~100,000 AI papers a year. We read the ones about agent skills.

LEGO breaks the digital front-end chip-design flow — spec generation, RTL coding, testbench generation, simulation, debug — into six fixed steps and represents every reusable capability within those steps as a circuit skill : a seven-field unit (name, function, constraints, entry command, IO spec, schema, completion criteria) that any code agent can invoke like a subroutine. An automated three-stage pipeline builds the library from there — summarize capabilities, map to a workflow step, standardize the fields — mining more than 100 papers and 11 open-source EDA-agent projects (VerilogCoder, MAGE, Spec2RTL-Agent, AutoBench, the hierarchy-verilog line of work, RTLFixer, and others) down to 42 skills across 24 functional groups. A companion retrieval layer, Agent Skill RAG , skips embedding models entirely: it loads only short skill descriptions up front and pulls the full entry — symptom, root cause, fix — once a match is found, keeping lookup at sub-millisecond speed while letting new fixes get appended as plain text.

Agent Skills — the filesystem-based packaging format that lets agents load domain-specific instructions and bundled scripts on demand — has never had a systematic security audit until now. This one splits a skill's life into four phases: Creation, Distribution, Deployment, Execution. Each opens a different door: authors get unrestricted control over SKILL.md and its scripts, marketplaces distribute without review, and the access a user actually grants at install time runs broader than what they think they're agreeing to. From that lifecycle view comes a threat taxonomy of seven categories and seventeen concrete attack scenarios, grouped into three layers: delivery and trust establishment, runtime attack, and persistent/lateral impact.

A nineteen-institution team spanning Zhejiang University, Alibaba, Tencent, Ant Group, and UCLA built SkillNet , infrastructure that creates, grades, and connects agent skills at scale instead of just hosting them. Skills get pulled from execution trajectories, GitHub repositories, PDFs and slide decks, and raw natural-language prompts through an LLM-driven pipeline, then run through deduplication (directory-structure and MD5 comparison) plus rule-based and model-based filtering before landing in one of ten functional categories. The distinguishing piece is a three-layer skill ontology : a taxonomy of categories and tags, a relation graph linking individual skills via similar_to, compose_with, belong_to, and depend_on edges, and a package library for modular deployment. Skills here aren't vetted one at a time and left to sit — they're wired into a queryable network.

COLLEAGUE.SKILL turns raw traces of a person — chat logs, work documents, email, screenshots, public research material, subtitles, plus a lightweight description — into a skill package through person-grounded trace-to-skill distillation : not a simulation of the person, but a bounded, editable artifact extracted from them. Each package splits into two coordinated tracks: a capability track for practices, mental models, and decision heuristics, and a behavior track for communication style, interaction rules, and correction history. The output is five content files — a combined SKILL.md plus independently invokable work.md/persona.md and work_skill.md/persona_skill.md — wrapped in manifest.json and meta.json for install and lifecycle state, on schema version 3. It installs across four agent hosts (Claude Code, OpenClaw, Codex, Hermes) and ships three domain presets : colleague for private workplace material, celebrity/public-figure for public evidence under source boundaries, and relationship for personal traces under consent and local-control rules.

A skill loads in three strict stages, and that staging is the whole point. A SKILL.md file's YAML frontmatter — name and description, a few dozen tokens — sits in the system prompt from startup. The full instruction body loads only once a task actually triggers the skill, and bundled scripts or reference docs load only when those instructions call for them. This progressive disclosure pattern is why an agent can hold a library of thousands of skills without paying a context-window tax for the ones it never uses — and it's the real difference between a skill and an ordinary tool call. A tool executes and returns a result; a skill rewrites what the agent knows and is allowed to do before it responds at all. The survey frames skills and MCP as two halves of one stack, skills carrying procedural know-how and MCP carrying connectivity to external systems, then works through how skills actually get built. Some are hand-authored SKILL.md files. Others grow inside a reusable library through reinforcement learning during training rollouts, or get discovered on the fly by agents exploring software nobody wrote instructions for.

EffiSkill treats recurring slow-to-fast code rewrites as reusable agent skills instead of one-off prompts. Stage I mines Operator Skills (concrete transformation mechanics) and Meta Skills (diagnosis, retrieval, and composition logic) from 900 Python and 900 C++ slow/fast program pairs, compiling a portable skill library. Stage II applies that library to unseen programs through an execution-free pipeline: diagnose the bottleneck, retrieve matching skills, compose a plan, generate candidates — no compiling or running the program during inference.

Ling, Zhong, and Huang treat a live marketplace as a dataset, not a sample. All 40,285 publicly listed agent skill listings get pulled and measured — when they're published, what category they land in, how long they run, how much they're actually used, how similar they are to each other, and what actions they're allowed to take. The payoff is a corpus-scale baseline for what an agent skill ecosystem looks like in practice, not aspiration.

SkillTester is a comparative test harness for agent skills — the packaged, SKILL.md -based capabilities now shipped across Claude Code, OpenAI Codex, GitHub Copilot, and OpenClaw. Its core rule, what the paper calls the comparative utility principle , is simple to state and strict to enforce: every task runs twice, once with the skill disabled and once enabled, on the same model and environment, and a skill only earns credit if it's actually invoked. That gate stops a model's own baseline competence from getting credited to the skill. Utility tasks split into common functional cases — the skill's stated use — and edge cases covering failure handling; each has to resolve in both conditions with a documented pass criterion before it's admitted to the benchmark. Security gets scored separately, through a controlled security probe suite rather than paired execution, organized into three groups — abnormal behavior control, permission boundary, sensitive data protection — built on one premise: a skill's SKILL.md claims and safety badges are unverified assertions until tested against actual code and behavior.

