How to Use AI Research Company: A Practical Walkthrough

The Hidden Risk in Your Agent's Skill Library

Your AI agent's skill library is growing fast — and almost nobody can tell which of those skills actually help, and which quietly put your business at risk.

The scale of the problem is easy to underestimate. According to Dark Reading's coverage of OWASP's new security blueprint, AI skill repositories have grown by at least one-third in just the past six months. Every new skill your team installs is another piece of third-party code and instructions running inside an environment with access to your data and tools.

The wake-up call came in July 2026, when Trojanized AI skills — distributed through a look-alike domain mimicking the "Paperclip" ecosystem — racked up more than 300,000 installs each before anyone detected them. Notably, the Trojanized Python packages in the same incident were caught by automated scanners within hours. The skills escaped.

OWASP has since published its Agentic Skills Top 10, and the rankings are blunt. The framework identifies two critical, four high-severity, and four medium-severity risks, with "Malicious Skills" sitting at #1, ahead of "Supply Chain Compromise" and "Overprivileged Skills." Published research on the skills ecosystem has found that roughly 26% of skills carry at least one vulnerability.

The industry's own experts are candid about how unprepared most organizations are. Omar Turner, Microsoft's Managing Director of Cloud and AI Security Projects, put it plainly: "Most CISOs can't honestly say how many agents are running and how many skills are embedded within agents." As he warns, without knowing what risks could exist with skills, "you're kind of operating blind."

The core problems to watch for include:

• Malicious skills — deliberately Trojanized packages that look useful while executing unwanted actions.
• Supply chain compromise — upstream changes to a skill you already trust, silently breaking things downstream.
• Overprivileged skills — instructions and scripts granted far more access than the task requires.
• Invisibility — no inventory of which agents are running which skills, so a bad skill can persist indefinitely.

The Frontier Model Forum's guidance on emerging security practices for AI agents captures the underlying principle: "every tool an agent can access expands both its capability and its exposure." Skills are no exception — the same mechanism that makes them powerful makes them an attack surface.

This is exactly the gap SkillzBench is being built to close: version-pinned, security-scanned, sandbox-tested skills, so you know what you're installing before it reaches your agent. Because the answer isn't to stop using skills — it's to stop using them blind.

What an Agent Skill Actually Is (And Why It's So Cheap to Keep Installed)

An agent skill is not a plugin, a prompt pack, or a proprietary feature locked to one vendor. It is simply a folder — and that simplicity is exactly why it costs almost nothing to keep installed.

At its core, a skill is a directory containing a required SKILL.md file plus optional scripts, references, and assets. The file opens with YAML frontmatter that the open specification defines precisely: a name field capped at 64 characters (lowercase letters, numbers, and hyphens only, matching the parent directory name) and a description field capped at 1024 characters. Everything else in the folder is optional and loaded only when needed.

That restraint is the point. Skills follow a progressive disclosure architecture: agents advertise each skill using roughly 100 tokens of metadata at startup, load the full SKILL.md body (recommended under 5,000 tokens) only on activation, and pull in bundled files or run scripts strictly on demand. Anthropic's engineering team describes this in three levels — metadata pre-loaded, SKILL.md on activation, bundled files on demand — noting the context a skill can carry is effectively unbounded because it stays on disk until invoked.

The practical result is a cost profile unlike almost any other AI capability:

• Idle skills consume only metadata tokens, so dozens can sit installed without crowding the context window.
• Full instructions load only when the agent decides the skill is relevant.
• Scripts and reference files execute or load only at the moment of use.
• Nothing is paid for until something is actually needed.

Portability compounds the value. Skills began as an Anthropic format and are now a cross-vendor open standard, supported across Claude, Claude Code, VS Code and GitHub Copilot, and the Microsoft Agent Framework, which documents the same advertise-load-read-run pattern. Build a skill once and it works across every compatible agent — no rewrites, no per-vendor forks.

That "install freely" economics cuts both ways, though. Because skills are cheap to keep, they accumulate quietly, and OWASP's Agentic Skills Top 10 ranks malicious skills as the number-one risk. Verification has to happen before installation, which is the gap SkillzBench is building its free directory and MCP connector to close — pinning versions to commit SHAs, security-scanning, and sandbox-benchmarking skills before any agent sees them.

The Safe Way to Source Skills: Verify Before You Equip

Installing a skill takes seconds; undoing the damage of a malicious one can take months. That asymmetry is why the industry's biggest names treat skill sourcing as a security decision, not a convenience.

Anthropic explicitly recommends installing skills only from trusted sources and auditing less-trusted ones before use — a rare moment of caution from the company that created the format. Microsoft goes further: its Agent Framework documentation notes that all skill tools require approval by default, and it warns against auto-approving anything except skill sources you explicitly trust. The Frontier Model Forum's guidance on emerging security practices for AI agents frames the rationale plainly: "every tool an agent can access expands both its capability and its exposure."

The warnings are grounded in real incidents. According to OWASP's coverage of the Agentic Skills Top 10, Trojanized skills racked up more than 300,000 installs each before detection in a July 2026 incident — while Trojanized Python packages in the same campaign were caught within hours by automated scanners. OWASP now ranks "Malicious Skills" as the #1 risk, ahead of supply chain compromise and overprivileged skills.

The consensus controls are consistent across every major source:

• Least-privilege access — grant skills only the permissions the task requires, since "the potential damage from any agent failure scales directly with the level of trust and permissions a user has granted."
• Sandboxing and audit logs — deterministic controls, because prompt-injection detection alone is insufficient.
• Version pinning and provenance — knowing exactly which version of which skill your agent is running.

