Prompt Engineering Is Not Dead—It Just Moved Into Skills

The Prompt Engineering Panic: Why 'Skills' Replaced the Hype

You've been told prompt engineering is dead. Yet your agents still fumble the same workflow every Monday morning—and that gap between hype and reality has a specific name.

Between 2022 and 2024, the field ran on prompt engineering: hand-crafting instructions, iterating on phrasing, keeping a private library of "magic prompts." Then 2025 shifted the conversation to context engineering—curating what goes into the context window rather than just how to word it. By late 2025, Anthropic's engineering team published Agent Skills as an open standard on December 18, and the migration was complete: the procedure itself became the portable artifact.

The format is simpler than it sounds. A skill is a folder—usually anchored by a SKILL.md file—containing instructions, scripts, and resources that an agent loads on demand. The open specification describes a three-stage loading mechanism: discovery (name and description at startup), activation (full instructions when a task matches), and execution (following those instructions and running bundled code). That progressive disclosure is why skills can carry "effectively unbounded" context without bloating the agent's window.

Here's the part the obituaries miss: every SKILL.md still issues prompts internally. Atlan's analysis puts it bluntly—skills bundle prompts with examples and resources that persist across sessions, but they don't replace them. Prompt engineering didn't die; it moved into YAML metadata, description fields, and step-by-step procedural authoring.

What actually changed is where your instincts get applied:

• Metadata design — the name and description determine when the agent triggers a skill, so wording precision matters more than ever
• Procedural authoring — writing the "how to do it again" steps that make a task repeatable across sessions and teammates
• Evaluation loops — identifying capability gaps on real tasks before writing anything, per Anthropic's authoring guidance
• Version discipline — skills behave like software packages, so pinning and review replace "paste and pray"

The payoff is real. Microsoft's SkillOpt research reports best or tied-for-best results in all 52 tested settings, with optimized skills adding up to +23.5 points of average accuracy on GPT-5.5 versus no skill at all. Cross-harness transfer is even starker: a Codex-trained skill lifted Claude Code's SpreadsheetBench score from 22.1 to 81.8.

But the migration created a new problem. A large-scale study of 31,132 skills found that 26.1% carry at least one vulnerability, and skills bundling executable scripts are 2.12x more likely to contain them than instruction-only skills. With over 100,000 skills in circulation and no universal vetting layer, the ecosystem needs verification infrastructure—which is exactly what SkillzBench is building: a free directory that discovers, scans, and benchmarks skills so you can see what actually works before you equip an agent with it.

The Hidden Cost of Ad Hoc Skills: 26% Are Vulnerable

Here's a sobering number: a large-scale empirical study of 31,132 skills—drawn from 42,447 collected across two major marketplaces—found that 26.1% contain at least one vulnerability. This isn't a theoretical concern; it's a measured property of the ecosystem your agent pulls from every time you "just grab a skill."

The study, conducted with a detection framework called SkillScan, identified 14 distinct vulnerability patterns across four categories: prompt injection, data exfiltration, privilege escalation, and supply chain risks. The most prevalent were data exfiltration at 13.3% and privilege escalation at 11.8%. More troubling still, 5.2% of skills exhibit high-severity patterns suggesting deliberate malicious intent.

One finding deserves special attention: skills that bundle executable scripts are 2.12x more likely to contain vulnerabilities than instruction-only skills. The more powerful the skill, the riskier it tends to be. As SafeDep's threat model analysis puts it, installing a skill is "analogous to installing a 3rd party library dependency"—except the code that runs is determined at runtime, not at review time.

The scale makes this urgent. NSFOCUS's ecosystem research counts over 100,000 skills, still growing exponentially, with more than 105,000 related projects. Their audit of nearly 700 sampled skills found serious risks in about 21% and code-execution risks as the most common category. Notably, they detected no in-the-wild poisoning attacks yet—but a wide, unguarded attack surface with no defenders is an invitation, not a comfort.

Quality issues compound the security ones. A UC Irvine study found that over 99% of SKILL.md files contain at least one authoring defect—so-called "skill smells" that degrade how agents interpret and execute instructions.

Why does this keep happening? Because of how the architecture works:

• Skills execute with implicit trust and minimal vetting, as the arXiv study itself states
• Tampered prompts can guide the model toward unsafe instructions, while malicious scripts break permission boundaries—and the two risk classes amplify each other
• Most skills are written ad hoc: by humans, generated once by an LLM, or refined through trial and error

The practical takeaway is simple. "Just grab a skill" is no longer a shortcut—it's a supply-chain decision, the same class of decision your security team makes about npm packages or Docker images. That's exactly the gap SkillzBench is building to close: pinning every skill version to a commit SHA, security-scanning each one, and benchmarking skills in a sandbox before they ever touch your agent.

Skills as Version-Controlled Software, Not Disposable Prompts

A prompt you craft once and forget is a liability; a skill you version, scan, and pin is an asset. That distinction is the whole game now.

The security research makes the case bluntly. A large-scale analysis of 31,132 skills found that 26.1% contain at least one vulnerability, spanning prompt injection, data exfiltration, privilege escalation, and supply chain risks. Skills that bundle executable scripts are 2.12x more likely to carry a vulnerability than instruction-only skills. SafeDep's threat model puts it plainly: the Agent Skill spec introduces instructions and executable code into the agent loop, which is analogous to installing a third-party library dependency.