Researchers built the first systematic census of healthcare-focused agent skills — self-contained instruction packages that an agent loads only once a task matches the skill's stated description, a pattern the spec calls progressive disclosure . Starting from 58,159 public skills on ClawHub (an April 2026 snapshot), the team used an LLM classifier to pull 557 healthcare-related skills, then had a second LLM read each skill's full SKILL.md file to annotate ten dimensions covering function, care-cycle stage, intended user, input modality, autonomy level , and clinical decision impact .

A fixed 24-check code-audit agent skill got stress-tested inside a production-derived auditing task, run through Codex with gpt-5.4-mini. The task and its verification checks stayed constant; only the surrounding context changed — a clean ~11,000-character run, a topically relevant ~299,000-character run, and an irrelevant ~299,000-character run padded to match. Ten runs per condition, and every failure was hand-classified into one of four buckets: a requirement dropping out of the active context, a requirement edited away mid-trajectory, a violation the agent noticed but never fixed, or a harness/evaluator failure unrelated to the agent.

This is a reanalysis, not a new experiment. It reuses a previously published 180-run study of an autonomous Capture-the-Flag agent — one grounded in the Model Context Protocol , so every tool call returns a schema-validated, low-latency observation — and reinterprets its four documentation conditions as a Skills ablation: a 591-token No-Skills baseline, a 12,865-token Experiential tier, a 17,253-token Curated tier, and a 36,001-token Comprehensive tier. Each tier ran against the same 15 challenges, three trials apiece, for 45 trials per condition. Read this way, the original study becomes exactly the controlled Skills-versus-no-Skills comparison that offensive-security benchmarks hadn't run before.

Most skill safety work checks prompts and runtime actions, never the skill artifact itself against its own description. Behavioral integrity verification (BIV) names that missing check: a typed comparison between what a skill declares and what it actually does, run over a shared capability taxonomy of 29 capability types spanning code, natural-language instructions, and metadata. The declared side comes from parsing manifests plus LLM-assisted extraction, constrained by a hallucination-control filter that requires a quoted source span for every claimed capability. The actual side comes from deterministic analysis — inter-procedural taint analysis for Python, regex extraction for JavaScript and shell — plus LLM parsing of natural-language instructions. Both sides land in the same typed taxonomy, producing one structured evidence record per skill that feeds three downstream jobs: a deviation taxonomy, a root-cause classifier, and a malicious-skill detector.

SkillCorpus turns the sprawling public SKILL.md ecosystem into one deployable, licence-clean corpus. A six-stage pipeline parses, deduplicates, and quality-scores roughly 821,000 crawled skill files down to 96,401 survivors: an exact-match tier collapses 169,465 duplicates outright, a semantic tier merges near-duplicates above a cosine-similarity threshold and sends borderline pairs to an LLM judge, and a final safety hard-gate plus OSI-licence filter removes skills flagged for prompt injection, command injection, unsafe execution, or an unclear licence. Every surviving skill gets one of 16 task-class labels and three independent quality scores — utility, robustness, and safety — instead of one blended number, and the corpus ships with a fine-tuned retrieval-and-selection stack : an embedding recall model, a reranker, and an LLM gate that reads each candidate's full body before injecting up to two skills into an agent's prompt.

SkillHarm treats an agent skill as a persistent artifact with a lifecycle, not a one-shot instruction set, and builds its benchmark on that framing instead of testing poisoned skills inside one task run. Two attack shapes anchor it: Fixed-Payload Poisoning , where a static poisoned skill package compromises every session that loads it, and Self-Mutating Poisoning , where a benign-looking run quietly rewrites the skill's saved content so the payload only fires on a later reuse. A taxonomy of 12 risk types sits around those two modes, grouped by what part of the agent workflow gets hit — data pipelines, system environment, agent autonomy — and an automated construction pipeline, AutoSkillHarm, generates attacks at scale using coding agents driven by natural-language harnesses rather than by hand. The result: 879 attack samples spread across 71 skills.

Memento-Skills flips who designs the agent: instead of a human hand-building a task-specific system, a generalist LLM builds and refines its own sub-agents through experience — an agent-designing agent . Capability lives in reusable skills : structured markdown files that serve as external, persistent memory, encoding both the behavior and the context it applies to. The agent starts from a small seed — web search, terminal operations — and grows the library from there. Growth runs on Read-Write Reflective Learning , a two-phase loop from a companion system, Memento 2. A read phase lets a trained skill router pick the most relevant skill for the current stateful prompt ; a write phase lets the agent update and expand its own library based on what just happened. None of it touches the base LLM's weights. Every bit of adaptation gets externalized into the skill files and prompts themselves.

