How to Use AI for Workflows: A Practical Walkthrough

The Automation Gap: Why General-Purpose AI Agents Struggle With Your Workflows

You've given your chatbot a task, and it produces something that's 80% right — the wrong invoice template, a summary that ignores your review process, code that breaks your team's conventions. That last 20% is where most workflow automation attempts quietly die.

The problem isn't the model's intelligence. General-purpose agents are, by design, generalists. They know how to write code and draft documents, but they don't know your company's naming conventions, your approval steps, or how your quarterly report is actually assembled. As Anthropic's documentation puts it, the fix is giving agents "domain-specific expertise: workflows, context, and best practices that turn a general-purpose agent into a specialist."

That mechanism is the agent skill — a SKILL.md instruction package that teaches an agent how to handle a specific workflow. Skills are remarkably efficient: only about 100 tokens of metadata load at startup, with full instructions pulled in on demand. That means you can install dozens of skills without slowing the agent down.

The format has also become a genuine cross-platform standard. Anthropic introduced skills in October 2025, and within weeks OpenAI Codex, Google Gemini CLI, Cursor, Microsoft VS Code/GitHub Copilot, and JetBrains all adopted the same format — with 30+ platforms on board by early 2026. A skill written for one agent works in the others without modification.

So what does closing the automation gap look like in practice?

• Pre-built document skills for PowerPoint, Excel, Word, and PDF handle the most common office workflows out of the box.
• Custom skills encode your conventions, review process, and the institutional knowledge that normally lives in people's heads.
• A free MCP connector, like the one SkillzBench is building, lets you equip each agent with exactly the skills it needs — and nothing it doesn't.

One caution before you install anything: this ecosystem is growing faster than it's being vetted. Snyk's audit of nearly 4,000 skills found 13.4% contain critical security issues, and a January 2026 study found over 26% of public skills carry at least one vulnerability. Skills inherit your agent's full permissions — shell, filesystem, credentials — so treat every third-party skill as untrusted code until it's been verified.

How Agent Skills Actually Work: The Mechanics You Need to Know

Skills work through a mechanism Anthropic calls progressive disclosure — a tiered loading system that keeps agents fast even with hundreds of skills installed. At startup, the agent loads only YAML metadata, roughly 100 tokens per skill. The full SKILL.md body, under 5k tokens, loads only when the skill triggers. Scripts and bundled resources cost zero context until the agent actually runs them — and then only their output enters context, never the code itself, according to Anthropic's official documentation.

That efficiency compounds. A single session supports up to 500 skills, deduplicated across agents, per Anthropic's managed agents documentation. Dozens of workflow skills can sit idle in the background without dragging on performance until one becomes relevant.

Every skill is a folder built around one file, SKILL.md, with two required fields:

• name — max 64 characters, the skill's identifier
• description — max 1024 characters, stating what the skill does and when to use it

The description matters most. It is what the agent matches incoming requests against, so a vague one means the skill never fires. In Claude Code, skills live in ~/.claude/skills/ for personal use or .claude/skills/ for a project — no upload step required. Repository skills are auto-discovered only at exactly .claude/skills/<skill-name>/SKILL.md, one level deep, and the session scans once at startup, so mid-session commits go unnoticed.

One caveat worth knowing before installing anything: skills inherit full agent permissions, including shell access, filesystem read/write, and credentials. A Snyk audit of nearly 4,000 skills found 13.4% carry at least one critical security issue, and a separate January 2026 study found over 26% contain at least one vulnerability. The mechanics are elegant; the ecosystem around them still needs vetting — which is exactly the gap SkillzBench is building to close, with version pinning, security scanning, and sandbox benchmarking planned for its free directory.

Step-by-Step: Automating Your First Workflow With Skills

Theory only gets you so far — the fastest way to understand agent skills is to automate one real workflow. Start small, follow a proven loop, and resist the urge to install everything at once.

Step 1: Start with pre-built document skills. Anthropic ships ready-made skills for PowerPoint (pptx), Excel (xlsx), Word (docx), and PDF, which cover most document-heavy business work out of the box, according to the official documentation. Because skills use progressive disclosure — only ~100 tokens of metadata load at startup, with full instructions pulling in under 5k tokens when triggered — you can install several without bloating your agent's context.

Step 2: Write a custom skill for your team's conventions. A skill teaches the agent to write your documents, following your review process and the institutional knowledge that normally lives in people's heads. Every skill is a SKILL.md file with a name (max 64 characters) and a description (max 1024 characters) that tells the agent what the skill does and when to use it. Place it in ~/.claude/skills/ for personal use or .claude/skills/ for a project — no upload required.

Step 3: Prototype, evaluate, iterate. Anthropic's engineering guidance recommends building quick prototypes, then running evaluations grounded in real-world tasks with verifiable outcomes — paste the evaluation transcripts back into your agent for analysis and improvement. This loop matters more than getting the first version perfect.

