What is an AI skill?

Ask what an AI skill is and you will often get the definition of a tool by mistake. The two sit side by side in every agent stack, and they get flattened into one idea. A tool lets an agent call a function, such as sending an email or running a query. A skill is a different kind of thing. It is the packaged know-how for doing a job, delivered into the model only when that job comes up.

What an AI skill actually is

A skill is a self-contained, model-external package of procedural knowledge. It carries written instructions, and often bundled scripts, reference files, and templates, that an agent pulls into its working context on demand, at inference time, to perform a class of task. Crucially, none of this changes the model’s weights. The know-how lives outside the model and is loaded when needed.

Put another way, a skill extends what an AI agent knows how to do. Where a tool gives it a new action to invoke, a skill supplies the method: what to do, in what order, and under what constraints.

The idea has moved past marketing language and into the research literature quickly. Recent work describes Agent Skills as “an emerging open standard that defines a modular, filesystem-based packaging format enabling LLM-based agents to acquire domain-specific expertise on demand” (Li et al., 2026). Other work frames skills as a knowledge primitive in their own right, distinct from raw documents or callable tools (Bakal, 2026).

Skill, tool, RAG, and fine-tuning

The clearest way to place a skill is against the other ways of giving a model capability. Each loads a different kind of thing, at a different time.

The line that matters is what kind of thing is being loaded, and when. Fine-tuning bakes knowledge into the weights. RAG retrieves facts and drops them into context. A tool exposes an action. A skill delivers the procedure. That last one is easy to miss, because a skill and a tool both show up at inference time and both help the agent get work done.

The skill-versus-tool boundary is where most confusion sits, so it is worth grounding. In the agent-evaluation literature, “tool use involves invocation of a single tool and is interchangeable with function calling” (Evaluation and Benchmarking of LLM Agents, 2025). A tool is that single callable function. A skill is the packaged procedure for deciding when and how to use one, or several.

What is inside a skill

The dominant instantiation of the concept is the open Agent Skills standard. Under it, a skill is a directory whose one required file is SKILL.md: a Markdown file with a short YAML header, giving the skill a name and a description, followed by the instructions themselves. It can also carry optional folders: scripts the agent can run, reference files it can read, and assets it can use (Agent Skills specification).

That is the whole format. No compilation step, no model change, no bespoke runtime. A skill is text and files an agent reads.

How an agent knows when to use one

A model cannot hold every skill’s full instructions in context at once, so the format solves loading through progressive disclosure. The agent pre-loads only each skill’s name and description, a lightweight index rather than the full instructions. When a task matches a description, it reads that skill’s full instructions. Only then, and only if the work calls for it, does it open the bundled reference files or run the bundled scripts (Agent Skills specification).

So the cost of having a skill available is tiny, and the cost of using one is paid only when it is actually used. That is what makes it practical to give an agent hundreds of skills without drowning its context.

How a skill relates to MCP

These two often get mentioned together, but they solve different problems. The Model Context Protocol standardises how an agent connects to external tools and data. A skill standardises how an agent learns a procedure. They compose rather than compete: a skill can instruct the agent to use tools reached over MCP. One is a connection layer; the other is packaged method.

Are AI skills safe to install?

Because a skill can bundle executable scripts, installing one is closer to running third-party code than to reading a document. The format is now studied as a genuine attack surface, not just an announced feature. One security analysis builds a threat taxonomy of seven categories spanning seventeen distinct threat scenarios across the skill lifecycle, from creation through distribution, deployment, and execution, and validates it against five real-world incidents in the ecosystem (Li et al., 2026). The practical reading is neutral and familiar: a skill from a trusted source is convenient; an unknown one is untrusted code you should review before it runs.

The mental model that holds up

The useful test is not “does this help the agent.” Tools, RAG, fine-tuning, and skills all do that. The test is what gets loaded and when. A skill loads procedure, from outside the model, at the moment a task needs it, and leaves the weights untouched. Hold that distinction and the word stops being a synonym for tool and starts naming something specific: the reusable method an agent reaches for when the work matches, and ignores the rest of the time.

Sources: Li et al., Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis (arXiv:2604.02837, 2026); Evaluation and Benchmarking of LLM Agents: A Survey (arXiv:2507.21504, 2025); Bakal, Knowledge Activation: AI Skills as the Institutional Knowledge Primitive for Agentic Software Development (arXiv:2603.14805, 2026); Agent Skills specification.