SkCC treats SKILL.md as source code, not the final artifact. A syntax parser lowers the raw markdown into a typed abstract syntax tree; an IR builder then normalizes that tree into SkIR, a strongly-typed intermediate representation capturing a skill's procedures, permissions, input/output schemas, constraints, and MCP dependencies independent of any target framework. Before anything gets emitted, a static Security Optimizer runs four passes over the IR — structural validation, permission auditing, pattern-based injection of missing safety constraints like timeouts, loop bounds, and destructive-operation guards, and risk-tier classification. From there, four emitters render the same hardened IR differently per framework: Claude gets XML-tagged sections, Gemini switches to YAML once nesting passes a depth threshold, Kimi keeps full markdown, Codex gets XML-tagged markdown to dodge JSON's token overhead. Parsing and static analysis run once per skill no matter how many targets follow, which is why adaptation cost moves from O(m×n) — m skills times n frameworks, each pair hand-rewritten — to O(m+n).

Graph-of-Skills (GoS) builds a typed skill graph offline over a local skill library, linking skills through four edge types: dependency, workflow, semantic, and alternative. Dependency edges come free — induced deterministically from I/O schema overlap between skills, no LLM involved — while the other three relation types are filled in by a sparse, top-k LLM validation pass rather than an exhaustive pairwise check. At query time, GoS blends semantic and lexical retrieval scores to seed the graph, then runs a reverse-aware Personalized PageRank diffusion so upstream prerequisites — a parser here, a format converter there — accumulate relevance even when they share no vocabulary with the query. A final rerank-and-hydrate step packs the top-scoring skills into a token-budgeted bundle.

Trace2Skill turns a pile of raw agent execution traces into one consolidated skill file, not a growing memory store, not an order-dependent chain of edits. A frozen agent runs a batch of tasks first and produces labeled trajectories, successes and failures both. Failures go to an interactive error analyst that inspects the actual output artifacts, checks them against ground truth, and validates a candidate fix before writing a patch; successes go to a lighter single-pass analyst that pulls out reusable behavior patterns. A hierarchical merge step then folds every patch in the pool together at once — deduplicating, resolving conflicts, keeping only what recurs across independently analyzed trajectories — into one updated skill document. The same model generates the trajectories, analyzes them, and merges the result, so there's no separate teacher model, no fine-tuning, no test-time retrieval. The pipeline runs in two modes: deepening an existing human-written skill, and building one from scratch out of a weak LLM-drafted seed, across spreadsheet editing, math reasoning, document QA, and office-file tasks.

SkillX turns an agent's raw trajectories into a three-tier skill knowledge base : strategic plans that sequence a task end to end, functional skills that package a tool-based subroutine, and atomic skills that encode a single tool call's constraints. Two automated passes then work the library. An iterative skill refinement loop merges near-duplicate skills and screens survivors through a general quality check plus a tool-schema check. An exploratory skill expansion step targets tools the agent under-uses or keeps failing on, generating and validating new skills to close the gap. Everything runs off a single backbone, GLM-4.6, with each training task rolled out four times, on small seed sets of 50 to 90 training tasks per benchmark, and no human editing in the loop.

Coding agents install third-party agent skills from open marketplaces with no mandatory security review, and because those skills run as operational directives with system-level privileges — file writes, shell commands, network calls — a single bad one can compromise the host outright. Document-Driven Implicit Payload Execution ( DDIPE ) is a supply-chain attack that skips the obvious move of writing malicious instructions into a skill's prompt text, and instead embeds the payload inside the skill's code examples and configuration templates — the parts of a skill an agent reuses verbatim while doing normal work, so the attack fires without ever being explicitly asked for. An LLM-driven generation pipeline scaled this from 81 hand-built seed skills to 1,070 adversarial variants spanning 15 MITRE ATT&CK categories, roughly a 13x expansion, then ran them against four production coding-agent frameworks — Claude Code, OpenHands, Codex, and Gemini CLI — across five underlying models.

MLLM-based GUI agents that plan step-by-step from screenshots run out of usable knowledge once a task stretches across many steps and several apps. The fix: a Hierarchical Multimodal Skills (HMS) module that abstracts recorded trajectories into three tiers — execution skills (a literal recorded action sequence for one concrete goal), core skills (a parameterized function distilled from several similar execution skills), and meta skills (a further roll-up of core skills into a broad, reusable capability). Paired with HMS is Skill-Augmented Monte Carlo Tree Search (SA-MCTS), which uses the offline-learned hierarchy to prune the action space an online tree search has to explore, then writes newly discovered successful trajectories back into HMS so the library keeps growing after deployment instead of freezing at training time.

SkillOS splits the self-evolving agent into two roles: a frozen executor that solves tasks and retrieves skills via BM25 retrieval , and a separately trained curator that edits an external SkillRepo of skills stored as Markdown files (the same SKILL.md format Anthropic uses). The curator issues insert/update/delete function calls after every task, but training doesn't grade each edit in isolation — training instances are groups of related tasks, so a skill written after task 1 gets its verdict from whether it actually helps solve tasks 2 through N in that same group. A composite reward (future task success, function-call validity, an LLM-judged content-quality score, and a compression term penalizing verbatim trajectory copying) trains the curator with GRPO while the executor stays frozen.

Clawdrain is a trojanized OpenClaw skill that hides a multi-turn "Segmented Verification Protocol" (SVP) inside its SKILL.md instructions. Before it hands back a simple BBC-headline lookup, the skill demands a growing, comma-separated "calibration sequence" — and a companion script grades every submission PROGRESS, REPAIR, or TERMINAL. REPAIR forces a retry of the same step, so the exchange stretches into extra tool calls that get replayed back into context on every subsequent turn.

