Agent Skills, Explained: The SKILL.md Format Powering Every Major AI Agent

Strip an AI agent down to its essentials and you find a surprisingly humble building block: a folder with a markdown file in it. That file is called SKILL.md, and it has quietly become the shared language of nearly every major agent platform — the place where human expertise gets written down so agents can actually use it.

Formally, an agent skill is "a package containing a SKILL.md file with metadata and instructions, bundled with scripts and supporting resources," according to the first large-scale academic study of the ecosystem. The SKILL.md file carries a minimum of two pieces of metadata — a name and a description — plus the instructions themselves, and can sit alongside optional folders for scripts, references, and assets. Anthropic describes skills as "organized folders of instructions, scripts, and resources that agents can discover and load dynamically to perform better at specific tasks."

The format became a true open standard in October 2025, when Anthropic released the Agent Skills specification to work across different AI models and platforms. Today Claude Code, Codex CLI, Gemini CLI, Cursor, and OpenClaw all support it — which means a skill written once can run on any compatible agent. That portability is also why security researchers warn that "the risk travels with the SKILL.md file, not the platform."

The clever part is how agents load skills, a design called progressive disclosure:

• Discovery — the agent loads only skill names and descriptions at startup.
• Activation — when a task matches, it reads the full SKILL.md.
• Execution — it follows the instructions, optionally running bundled code.

Because agents only pull in the full instructions when a task actually requires them, the format scales to thousands of skills without exhausting context windows — a real constraint when a recommended five-skill setup already adds roughly 15–25K tokens per turn, versus about 50K for installing everything. The ecosystem has taken advantage: over 900,000 skills are now indexed across five marketplaces, and daily submissions to ClawHub jumped tenfold in early 2026, from under 50 to more than 500 per day.

That growth, however, has outpaced oversight. The same academic study found 26.1% of the 31,132 skills analyzed contain at least one vulnerability, and Snyk's separate audit found 13.4% carry critical-level issues. This is exactly the gap SkillzBench is being built to close — an independent lab that verifies, benchmarks, and scores skills so teams can tell the genuinely useful ones from the risky ones before installing them.

The takeaway is simple: skills are a genuinely elegant format for packaging expertise, and their cross-platform momentum is real. What the ecosystem still lacks is a trusted way to know which ones deserve a place in your agent's context window.

The Problem: Explosive Growth With Zero Vetting

In early 2026, daily submissions to one skill marketplace jumped from under 50 to over 500 in a matter of weeks — a 10x surge that no vetting process was designed to absorb. Across five marketplaces, more than 900,000 agent skills are now indexed, and publishing one often requires little more than a SKILL.md file and a week-old GitHub account. No code signing, no security review, no sandbox by default, as Snyk's ToxicSkills research documented.

The consequences are measurable. The first large-scale academic study of the ecosystem analyzed 31,132 unique skills and found that 26.1% contain at least one vulnerability, with 5.2% showing high-severity patterns strongly suggesting malicious intent. Snyk's parallel audit of 3,984 skills found 13.4% carried at least one critical-level issue, and 76 confirmed malicious payloads — eight of which were still live at publication.

This isn't theoretical. In December 2025, researchers demonstrated a benign-looking "GIF Creator" skill that silently downloaded and executed MedusaLocker ransomware. Months earlier, Anthropic disclosed the GTG-1002 campaign, the first documented large-scale AI-orchestrated cyberespionage operation, with 80–90% of tactical actions running autonomously. A coordinated malware campaign targeting Claude Code and OpenClaw users followed in February 2026, distributing 30+ malicious skills through a public registry.

What makes skills uniquely dangerous is the format itself. A malicious skill doesn't need to exploit a code vulnerability — a convincing English sentence is enough, because the agent simply follows the instructions it reads. That breaks traditional security tooling:

• Snyk showed a deliberately malicious test skill marked "CLEAN. 0 findings" by a popular scanner, with simple obfuscation like c${u}rl evading known-bad-string detection.
• 91% of confirmed malicious skills pair malicious code with plain-English prompt injection — a combination pattern-matching scanners cannot address.
• Once approved, a skill inherits the agent's full permissions — shell access, file read/write, credentials — without further prompts, the "consent gap" OWASP now classifies as Identity and Privilege Abuse.