This is the gap SkillzBench is being built to close. The platform — free, and currently pre-launch — will pin every skill version to a commit SHA, run security scanning and license checks, and quality-judge each package before it earns a place in the directory. Crucially, it will also benchmark every skill in a sandbox, running the same model with and without the skill to publish a measurable Lift in percentage points. Ratings and Lift stay separate, and money never touches scores.

If you want to be first in line when verification, benchmarking, and the free MCP connector go live, join the SkillzBench waitlist at skillzbench.com. Skills, proven — before your agent ever sees them.

Step-by-Step: From Discovery to a Verified, Equipped Agent

The difference between an agent that flails and one that delivers often comes down to which skills you install — and whether you trust them. A practical workflow handles that in four stages: discover, verify, connect, and stay current.

Stage 1: Discover from a curated directory, not raw GitHub. Agent skills are folders containing a SKILL.md instruction file plus optional scripts and references, and they now work across Claude Code, VS Code/GitHub Copilot, and the Microsoft Agent Framework as an open standard. But skill repositories have grown by at least one-third in just six months, which makes manually vetting raw listings impractical. A deduplicated, continuously crawled directory — like the one SkillzBench is building — collapses that sprawl into a browsable catalog instead of a search through thousands of overlapping GitHub repos.

Stage 2: Check trust signals before you install. This step is not optional. In a July 2026 incident, Trojanized skills racked up more than 300,000 installs each before anyone detected them — while Trojanized Python packages in the same event were caught by automated scanners within hours. Skills, in other words, slip past the tooling most people rely on. OWASP's Agentic Skills Top 10 ranks "Malicious Skills" as the number-one risk, followed by supply-chain compromise and overprivileged skills. Look for a consolidated trust score from 0 to 100 covering security, quality, license, maintenance, and community signals. On SkillzBench, that score is shown alongside the skill's measured Lift — the performance gain tested in a sandbox with the same model, with and without the skill — but Lift is always displayed separately from ratings, and money never touches either number.

Stage 3: Connect skills to your agent with per-agent control. The standard connection mechanism is MCP, and Anthropic's engineers describe skills as complementing MCP servers for complex external-tool workflows. The key discipline here is least privilege: the Frontier Model Forum notes that "the potential damage from any agent failure scales directly with the level of trust and permissions a user has granted." Per-agent loadouts solve this — you toggle skills and tools for each agent, and the agent only ever sees what you selected. SkillzBench's free MCP connector is being built around exactly this model, so a research agent and a writing agent can carry entirely different toolkits.

Stage 4: Stay current as upstream changes. Skills evolve upstream, and a skill that was safe in March may not be in September. Ongoing re-scanning, re-benchmarking, and change alerts close that gap — which is why SkillzBench treats upstream-change tracking as a core pillar rather than an afterthought.

If you're writing your own skills for your team, the same spec that makes them portable makes them manageable. Follow these practices drawn from the official specification and Anthropic's engineering guidance:

• Keep SKILL.md under 500 lines (roughly 5,000 tokens) — agents load only about 100 tokens of metadata at startup, so the body only costs context when activated.
• Write keyword-rich descriptions up to the 1,024-character limit; "Helps with PDFs" tells the agent almost nothing about when to activate the skill.
• Keep reference files small and one level deep, splitting large content into separate files the agent reads on demand.
• Make scripts self-contained with error handling, since agents run them as-is.

Anthropic puts it well: building a skill is like writing an onboarding guide for a new hire. Do it once, and the same skill works across every compatible agent. Want to go further? Browse and test free agent skills on SkillzBench — the directory, MCP connector, benchmarks, and alerts are all free, and the waitlist is open now.

Governance at Scale: Keeping Your Skill Stack Safe Over Time

A skill stack is not a one-time install. It is a living inventory that grows with every new capability your agents pick up, and every new entry is another thing that can break, drift, or turn hostile. The question is not whether to allow skills, but how to keep them safe once they are running across dozens of agents and thousands of tasks.

Security researchers have argued for years that the answer is a secure-by-default environment, not a ban. Niv Hoffman, co-founder and CTO of Air, put it plainly: "we do not recommend to forbid people from using them, but to use them in a secure-by-default environment." That framing matters because, from the agent's perspective, there is "no separation of user mode and current mode" — every skill a model can invoke effectively runs with the agent's full privileges. Omar Turner, Managing Director of Cloud and AI Security Projects at Microsoft, warned that "most CISOs can't honestly say how many agents are running and how many skills are embedded within agents," and urged organizations to plan in advance how to disable a malicious skill at scale.

The practical controls that make that environment real are well understood and worth treating as ongoing practice rather than a one-off setup:

• Least-privilege permissions so each skill can only touch the data and tools it actually needs
• Approval workflows for any skill execution, with auto-approval reserved for sources you explicitly trust
• Sandboxing and resource limits that contain what a skill can do if it misbehaves
• Audit logging so every invocation leaves a trace you can review and roll back

The harder problem is keeping those controls useful as the ecosystem moves. In the July 2026 "Paperclip" look-alike incident, Trojanized Python packages were caught by automated scanners within hours, but Trojanized skills escaped detection long enough to rack up more than 300,000 installs each. The gap was not policy; it was coverage. Closing it means continuous re-scanning and re-benchmarking of every skill in the stack, tracking upstream changes, pinning each version to a commit SHA, and alerting the moment a trusted skill drifts.

That is the discipline SkillzBench is building toward: a free directory that pins, scans, license-checks, and sandbox-benchmarks skills against the same model with and without the skill, plus a free MCP connector that lets each agent see only the loadout you have toggled on for it. Skills, proven — by continuous verification rather than a single check at install time.

Ready to govern your skill stack instead of just collecting it? Join the free waitlist at skillzbench.com for early access to verified, benchmarked skills and the free MCP connector.