Most agent-skill generation pipelines get the order backwards: a model plans a solution before it ever touches the environment, and that plan becomes the skill. That's the wrong sequence — a skill is only as trustworthy as the evidence behind it, and a pre-execution plan encodes untested assumptions, not verified facts. The Posterior Distillation Index (PDI) is the fix: a trajectory-level score, a z-scored and equally-weighted combination, that rewards execution grounding and penalizes plan copying and "memo ossification" — belief stagnation across repeated attempts. Generating the trajectories PDI scores runs through SPARK (Structured Pipelines for Autonomous Runnable tasKs and sKill generation): a teacher agent repeatedly attempts a task inside a Dockerized environment, keeps a running exploration memo, and distills the successful run into a SKILL.md file. PDI isn't only a post-hoc grade — a memo-based proxy of it also intervenes online, during exploration, before a weak skill ever gets written.

Agent skills now have a formal definition: a skill is the tuple S = (M, R, C) — a root instruction document M, a set of auxiliary resources R (references, templates, scripts), and applicability conditions C that govern when the skill gets retrieved and used. The point of formalizing it is closing the procedural gap — giving an agent a tool through an API or the Model Context Protocol tells it what it can do, not when to do it, how to sequence it with other capabilities, or how to judge whether the result succeeded. Literature tracked from April 2023 to April 2026 sorts into four lifecycle stages — representation, skill acquisition , skill retrieval and selection, and skill evolution — spanning eight application domains, from software engineering and web/GUI automation to robotics, finance, healthcare, and social simulation.

SkillGenBench splits the skill lifecycle in two and scores only the first half: not whether an agent can use a skill, but whether a pipeline can generate one. A generator sees only raw source material — a pinned code-repository snapshot or a long-form document bundle — and has to produce a standalone SKILL.md package. A separate, fixed executor (MiniMax-2.5) then runs that package against hidden, deterministic test cases, so generation quality is measured apart from prompting skill or task planning. The benchmark crosses two source types — repository-grounded, where the procedure is scattered across code, config, and scripts, and document-grounded, where it's explicit but spread across a manual or spec — with two regimes: task-conditioned generation, where the task is revealed before the skill is written, and task-agnostic generation , where a reusable skill library has to be distilled before any task is known. The 187 accepted tasks went through a five-stage pipeline — knowledge-graph extraction, scenario generation, test-case generation, a difficulty filter that throws out anything solvable without the corpus or trivially solvable with it, and reference-skill verification — plus human review. Five generation methods, from naive prompting to workflow-based and self-evolving pipelines, each paired with six backbone models — Claude Sonnet 4.5, GPT-5, Kimi K2.5, GLM-5, MiniMax-M2.7, and Qwen3.6-Plus — and scored on pass@3 .

Notes2Skills runs lab notebooks through two stages before any of it reaches an agent. Stage 1, epistemic directive extraction (EDE), scans free-text notes and tags each statement as FACT, JUDGMENT, or SUGGESTION, then sorts it into one of five directive types: flag data for review, note a condition change, suggest an analysis step, revise a protocol, or adjust a parameter. Stage 2, MetaSkill compilation , turns those labeled directives into agent-loadable Markdown skills, where each one keeps its certainty tag plus a SHA-256 hash pointing back to the exact source excerpt. They validated the pipeline against 461 hand-annotated segments across three corpora — informal free-form lab notes on one end, formal wet-lab protocols on the other.

Researchers crawled 238,180 unique agent skills from ClawHub, Skills.sh, SkillDirectory, and GitHub — the largest cross-platform census of the skill ecosystem so far. Every skill passed through three lenses: each marketplace's own scanner, an independent Cisco skill scanner, and the authors' own LLM-based classifier. For skills flagged high-risk by both an external scanner and their model, the team went a step further and checked the skill against the GitHub repository it actually ships from — README, code, commit history — rather than judging the SKILL.md file in isolation.

SkillsMP, the largest open-source Agent Skills marketplace, supplied a corpus of 264,937 normalized skill packages out of 273,657 catalog entries, each split into three layers: metadata (name, description, tags), instructions (the SKILL.md procedural text), and resources (scripts, configs, dependencies). Divergence between what the metadata claims and what the instructions and resources actually do — cross-layer misalignment — is what PL-HCL (Progressive Loading-Aware Hierarchical Contrastive Learning) is built to catch before a skill ever runs. Training mirrors how a skill actually loads: first continued pretraining on metadata plus instructions alone, then on full packages including resources. On top of that sits a contrastive learning stage, trained against two kinds of synthetic negatives per skill — swapping in another skill's metadata, and perturbing the skill's own metadata — while the true metadata-instructions-resources triple stands as the positive example the model learns to recognize as consistent.

LatentSkill replaces the standard approach of stuffing a skill's text into the prompt at every decision step with a hypernetwork that compiles the skill document directly into weights. Given the skill's text, the hypernetwork runs one forward pass and emits a skill-specific LoRA adapter — a low-rank update mounted onto a frozen Qwen3-8B backbone — so the model conditions on task history alone, with no per-step skill tokens sitting in context. It's pretrained on 171,000 deduplicated GitHub skill documents (roughly 300 million tokens), then fine-tuned with trajectory-supervised learning against teacher agent runs on ALFWorld and a multi-dataset Search-QA suite. Every result is measured against two baselines: a vanilla agent with no skill access, and an in-context skill agent that inserts the identical skill text into the prompt at each step.

