What Is the Difference Between Skills and Plugins?

Why the Confusion Exists (and Why It Matters Now)

Ask five AI vendors what a "plugin" is and you'll get five different answers. OpenAI's agent guide never uses the word at all — it talks about data tools, action tools, and orchestration tools. Anthropic calls its extension format "skills." MCP servers are something else entirely. The vocabulary hasn't caught up with the technology, and that gap is now causing real problems.

The timing matters. Agent adoption is exploding beyond the developer community: OpenAI reports that non-developer individual users grew 137x since August 2025, and non-developer organizational users grew 189x. Meanwhile, daily skill submissions jumped from under 50 in mid-January 2026 to over 500 by early February — a 10x increase in a matter of weeks.

That means the people installing extensions to their agents are increasingly not developers. They're business owners, analysts, and managers who see a listing that promises to make their agent better and click install. And the terminology fog makes that dangerous, because different "extension" types carry very different risks:

• Skills are instruction packages — SKILL.md files that teach an agent how to perform a task, loading only when needed.
• Tools and MCP servers are executable connections that link agents to external services like CRMs, databases, or email.
• Plugins, in the classic sense, bundled code into an application — but no current agent vendor uses the term as a standard.
• Skills that bundle scripts blur the line entirely, mixing instructions with executable code.

The distinction isn't academic. A skill that only adds instructions is a very different risk profile from one that ships scripts your agent can execute — one study found script-bundling skills are 2.12x more likely to contain vulnerabilities. And because skills inherit the full permissions of the agent they extend — shell access, file read/write, credential access — installing the wrong thing isn't a cosmetic mistake.

So before you install anything, you need a clear mental model of what you're actually adding to your agent: knowledge, or a connection with real system access. The rest of this article builds that model — and shows why the difference determines how carefully you should vet each one. That vetting is exactly the problem SkillzBench is being built to solve, with a free directory that scans, benchmarks, and scores agent skills before you trust them with your agent.

What Skills Actually Are: Instruction Packages with Progressive Disclosure

Ask an AI coding agent to review a pull request, generate a report, or refactor legacy code, and you're relying on more than the base model — you're relying on packaged know-how the agent picked up along the way. That know-how increasingly arrives in a standard format called an agent skill, and understanding it is the key to understanding how modern agents actually extend themselves.

An agent skill is a lightweight, open format for extending what an agent can do — described by the skills standard documentation as a folder containing a SKILL.md file with metadata plus written instructions, optionally bundled with scripts, reference documents, and assets. The format was originally developed by Anthropic and released as an open standard, since adopted by a growing roster of agent products. Academic analysis of the ecosystem notes that Claude Code, Codex CLI, and Gemini CLI all support these metadata-rich instruction files with bundled scripts.

The clever part is how skills load into an agent's limited memory. Rather than dumping everything into context at once, skills use a three-stage mechanism called progressive disclosure:

• Discovery — at startup, the agent sees only each skill's name and short description, keeping the context footprint tiny.
• Activation — when a task matches a skill, the agent reads the full SKILL.md instructions into context.
• Execution — the agent follows those instructions, optionally running bundled scripts or code.

Because full instructions load only when a task calls for them, agents can keep many skills on hand without exhausting their context windows — the format is designed to scale to thousands of skills per agent, according to the research on skill ecosystems. One practitioner puts the underlying idea well: you write for a reader that has already read everything, so precision is the whole job — a skill is essentially a context pointer that surfaces the right playbook at the right moment (AI Hero).

This matters for non-developers too. As agents shift from single chat exchanges to delegated, long-horizon work — with non-developer usage growing dramatically since August 2025, per OpenAI's analysis — skills are how ordinary users teach an agent specialized workflows without writing code. But quality varies wildly: studies have found roughly a quarter to over a third of published skills carry at least one security flaw. That's exactly the problem SkillzBench is building for — its free directory will verify, sandbox-benchmark, and version-pin every skill so you can see which instruction packages actually help before you load them into an agent.

What Plugins, Tools, and MCP Servers Actually Are

If you've spent any time around AI agents, you've probably heard "skills," "plugins," "tools," and "MCP servers" used almost interchangeably. They're not. The distinction matters because each one hands your agent a very different kind of power.

The cleanest way to think about it: skills teach behavior, while plugins, tools, and MCP servers connect agents to executable external services. A skill is a folder with a SKILL.md file at its core, packaging procedural knowledge, context, and optional scripts that an agent reads when a relevant task comes up. According to the agentskills.io specification, skills load in three stages — discovery, activation, and execution — so an agent can carry thousands of them without burning through its context window.

A plugin, a tool, or an MCP server is something else entirely. It is a live connection to an outside system that the agent can call to do something — query a database, send an email, update a CRM, call an API. As the AGNT skills catalog frames it, MCP is "the standard protocol for connecting AI agents to external services," while skills are the instruction files that tell an agent how to behave when it uses those connections.

OpenAI's own agent-building guide sidesteps "plugins" and "skills" altogether, using "tools" as its canonical term and breaking them into three categories:

• Data tools — retrieve context the agent needs (search, document lookup)
• Action tools — take real-world actions like sending email or updating a CRM
• Orchestration tools — hand a subtask off to another agent

No major vendor uses "plugin" as a canonical term today, which is why any skills-versus-plugins comparison has to be synthesized rather than quoted. A useful mental model: a skill is closer to a playbook than an integration. It tells the agent what good practice looks like in a given situation. An MCP server or tool is the integration — the thing that actually reaches out and touches another system on the agent's behalf.