So treat skills like open-source packages, not disposable prompts. That means:

• Pin every version to a specific commit SHA, so an upstream edit can't silently change what your agent runs
• Review dependencies manually instead of trusting a skill's transitive scripts
• Scan before deployment using static analysis, LLM-based semantic analysis for prompt injection, and dependency auditing
• Test in a sandbox with and without the skill, so you know what it actually adds

That last point matters more than it sounds. Because skills use progressive disclosure, agents load only a skill's name and description at startup, the full SKILL.md body when a task matches, and bundled files only as needed. Anthropic notes this means the amount of context a skill can bundle is effectively unbounded. Comprehensive skills don't have to bloat your context window—but they do have to earn their place.

Verification infrastructure is the missing layer, and it's what SkillzBench is building: a free directory plus a free MCP connector that pins versions, scans, and benchmarks each skill in a sandbox to publish its Lift—the measured percentage-point gain, shown separately from trust scores. The fix isn't better prompts. It's proving which skills work.

Skills, proven.

When to Write a Skill (and When Not To): A 3-Repetition Rule

The most expensive prompt you will ever write is the one you rewrite every week. That is the moment a repeated instruction stops being a prompt and starts being a skill.

Atlan offers the clearest adoption test available: author a skill once a procedure repeats three or more times, needs to be shared across a team, or the same mistake keeps resurfacing across sessions. Anything one-off or exploratory still belongs in plain prompting, where iteration is cheap and nothing needs to persist. The rule works because skills are portable, version-controlled artifacts, not disposable text.

The payoff is measurable. In Microsoft's SkillOpt evaluation, optimized skills delivered best or tied-for-best results in all 52 tested settings across six benchmarks, seven target models, and three execution environments. On one frontier model, skills added roughly 23 points of average accuracy in direct chat versus no skill, and a Codex-trained spreadsheet skill transferred to a different harness at a gain of nearly 60 points, according to Turing Post's analysis. Reusable beats rewritten.

Signals that you should write the skill:

• The same procedure has come up three or more times, in chat or in an agent session.
• A teammate needs the same behavior, and copy-pasting prompts is the current handoff.
• The same error keeps returning across sessions because the instruction never persists.
• The task is stable and repeatable, not a one-time investigation.

Signals that you should not: a single exploratory question, a task you are still figuring out, or anything you would rewrite from scratch next week. Skills freeze a procedure, so freezing the wrong one just spreads a bad habit faster.

Two cautions temper the enthusiasm. Current practice remains ad hoc, with most skills written by hand, generated once by a model, or refined by trial and error, per the same Turing Post research. And the ecosystem carries real risk: a large-scale study of 31,132 skills found that 26.1% contain at least one vulnerability, with skills bundling executable scripts 2.12x more likely to be flawed than instruction-only ones, according to this empirical analysis. Verify before you install.

Anthropic's guidance points the same direction: start from evaluation. Identify capability gaps on representative tasks, then build skills incrementally to close them, rather than authoring speculatively. Prompt engineering is not dead here. It moved into skill authoring, metadata design, and evaluation. Agent skills can automate the rest of this workflow, and you can browse and test free ones on SkillzBench.

Your Next Step: Verify Before You Equip

If you've read this far, you already know the numbers: a large-scale study found that 26.1% of agent skills contain at least one vulnerability, and skills bundling executable scripts are 2.12x more likely to be risky than instruction-only ones. The right response isn't to avoid skills—it's to verify before you equip.

That's the gap the ecosystem is only now starting to close. The same research calls for "capability-based permission systems and mandatory security vetting," while security teams at SafeDep recommend treating every skill like an open-source dependency—with version pinning, review, and scanning. Until that infrastructure is standard, most agents are loading skills on pure trust.

This is why SkillzBench is being built. It's a free, independent directory of agent skills with a free MCP connector, designed around a simple workflow:

• Discover and verify: skills are crawled from GitHub, pinned to a commit SHA, license-checked, security-scanned, and quality-judged.
• Benchmark: every skill is tested in a sandbox with the same model, with and without the skill, so you can see the Lift in percentage points—published separately from trust ratings.
• Equip selectively: one free MCP server plus per-agent loadouts. You toggle skills and tools per agent, and the agent only sees what you chose.
• Stay current: upstream changes are tracked, and skills get re-scanned and re-benchmarked with notifications, because a skill that was safe last month may not be today.

Everything on the platform is free—the directory, the connector, the benchmarks, and the alerts. SkillzBench earns revenue from ads around blog content, never from users, and ad money never touches scores or listings. Trust scores (0–100) combine security, quality, license, maintenance, and community signals; Lift is always shown separately so performance data stays honest.

One honest caveat: SkillzBench is pre-launch and actively being built, which is exactly why now is the moment to act. The waitlist is open. Joining today means you're in position before the next vulnerable skill lands quietly in your agent's context—not after. Given that over 100,000 skills already exist and the count is still growing exponentially, the verification layer isn't optional anymore. It's the difference between equipping your agents deliberately and hoping for the best.

Join the SkillzBench waitlist and be first in line when verification, benchmarking, and per-agent loadouts go live.