This survey traces how agent skills — packaged, reusable procedures that let LLM agents execute domain tasks — move from one-off authoring to systematic evaluation and revision. Skill-improvement methods sort into four paradigms: execution feedback (single-run signals, where systems like SkillForge and CoEvoSkills compare executed behavior against a reference and separate failure diagnosis from rewriting), trajectory distillation (patterns pulled from many runs, as in SPARK and Trace2Skill), library-level compression that merges or prunes redundant skills, and reinforcement learning that scores skill value against task-level reward. The same survey catalogs six families of skill-centric benchmarks — utility, generation, retrieval and routing , safety auditing, software engineering, and real-world deployment — noting what each one measures and how large it is.

An agentic skill, formalized here as a four-part contract S = (C, π, T, R), needs all four pieces to count: an applicability condition that decides when it fires, an executable policy, a termination condition, and a callable interface. That's what separates a skill from a raw tool call (no reuse contract), a one-off plan (no persistence), or stored memory (no execution policy) — three things builders already reach for and easily mistake for skills. The definition anchors a lifecycle — discovery, practice, distillation, storage, composition, evaluation, update — plus two taxonomies for what's already shipping. Seven system-level design patterns cover how skills get packaged and run, from metadata-first progressive disclosure and executable code skills through workflow-enforcing gates, self-evolving skill libraries , hybrid natural-language-plus-code macros, meta-skills, and marketplace-distributed plugins. A second, orthogonal grid crosses representation (natural language, code, policy, hybrid) against operating scope (web, OS, software engineering, robotics).

SelSkill treats every point where an agent could call an agent skill as a binary decision — invoke or skip — instead of assuming relevance implies use. It flags candidate decision points with predictive entropy (how uncertain the model is about its next token), then forks the trajectory at that exact prefix into two rollouts: one calls the skill, one doesn't. Both run to completion and get labeled by outcome and step-efficiency — success beats failure, and between two successes the shorter one wins. Those local invoke/skip pairs get combined with whole-trajectory, episode-level preferences (successful runs vs. failed ones) and trained jointly with Direct Preference Optimization (DPO). The loss is masked to just the few assistant turns right after each branch, so the gradient targets the invocation decision itself, not the whole trajectory.

Researchers built the first large-scale audit of credential leakage across a live agent-skill marketplace. Starting from 170,226 artifacts on SkillsMP, they drew a stratified random sample of 17,022 skills and ran each through a three-stage pipeline: static secret extraction using regex and AST parsing , dynamic sandbox testing seeded with mock credentials, and a cross-reference step that checks whether a skill's stated natural-language purpose matches what its code actually does at runtime. That last step is the paper's structural bet: credential handling in an agent skill isn't just a code-review problem, because the thing an LLM trusts (the description) and the thing that executes (the code) can diverge, and neither view alone catches the gap.

LLM agents that keep a library of reusable skills eventually run into a problem invisible at the single-skill level: skills get added, patched, reused in new contexts, and wired to shifting dependencies until the library itself degrades. Call it skill technical debt — library-level defects (near-duplicate skills, stale interfaces, missing validators, broken dependency chains) that don't break any one skill locally but quietly corrode future retrieval, composition, and execution. SkillOps is the maintenance layer built to catch it, and it's method-agnostic: every skill gets formalized as a typed Skill Contract — preconditions, operation, output artifacts, validators, known failure modes — and the whole library sits inside a Hierarchical Skill Ecosystem Graph with typed edges for dependency, compatibility, redundancy, and alternative relations. A five-dimension health scan (utility, redundancy, compatibility, failure-risk, validation-gap) drives six typed repair actions — merge, repair, retire, add_validator, add_adapter, instantiate — turning a raw library into a maintained one that any existing retrieval or planning agent can use unchanged.

SkillAudit evolves an agent skill with no labeled outcomes to train against. The core mechanism, paired trajectory auditing , runs the same task twice per iteration — once with the candidate skill injected, once without — and treats whatever diverges between those two runs as the entire training signal. Twelve evaluators, bundled under the name Process-Aligned Contrastive Evaluation (PACE), read that divergence along four axes: procedural adherence, artifact correctness, format consistency, and where the skill measurably helped. Each verdict cites a specific passage in the skill document, quoting it directly rather than gesturing at it. A separate, frozen structural verifier — compiled once from the task spec and never touched again — checks hard constraints like file existence and format compliance, and can veto or roll back an edit that makes things worse. From there, edits split into two modes: Refine strips noise from a skill that's already broadly working; Repair replaces passages that actively fight what the task needs.

