Skills vs MCP in 2026: Where the Ecosystem Is Settling

The False Duel: Why Skills vs MCP Is the Wrong Fight

Your team just spent an afternoon arguing about it: should we build MCP tools or write skills? Slack threads split into camps. Someone shares a blog post proving skills are the future; someone else shares one proving MCP made skills pointless. Both posts are right — and the debate itself is the wrong frame.

The ecosystem has already resolved this, quietly and from multiple directions at once. The converging consensus treats MCP and skills as two layers of one stack, not competitors. MCP handles deterministic execution: fixed schemas, API calls, governed access. Skills handle context: natural-language instructions that shape agent behavior and decide when and how to reach for those tools.

The major players describe the same boundary in nearly identical terms:

• Google's official design principle for agent skills is to reference remote MCP tools whenever possible, falling back to CLI or API calls only when necessary — with remote MCP servers preferred for agentic workloads because they offer built-in auth and IAM governance.
• Atlan frames skills as procedural memory — instructions that pull governed context on demand — while MCP serves as the governed data-delivery layer beneath them.
• LlamaIndex defines MCP as a "functional interface" and skills as "contextual modification," and candidly reports that in their fast-moving docs domain, skills were rarely invoked and often didn't outperform their documentation MCP alone.

That LlamaIndex finding isn't a contradiction — it's the point. Skill value is domain-dependent, not universal. NVIDIA's benchmark of 300+ verified skills found average Skill Lift of +41 points for Correctness, but per-product results ranged from +2 to +46. SkillsBench found curated skills raise pass rates by 16.2 points on average — yet 16 of 84 tasks actually got worse with a skill installed. In fast-evolving domains where a single source of truth matters, MCP alone often suffices; in stable procedural domains, skills can transform performance.

So the real question for 2026 isn't "which one wins." It's a harder, more practical pair: which skills actually work, and which ones are safe to install? That second half is urgent. Snyk's audit of 3,984 community skills found 36.82% carry at least one security issue and 13.4% a critical one — while publishing still requires nothing more than a SKILL.md and a week-old GitHub account.

This is the gap SkillzBench is being built to close: an independent testing lab that benchmarks every skill with and without it in a sandbox, publishes the Lift in percentage points, and verifies versions, licenses, and security before you ever load one. The duel was never real. The trust problem is.

The Trust Vacuum: 36% of Skills Carry Security Issues

If you installed an agent skill in the past month, there's a one-in-three chance it carries a security issue — and a non-zero chance it's actively exfiltrating your credentials right now. That's not hyperbole; it's the headline finding of the ecosystem's most comprehensive security audit to date.

Snyk researchers scanned 3,984 skills from ClawHub and skills.sh in February 2026 and found that 36.82% carry at least one security issue, with 13.4% rated critical. The same audit confirmed 76 malicious payloads through human-in-the-loop verification — and eight malicious skills were still live on ClawHub at publication. Perhaps most quietly alarming: 10.9% of ClawHub skills contain hardcoded secrets, meaning authors are leaking their own API keys alongside whatever risk they pose to users.

Academic research paints a consistent picture with different lenses. A separate figure cited via Buteau's analysis of Xu and Yan puts the vulnerability rate at 26.1% of community skills, while a UC Irvine study found 99% of 238 real-world skills carry at least one flaw — a broader quality definition, but a damning one. These aren't contradictions; they're distinct metrics measuring security issues, vulnerabilities, and quality defects respectively. All three point the same direction.

What makes skills worse than the early npm and PyPI days — an era Snyk explicitly compares this moment to — comes down to three structural differences:

• Higher default privilege: skills operate with unprecedented access to credentials, file systems, and APIs.
• Prompt injection: a vector with no analog in code packages — 91% of malicious skills use it to prime agents into executing code a human reviewer would reject.
• Memory persistence: a compromised skill can shape agent behavior long after installation.

The growth curve compounds the risk. Daily submissions on ClawHub jumped from under 50 in mid-January to over 500 by early February — a 10x increase in weeks — while publishing still requires nothing more than a SKILL.md and a one-week-old GitHub account. No code signing. No security review. No sandbox by default.

This is precisely the gap SkillzBench is being built to close: pinning every skill version to a commit SHA, running security scans and license checks, and scoring trust on a 0-100 scale before a skill ever reaches your agent.

OWASP's launch of the Agentic Skills Top 10 — the first comprehensive security framework for AI agent skills — should be read as a maturation signal, not a nicety. Package ecosystems earn standardized security treatment only after the damage becomes undeniable. The question, as Snyk puts it, is whether this community will learn from those hard lessons or repeat them.

Lift Is Real — But Domain-Dependent and Sometimes Negative

The averages look spectacular — until you read the fine print. NVIDIA's evaluation of 300+ verified skills reports an average Skill Lift of +41 points for Correctness and +39 for Effectiveness, but per-product lift ranged from just +2 to +46. As NVIDIA itself concluded, the task domain mattered far more than which harness the agent ran in.

The independent picture is more sobering still. SkillsBench research found curated skills raise pass rates by 16.2 points on average — yet 16 of 84 tasks actually got worse with a skill attached. Nearly one in five tasks saw no benefit or a regression. That's not a rounding error; that's a coin you don't want to flip blind.

