-risk decision requiring full vetting.

Pin all dependencies and avoid curl | bash patterns. Agent output quality tracks the verifiability of the context it retrieves. Stale or untrusted content leads to plausible but wrong code, so ground your skill in stable, verified inputs.

Run security scans before deployment. With 26.1% of skills containing at least one vulnerability, security vetting is a mandatory build step, not an afterthought studies show. Use the OWASP Agentic Skills Top 10 framework as your checklist for mitigations.

Stress-test the skill in a sandbox. Production agents require rigorous testing to avoid cascading failures. Design mechanisms for rollback actions and ensure audit logs are integral to the process IBM advises.

Finally, make the skill the default workflow. The sharpest output increases occur only when the agent is the default, not an optional add-on. Define your metrics before rollout:

• Usage frequency across the team
• Acceptance rates of generated outputs
• Revert rates and bugfix frequencies

Track these operational metrics to find bottlenecks. Lightweight guardrails, such as reviews of test coverage and file changes, beat heavy bureaucratic oversight.

If you need to discover or vet third-party skills for your stack, SkillzBench is building a free directory and MCP connector to help you verify and benchmark skills safely.

Skills, proven.