SkillFlow trains a single orchestrator (a "Supervisor" that calls a frozen executor and a growing library of reusable skills) with Tempered Trajectory Balance (TTB), a regression-style flow-matching loss borrowed from GFlowNets in place of a REINFORCE-style policy gradient. TTB pushes each trajectory's sampling probability toward being proportional to its reward, rather than collapsing onto one dominant path, so multiple distinct winning strategies survive under the same loss. Training TTB also produces a backward policy for free: it re-scores each action once execution feedback is known, giving per-step credit assignment at no extra inference cost. Two by-products fall out of this. A training-residual signal flags when the current skill library is capping performance, and a per-step flow signal shows where credit actually belongs. Together they drive an automatic curation loop that keeps, refines, or prunes skills, and mines new ones from matched success/failure trajectory pairs on the same query.

SkillEvolBench tests something more specific than whether skills help an agent — whether an agent can turn its own one-off experience into a skill worth keeping. The benchmark spans 180 tasks across six real-world environments: code debugging, tool and API orchestration, data processing, document parsing, research synthesis, and communication/scheduling. Tasks are grouped into families that separate acquisition roles — canonical, enriched, variant — from three frozen deployment roles built to stress a skill after the fact: context shift, adversarial shortcuts, and skill composition . Agents write to and revise an external skill library during acquisition under outcome- and process-based verifier feedback ; the library is then frozen before deployment tasks run, so nothing learned during evaluation can leak back into the skill being tested. Ten model configurations across three agent harnesses — Claude Code, Codex CLI, Gemini CLI — run self-generated and curated skill-writing policies against no-skill and raw- episodic-trajectory replay controls.

This survey audits 124 papers on agent skill systems published between 2023 and 2026 (2 from 2023, 19 from 2025, 103 from 2026, cutoff May 31, 2026) and builds three shared tools for comparing them. A six-sense taxonomy splits what papers loosely call a "skill" into six structurally different artifacts — executable code, natural-language instructions, SKILL.md-style packages, learned adapters, memory traces, and capability labels — each with its own edit and verification behavior. An eight-stage lifecycle architecture (evidence acquisition, proposal, verification/admission, storage, retrieval/composition, maintenance, distillation, governance) maps the design decisions that recur across systems. A ten-operator vocabulary — Add, Refine, Merge, Split, Prune, Distill, Abstract, Compose, Rewrite, Rerank — gives those changes a common language, instead of treating each update mechanism a paper introduces as a novel method in its own right.

Agent Skills packs — the folder-based standard for handing an agent on-demand expertise — expose only a short description until a task matches it, then load an indexed body, then the specific passages: that's progressive disclosure . The first controlled test of the idea pits raw-document navigation against flat and hierarchical skill-pack designs, plus a classical hybrid retriever, across three agent harnesses (Codex, Pi, Claude-Code) and three model families. The benchmark itself is new: LoongDoc turns the ∞Bench long-document set into a live environment where agents navigate a sandboxed file system instead of a fixed context window , testing single books and libraries of 5, 10, and 20 books stitched together.

The pipeline mines open-source agentic repositories in three stages: structural analysis of a repo's layout, dense retrieval to find reusable procedural capabilities buried in the code, and translation of what it finds into the standardized SKILL.md format . Run against two Manim-based educational video generators — TheoremExplainAgent's planner-coder pair and Code2Video's three-agent planner-coder-critic setup — it produces two working skills: a theorem-walkthrough animator and a visual-layout critic. Neither ships without clearing a four-gate check first: static code analysis, semantic prompt injection screening, sandboxed behavioral testing, and permission validation against an allowed-tools manifest.

RATs (Robotics Agent Teams) gives a robot a practice stage before it's ever handed a task — a multi-agent Code-as-Policy system built around three coordinating roles. A task proposer invents exploratory goals, an execution team writes and runs candidate robot code with step-level verification and retry-on-failure, and a memory team distills what worked into a persistent skill library . Task selection isn't random: a "Goldilocks" score multiplies novelty (how rarely a given object-skill pairing has been attempted) by learnability (how close the agent's current success rate on that skill sits to 50%), pushing practice toward the edge of what the agent can already half-do. It's intrinsic motivation from developmental psychology, rebuilt as a computable scoring function instead of a vague heuristic.

General-purpose computer-use agents train on demonstrations from roughly 100 digital environments, then get thrown at whatever unfamiliar interface a real task requires — and the skills don't transfer. OSExpert's fix is to have the agent explore before it's ever asked to perform. A GUI-DFS (depth-first search) procedure pushes candidate UI targets onto a stack, resets the environment, replays the action sequence needed to reach each one, and coordinates three modules — planner, action executor, feedback classifier — to expand, terminate, or retry each branch. Any state the feedback module marks terminal becomes a verified unit-function skill with a short usage description; the agent then chains unit skills into composite tasks and folds those in too. A separate database of fine-grained action primitives — calling an external segmentation tool, extracting boundary coordinates, clicking a sequence of points along an object's contour — gets pulled in whenever the feedback module flags an error needing pixel-level precision, and a primitive only survives if it succeeds under verification. Once exploration wraps, a LoRA-tuned lightweight model trained on the resulting plan-skill pairs serves as a fast planner , producing a full plan in one forward pass instead of re-planning at every step, and a skill-boundary check lets the agent recognize tasks resembling past repeated failures and bail early instead of burning its inference-time-scaling budget.