Token economics are equally mixed. NVIDIA's benchmark shows one optimization skill cut tokens by 76.9% and time by 53.7%, while an installation skill increased token usage by 120.3% and time by 20.8%. A skill that "works" can quietly double your inference bill.

Two failure modes deserve more attention than they get:

• Data trust: a skill can pass every conventional security check and still return confidently wrong answers because the data it queries is stale — "code trust asks if the skill is malicious; data trust asks if it reaches for what's true."
• Attention competition: every loaded skill competes for the agent's attention, and a skill that activates when irrelevant can actively reduce performance.

LlamaIndex's candid case study reinforces the point: in their coding agent, skills were rarely invoked and often didn't outperform their documentation MCP alone. Skills generated mid-session showed no measurable benefit at all.

The uncomfortable conclusion is that a skill's average Lift tells you almost nothing about your agent on your tasks. The only number that matters is the one measured with your harness, your domain, and your evaluation set — which is exactly why SkillzBench is building with/without-skill A/B benchmarking that reports Lift per skill, per context, always shown separately from trust ratings.

Before you install that trending skill, check whether anyone has actually measured it. Skills, proven — that's the standard the ecosystem now needs.

Verification Infrastructure Is the New Competitive Frontier

When npm and PyPI went through their supply-chain crisis, the survivors weren't the biggest registries — they were the ones that built verification first. The skills ecosystem is now walking the same path, and the companies building the infrastructure are telling us where the competitive ground is shifting: away from raw capability and toward trust.

NVIDIA's approach, detailed in its SkillEvaluator writeup, runs every skill through a three-tier pipeline: safety and structure scanning for prompt injection, data exfiltration, secrets, and license issues; distinctiveness checks using embedding similarity to catch duplicates; and live A/B evaluation in sandboxes, running the same task with and without the skill to measure Lift. Google goes further, treating each skill as "a living product, not a one-off document" — CI/CD checks on every submission, weekly scheduled evaluations, and named owners per skill, because as Google's team puts it, an open-source skills repository "quickly becomes chaotic" without automated governance.

On the security side, Snyk's detectors achieved 90–100% recall on confirmed malicious skills with zero false positives across skills.sh's top-100 — proof that scanning at scale is technically feasible. That matters because the threat is real: Snyk's audit of 3,984 skills found 36.82% carrying at least one security issue and 76 confirmed malicious payloads, with daily submissions growing 10x in a matter of weeks.

Strip away the vendor differences and the same methodology is emerging everywhere:

• Commit-pinned versions — every skill traceable to an exact source state, not a mutable repo head
• Security scanning — automated detection of injection, exfiltration, and secrets before install
• License checks — provenance and usage rights verified, not assumed
• With/without benchmarking — Lift measured in points, separately from any rating or popularity score

This is precisely the standard SkillzBench is building toward with its five pillars — Discover, Verify, Benchmark, Equip, and Stay current — including the deliberate choice to publish Lift separately from trust scores, mirroring NVIDIA's methodology. And the "stay current" pillar addresses what Google's weekly evals imply: verification isn't a one-time gate but a continuous obligation, because skills degrade as APIs and models evolve underneath them.

The frontier in 2026 isn't who has the most skills. It's who can prove, version by version, that a skill actually helps — and does no harm.

Your 2026 Stack: Skills + MCP Under a Control Plane

By 2026, the question is no longer skills or MCP — the winning stack runs both, under a control plane that decides what each agent sees. Google's own design principle is to reference remote MCP tools whenever possible, with skills acting as the stable procedural layer on top.

The hard part is trust. Snyk's audit of 3,984 skills found 36.82% carry at least one security issue, and publishing on ClawHub still requires no signing, review, or sandbox. Meanwhile, value is uneven: NVIDIA measured average Skill Lift of +41 correctness points across 300+ verified skills, but per-product lift ranged from +2 to +46. A popular skill may genuinely help — or quietly hurt — your specific agent.

So the practical 2026 stack has three commitments:

• MCP for governed execution — remote servers provide tools, auth, and IAM governance for anything touching credentials, data, or APIs.
• Skills for stable procedural context — vetted instruction packages, installed only after security scans and per-domain Lift data confirm they earn their place in context.
• Per-agent loadouts — each agent sees only the skills and tools you chose for it, since every installed skill competes for the agent's attention and can degrade performance when irrelevant.

That last point matters more than teams expect. NVIDIA found that a skill loading when it is not relevant can reduce agent performance, and SkillsBench research showed 16 of 84 tasks got worse with a curated skill attached. Loadouts aren't bureaucracy — they're the mechanism that turns benchmark data into actual behavior.

This is exactly the architecture SkillzBench is building: one MCP server as the Equip layer, with per-agent loadouts so nothing reaches an agent unvetted. Every skill version is pinned to a commit SHA, security-scanned, and benchmarked with and without the skill in a sandbox, with Lift shown separately from ratings. And because skills degrade as APIs and models evolve — Google needed weekly scheduled evals just to catch regressions — upstream changes trigger a re-scan, re-benchmark, and notification rather than silent drift.

The ecosystem is settling, and the teams that settle fastest are the ones with verification in the loop. SkillzBench is pre-launch and actively being built; join the waitlist to get verified, benchmarked skills as the standards crystallize. Skills, proven — before your agents install them.