That split also explains why the security stakes are so different. Skills inherit the full permissions of the agent they extend — shell access, file read/write, credential access, and persistent memory — and studies have found roughly a quarter to over a third of published skills carry at least one security flaw. The arXiv analysis of 31,132 skills reported 26.1% with at least one vulnerability, while a separate Snyk audit found 36.82% with at least one flaw, including 76 confirmed malicious payloads. Because skills load dynamically based on task context, there is often little human review before they execute.

This is exactly the gap that verification and benchmarking are meant to close. SkillzBench is building toward a free, independent directory that pins every skill to a commit SHA, scans for vulnerabilities, checks licenses, and runs each skill in a sandbox to measure the actual lift it delivers — with and without the skill, against the same model. The goal is simple: separate the skills that genuinely help an agent from the ones that quietly hand it more power than anyone realized.

Skills, proven. Join the SkillzBench waitlist to get early access when the directory and free MCP connector go live.

The Security Gap That Makes Verification Non-Negotiable

Every skill you install hands your agent a set of instructions — and sometimes executable code — that runs with your permissions. The numbers on how often that goes wrong should make any team pause before installing skills blindly.

Two independent studies put the risk in stark terms. An arXiv analysis of 31,132 skills found that 26.1% contain at least one vulnerability, including data exfiltration (13.3%) and privilege escalation (11.8%). A separate Snyk audit of 3,984 skills found 36.82% carried at least one security flaw, with 13.4% containing critical issues and 76 confirmed malicious payloads. The takeaway: roughly a quarter to over a third of published skills are flawed, depending on the dataset.

The risk isn't evenly distributed. The arXiv study found that skills bundling executable scripts are 2.12x more likely to be vulnerable than instruction-only skills. And Security/Red-team skills showed the highest raw vulnerability rate of any category: 67.4%.

The consent gap: why "you approved it" doesn't protect you

Skills inherit the full permissions of the agent they extend — shell access, file read/write, credential access, messaging, and persistent memory, as the Snyk audit documents. Worse, the arXiv researchers identified a "consent gap": once you approve a skill, it gains persistent access without further prompts. The agent acts on the skill's instructions dynamically, based on task context, which reduces opportunities for human review before something happens.

The consequences are already real. The ClawHavoc campaign documented by OWASP distributed 1,184 malicious skills across 12 compromised publisher accounts, reaching 247,693 confirmed installations — resulting in $2.3M in stolen cryptocurrency and $890K in cleanup costs.

Why verification is the missing layer

Publishing barriers are part of the problem. As Snyk noted, publishing a skill on ClawHub requires little more than "a SKILL.md Markdown file and a GitHub account that's one week old. No code signing. No security review. No sandbox by default."

A sane verification layer would cover at minimum:

• Pinning every skill version to a commit SHA, so what you reviewed is what you run
• Security scanning and license checks before a skill reaches your agent
• Sandboxed benchmarking — testing each skill with the same model, with and without it, to measure real Lift
• Ongoing monitoring of upstream changes, with re-scans when a skill updates

This is exactly the gap SkillzBench is being built to close: its Verify and Benchmark pillars are designed to pin, scan, and test every skill in a directory that anyone can browse for free. Until independent verification becomes the norm, treat every third-party skill the way you'd treat unvetted code — because that's frequently what it is.

How to Choose and Use Skills Safely in Your Workflow

The skills ecosystem is growing fast — daily submissions jumped from under 50 to over 500 in a matter of weeks — and studies have found roughly a quarter to over a third of published skills carry at least one security flaw. That combination makes adoption strategy matter just as much as the skills themselves.

The right starting point is restraint. OpenAI's agent guide recommends maximizing a single agent's capabilities first, since more agents introduce complexity and overhead. Pick one agent you already use daily and give it a small, deliberate skill set rather than a sprawling library.

When choosing among skills, prefer instruction-only packages. Research on 31,132 skills found that skills bundling executable scripts are 2.12× more likely to contain vulnerabilities than instruction-only skills — and since a skill operates with the full permissions of its agent, including shell and credential access, that difference is significant.

• Check the publisher's history: the ClawHavoc campaign spread 1,184 malicious skills through 12 compromised publisher accounts, affecting 247,693 installations.
• Pin versions to a specific commit so upstream changes can't silently alter what your agent loads.
• Watch for the consent gap: approved skills gain persistent permissions without further prompts, so review what you approve.
• Use per-agent loadouts so each agent only sees the skills and tools you explicitly chose for it.

These practices pay off in real workflows. Writers can add a style-guide skill that teaches an agent their house voice; developers can add indexing guidance that turned PlanetScale queries from ~8 seconds to 2ms; business owners can add playbook skills for reporting or CRM hygiene without writing code. As one practitioner puts it, you are the author and the agent is the reader — precision is the whole job.

Because vetting each skill manually is impractical at this pace, this is exactly the problem SkillzBench is being built to solve: pinning every version to a commit SHA, security-scanning, license-checking, and benchmarking each skill in a sandbox — with and without it — so you can see the Lift in percentage points before trusting it with your agent's permissions. Once it launches, you'll be able to browse and test free skills on SkillzBench, and equip your agents with only what you chose via its free MCP connector. Until then, the waitlist is live — join it and be first in line when the directory, benchmarks, and per-agent loadouts go public.