The team built one reusable skill file per stage of a data-science agent's workflow — data preparation, data extraction, statistical analysis, and reporting — generating each with Gemini 2.5 Pro and shipping it unedited, mirroring how a low-curation skill pipeline actually gets used. Each skill split into four parts: routing triggers, a core procedure, worked examples, and reference notes. Rather than testing skills as a single on/off switch, they ran a component ablation : five conditions from no-skill up to the full four-part file, plus a token-matched control of irrelevant office-supply text padded to the same length, and a variant instructing the model to prioritize task instructions over skill guidance. Nine model configurations across OpenAI, Google, and Anthropic — spanning compact, frontier, and explicit-reasoning tiers — ran three times each over 56 deterministically verified tasks, yielding 7,560 runs in the main ablation and 10,584 runs total with the supplemental controls.

A regex scanner can read a skill's code but not the English prose in its SKILL.md — exactly where prompt injection and social-engineering instructions like to hide. Formal static analyzers read code more rigorously and still can't parse prose. SkillSieve's answer isn't a smarter single scanner; it's three escalating layers, each one filtering for the next. Layer 1 is a zero-cost static analysis pass — regex, AST parsing, metadata heuristics — that clears roughly 86% of skills in under 40ms apiece. What's left goes to Layer 2, an LLM that splits judgment into four parallel sub-checks (intent alignment, permission justification, covert-behavior detection, cross-file consistency) rather than one monolithic prompt. Skills that still look risky hit Layer 3: a multi-model jury — GLM-5.1, Qwen3-235B, DeepSeek-V3.1 — that votes independently and only debates when the votes split. The full pipeline ran end to end on a single $440 ARM single-board computer against 49,592 real skills pulled from OpenClaw's ClawHub registry (a 2026-04-04 snapshot spanning 16,797 authors), plus adversarial samples built around five evasion techniques.

MLLM agents doing 3D spatial reasoning — object counting, distance estimation, route planning — call on external tools for detection, depth estimation, and 3D reconstruction. But they default to the same one or two tools no matter what the scene needs. Ask an "object-to-object distance" question and the agent answers from reconstruction evidence that encodes relative position, not the depth grounding the question actually requires. Skill-3D fixes the mismatch with memory instead of a bigger model. Every completed tool-use trajectory gets logged into a Scene Memory , successful trajectories from similar scenes distill into reusable "skills" — a trigger condition, required evidence, tool order, argument template — and failed trajectories don't get discarded; they attach to the nearest skill as lessons. Skills come in two flavors: static ones fixed as task-level priors, and dynamic ones that keep merging new successful variants and absorbing failure-driven fallback rules. The Skill Library and the Scene Memory keep refining each other as trajectories accumulate. At inference, the agent retrieves a compact slate of candidate skills by scene signature and evidence type, then a policy narrows that down to what it will actually use — before it touches a single tool.

SKILL.md files — the natural-language front matter that tells an agent when and how to use a packaged capability — sit upstream of three separate decisions: whether a skill gets found, whether it beats a rival for selection, and whether it clears a security check. Researchers tested all three against real skills pulled from ClawHub , a live agent-skill registry, drawing on 100 skills across five categories (email, travel, tax, health, prompt). Discovery got the beam-search-and-gradient treatment: short adversarial trigger phrases, appended to the SKILL.md text, tested whether embedding-based retrieval could be steered toward a skill without touching a line of its code. Selection worked differently — functionally identical skill pairs, differing only in how the description was framed (exaggerated capability claims, directive language, recency signals, trust claims), put in front of four LLM agents asked to pick one. Governance was the toughest test: a three-stage vetting pipeline — a static scanner, an LLM reviewer, a VirusTotal malware pass — run against admittedly malicious skills rewritten with wording-only evasion tactics like paraphrasing and context-window overflow .

Every agent skill is two artifacts stapled together: a structured half that declares callable actions, and a prose half that tells the agent when to fire them — prose that gets reinterpreted fresh, probabilistically, on every invocation. Static analyzers parse the structured half and ignore the prose; LLM-based auditors read the prose but can't reproducibly prove a tainted input reaches a dangerous sink. Semia lifts each skill into the Skill Description Language (SDL) — a Datalog fact base capturing triggers, data flow, authorization gates, and documented claims. It generates that fact base through Constraint-Guided Representation Synthesis (CGRS), a propose-validate-verbalize loop that keeps refining a candidate until it's both structurally sound and faithful to the source text. Once the facts exist, checks for indirect prompt injection , secret leakage, or a confused deputy become plain Datalog reachability queries.

MUSE-Autoskill wraps an LLM agent in a five-stage skill lifecycle — creation, memory, management, evaluation, refinement — instead of treating each skill as a one-off script. New skills are built through a create tool that emits a SKILL.md interface file plus optional scripts, resources, and unit tests; code-backed skills are graded on their own tests, while procedural ones go through sandboxed execution and trajectory checks. Every skill also carries a skill-level memory file where the agent appends lessons from past use, alongside short-term task memory and persistent cross-session notes; long conversations stay within budget through a DAG-based context compression scheme that summarizes or merges old turns rather than discarding them outright. A management stage periodically merges overlapping skills and prunes ones that keep failing. That setup gets evaluated across three agent runtimes — Hermes, Codex, and Claude Code — on SkillsBench (75 tasks across four domains, 5 runs each) and SkillLearnBench (100 verified instances over 20 skill-dependent tasks).