The result is an ecosystem that researchers compare to early package managers before security became a first-class concern — and Anthropic itself now recommends installing only from trusted sources and auditing everything else. That's the gap SkillzBench is being built to close: independent verification, version pinning, security scanning, and sandboxed benchmarking so you can see which skills actually help before they touch your agent. Skills, proven — join the waitlist to stop vetting 900,000 options by hand.

How to Judge a Skill Before You Install It

With roughly one in four skills carrying a vulnerability, a quick gut-check before installing is no longer optional — it's basic hygiene. The good news: a five-minute evaluation catches most of the risk.

Start by reading the raw SKILL.md before you install anything. This is the single highest-value habit, because a malicious skill doesn't need to exploit a code vulnerability — it just needs to write a convincing English sentence that the agent follows. Look for instructions that request connectivity checks, downloads, or access to files unrelated to the skill's stated purpose.

Next, scrutinize the permissions the skill requests against what it actually does. A markdown formatting skill has no business asking for shell access or network calls. Remember that skills inherit your agent's full permissions by default — file read/write, credentials, network — and that once you approve a skill, it operates under persistent permissions without further prompts, a gap OWASP classifies as "Identity and Privilege Abuse."

Publisher reputation matters more than star count. Anthropic's own guidance is to install only from trusted sources and thoroughly audit anything untrusted. Check whether the skill is actively maintained, who published it, and whether the repository has real history behind it — publishing to some registries requires nothing more than a SKILL.md and a week-old GitHub account.

Pay attention to what's bundled. According to the first large-scale academic study of the ecosystem, script-bearing skills are 2.12× more likely to contain vulnerabilities than instruction-only skills. A pure SKILL.md with text references gives you far less attack surface than a package shipping executable scripts. It's one reason SkillzBench is launching with instruction-only skills, listing script-bearing packages link-out only.

• Read the raw SKILL.md end to end before installing.
• Match requested permissions to the skill's stated purpose.
• Prefer trusted, actively maintained publishers over anonymous uploads.
• Be extra cautious with skills that bundle scripts or fetch remote content.

Finally, weigh the token cost. A curated set of five core skills adds roughly 15–25K tokens per turn, versus around 50K if you install everything — overhead that slows every session. One practitioner's filter — trusted publisher, actively maintained, solves a real problem, SKILL.md actually read — cuts 900,000+ indexed options down to about 20. And 20 is plenty.

Doing this manually works, but it doesn't scale, and pattern-matching scanners miss obfuscated threats anyway. That's the gap SkillzBench is being built to close: independent security scanning, version pinning, and trust scores so you can evaluate skills in seconds instead of hours. Skills, proven. Join the waitlist to stop vetting skills by hand.

The Fix in Progress: Independent Verification and Benchmarking

The skills ecosystem is at an inflection point. As Snyk's researchers put it, the current state resembles early package managers before security became a first-class concern — and the response now taking shape is a dedicated curation layer built specifically for agent skills.

SkillzBench, an independent testing lab from AIQ Labs, is being built around five pillars designed to close the documented gaps. Each one maps to a failure the research has already exposed.

• Discover — continuously crawl and deduplicate skills from GitHub, addressing the reality that general marketplaces contain thousands of duplicates with no filtering.
• Verify — pin every version to a commit SHA, then run security scans, license checks, and quality judgments, producing a 0–100 trust score from security, quality, license, maintenance, and community signals.
• Benchmark — test each skill in a sandbox with the same model, with and without the skill, and publish the Lift in percentage points. No source today measures whether a skill actually helps; Lift answers that empirically.
• Equip — one MCP server with per-agent loadouts, so users toggle skills and tools per agent and the agent only sees what was chosen.
• Stay current — track upstream changes, re-scan, re-benchmark, and notify when a skill you rely on shifts underneath you.

Two design choices stand out as data-driven rather than arbitrary. The launch scope covers instruction-only skills — SKILL.md plus text references — with script-bearing skills listed link-out only. That mirrors the academic finding that skills bundling executable scripts are 2.12× more likely to contain vulnerabilities than instruction-only ones.

The second choice is structural: Lift is always shown separately from trust ratings, and money never touches scores. Given that a popular scanner marked a deliberately malicious test skill "CLEAN. 0 findings," and that traditional tools struggle to detect malicious content in unstructured text, the separation of "does it help" from "is it safe" is a deliberate epistemic boundary — one measurement should never contaminate the other.

SkillzBench is pre-launch and actively under construction, so the benchmarking, scanning, and MCP server described here are what it will offer, not published results. But the direction is clear: the era of installing skills on faith is ending, replaced by independent verification and measurement.