Step 4: Vet before you install. This is where caution pays off. Security audits have found that 13.4% of scanned skills contain critical security issues, and skills inherit your agent's full permissions — shell, filesystem, credentials. A popular code-review skill with 312 GitHub stars turned out to contain hidden instructions to auto-approve "security-exempt" PRs, so star counts and install counts are not reliable trust signals. At minimum:

• Audit the skill's source repository manually before installing
• Pin versions to specific commits and avoid blind bulk updates
• Be suspicious of skills that share a name with an existing one
• Treat every skill as third-party code, not trusted configuration

Step 5: Avoid tool overload. Anthropic's own engineering team warns that more tools don't always lead to better outcomes — a few thoughtful skills targeting high-impact workflows beat dozens of overlapping ones. Pick two or three workflows that actually consume your team's time, automate those well, and scale up only when the evaluations justify it.

If you'd rather not vet skills manually, SkillzBench is building a free directory that will pin every skill to a commit SHA, security-scan it, and benchmark it in a sandbox — plus a free MCP connector so each agent only sees the skills you choose. You can join the waitlist today and test your first automated workflow when it launches.

The Catch: Why ~26% of Skills Are a Security Risk You Can't Ignore

Here's the section: most tutorials show you how to install a skill in thirty seconds. Almost none show you how to check whether that skill is about to hand your credentials to a stranger.

The problem is structural. When you install a skill, it inherits everything your agent can do: shell access, filesystem read/write, environment variables, config files, and persistent memory across sessions. As Mondoo's security research puts it, a compromised npm package runs code — but a compromised skill runs code inside an agent that already holds your credentials and your environment.

The numbers back this up. Snyk's audit of 3,984 skills found that 13.4% carry at least one critical security issue, and a January 2026 study found more than 26% of publicly available skills contain at least one vulnerability across 14 distinct attack patterns. Behavioral testing confirmed 157 malicious skills, averaging four distinct attack vectors each — and a single actor accounted for 54% of them.

Worse, the trust signals you'd normally rely on can be faked. Orca Security demonstrated install-count inflation on a live marketplace, along with silent same-name overrides and blind bulk updates. And a popular code-review skill with 312 GitHub stars turned out to contain hidden instructions to auto-approve "security-exempt" pull requests — meaning even a well-starred skill can quietly subvert your review process.

The attack patterns fall into two broad camps:

• Data Thieves — scripts that harvest credentials while disguised as analytics or utility code.
• Agent Hijackers — hidden instructions embedded via HTML comments or invisible Unicode codepoints that survive casual code review.
• Hybrid attacks — 100% of confirmed malicious skills contain malicious code patterns, and 91% pair that code with prompt injection to prime the agent first.

Publishing a skill requires nothing more than a SKILL.md file and a one-week-old GitHub account — no code signing, no security review, no sandbox by default. Anthropic's own documentation warns users to treat skill installation like installing software and use skills only from trusted sources.

The practical takeaway: every third-party skill is untrusted code until proven otherwise. Audit the source repository, pin versions to specific commits, and avoid bulk updates. If you'd rather not do that manually for every skill, SkillzBench is building exactly this — automated security scanning, version pinning to commit SHAs, and sandbox benchmarking — into its free skills directory, so the vetting happens before a skill ever touches your agent.

From One Skill to a Vetted Workflow Library

One working skill is a hack. A vetted library of them is infrastructure — but only if you scale it the way security teams scale anything: deliberately, with version control and an audit trail.

The stakes are real. Snyk's audit of 3,984 skills found 13.4% contain at least one critical security issue, and 36.82% carry at least one flaw of any severity (Snyk's research). A separate January 2026 study put the figure at over 26% of publicly available skills with at least one vulnerability (Mondoo's analysis). Skills inherit your agent's shell access, filesystem permissions, and credentials, so Orca Security's advice is blunt: treat every skill as untrusted code (supply-chain research).

Four practices turn a growing skill collection into an approved catalog you can trust:

• Pin versions to specific commits. A commit SHA gives you a reproducible, auditable reference — you know exactly what code your agents ran, and upstream changes can't silently reach you.
• Audit the source repository before installing. Read the SKILL.md, read the scripts, check for hidden instructions — Mondoo found hidden payloads via HTML comments and invisible Unicode that survive casual code review.
• Avoid blind bulk updates. Orca demonstrated that bulk updating is a persistent-code-execution vector, and popularity signals like star and install counts can be spoofed — a 312-star code-review skill was found malicious.
• Build an internal approved catalog. Maintain a short list of skills that passed review, and give agents least-privilege access to exactly those.

The hard part is that manual vetting doesn't scale. Daily skill submissions jumped from under 50 to over 500 in a matter of weeks, and publishing requires nothing more than a SKILL.md file and a week-old GitHub account (Snyk's audit). No team can hand-review that volume.

This is the gap SkillzBench is being built to fill. It's designed to continuously discover and deduplicate skills from GitHub, verify each version against a pinned commit SHA with security scanning and license checks, and benchmark every skill in a sandbox — running the same model with and without the skill, then publishing the Lift in percentage points so you can see what actually helps rather than trusting ratings. A free MCP connector with per-agent loadouts means each agent only sees the skills you explicitly chose for it, and upstream changes get re-scanned and re-benchmarked automatically.

SkillzBench is pre-launch, but the waitlist is live — and for teams building skill-driven workflows, continuous verification beats one-time manual review. The teams that already treat skills as third-party code, as Mondoo notes, will have a significant head start when the ecosystem's security debt comes due.