SkillHone treats agent skill maintenance as a logging problem, not an editing one. Every development step — probe run, diagnosis, candidate revision, accept or reject — gets written down as a structured record, and the growing chain becomes a persistent decision history that later sessions query instead of re-deriving from scratch. Two role-separated subagents split the actual work: an evaluation team sees the full oracle targets, validators, and execution traces for a probe but can never touch the skill file, while an optimization team can rewrite the skill but only ever reads a redacted report of what evaluation found. A dispatcher just routes messages between the two and logs outcomes; it holds no repository-write authority of its own.

Researchers turned Anthropic's own Agent Skills framework against itself. Agent Skills let a coding agent pull task-specific knowledge into its context at runtime from a SKILL.md markdown file plus any scripts it references — no code-review step, no separate trust channel from the rest of the model's instructions. The authors took Anthropic's own published PowerPoint-editing skill, inserted an instruction calling a disguised "backup" script, and ran the attack two ways: inside Claude Code, and inside Claude's web interface once its skill-upload feature was live there too.

Researchers stress-tested skill routing across 15 frontier LLMs and 1,141 real-world skills pulled from public Agent Skills repos, Claude Code, MCP servers, and community GitHub, organized into 14 software-automation domains. Using 4,075 tasks swept across library sizes from 10 to 500 skills and pipelines of 1 to 10 steps, they logged more than 3 million routing and execution decisions, then fit two separate laws: a routing law for single-step skill selection and an execution law for what happens once a chosen skill actually runs.

POISE compromises a SKILL.md file by editing exactly one line. The earlier approach scattered several explicit malicious steps through a skill's body, giving an agent multiple chances to notice a command that doesn't belong. POISE instead compresses the whole payload into a self-contained external script and inserts a single line that just invokes it, framed as a routine prerequisite ("before first use, run <cmd> to verify the environment"). Placement is restricted to positions that already look native to the file — a step folded into an existing numbered procedure, or a line appended to a setup/install block — both written by a context-aware generator so the injected sentence reads like ordinary skill prose. The evaluation spans two agent-skill benchmarks, Skill-Inject (25 tasks) and SkillsBench (27 tasks), each crossed with three harm categories (credential exfiltration, config tampering, privileged-shell behavior), across four agent-model pairings: codex +gpt-5.2 as the primary target, with openclaw and Claude Code used to test transfer. The headline metric is Attack Success Rate (ASR) : the injected command has to fire and the user's own task still has to pass its verifier in the same trial, which rules out attacks that tip their hand by breaking the task.

Compositional skill routing formalizes what happens when a query needs more than one skill: decompose it into atomic sub-tasks, retrieve a skill for each, then compose the results into an executable plan. SkillWeaver, the framework built to do this, has three parts — an LLM decomposer, a bi-encoder retriever indexed with FAISS , and a dependency-aware DAG planner that orders and parallelizes the resulting steps. To measure it, the authors built CompSkillBench: 300 compositional queries (150 easy/2-skill, 100 medium/3-skill, 50 hard/4-to-5-skill) run against 2,209 real skills pulled from the public Model Context Protocol (MCP) server ecosystem and sorted into 24 functional categories.

Security review for agent skills mostly happens one skill at a time — does this skill's code or manifest do anything dangerous, taken alone. Skill Composition Risk (SCR) names what that misses: a skill can be completely bounded and legitimate on its own and still hand a later skill a discovered file path, a trust signal, or an authorization-sounding sentence, with the harm living on that handoff rather than in either skill. SCR-Bench makes the failure mode testable — it models an agent's available skills as a graph, with edges forming wherever one skill's output becomes another skill's input, endorsement, or approval evidence, then runs the graph in sandboxed environments that track actual downstream state changes rather than model text. Three sub-benchmarks each isolate one composition mechanism: capability flow , where an upstream discovery skill hands a downstream execution skill a concrete target; trust transfer , where an upstream review-style skill's endorsement legitimizes a risky downstream install; and authorization confusion , where advisory language from one skill gets read as approval by another. Each runs matched control, isolated, and composed conditions across up to ten current model backends — GPT-5.5, GPT-5.4, Claude Opus 4.6 and 4.5, Gemini 3.1 Pro Preview, MiniMax-M2.7, DeepSeek-V4, Kimi-K2, GLM-5.1, and GLM-5.

Cramming every skill's SKILL.md into context stops scaling long before a library gets large: context budgets fill up, and the calling model gets measurably worse at picking the right entry out of the pile. Skill Retrieval Augmentation (SRA) splits that into three separable stages instead of one context-stuffing problem — retrieve candidates from a large external corpus, decide which of them actually make it into the active context ( skill incorporation ), then apply whatever got loaded to solve the task — and SRA-Bench grades each stage on its own rather than scoring pass/fail on the end result. The benchmark draws 5,400 test instances from six existing datasets spanning theorem proving, formal logic, tool-use QA, medical calculation, competition math, and code generation, each hand-annotated against one or more of 636 gold skills. Those gold skills sit buried inside 25,626 web-scraped distractor skills, producing a 26,262-entry corpus where only 2.4% of anything is actually relevant to a given query. Eight models — six open-weight (Qwen3-4B/32B/235B, Llama-3.1-8B, Llama-3.3-70B, Mistral-Small-3.1-24B) plus frontier GLM-5.1 and GPT-5.4 — ran across BM25, dense, and reranking retrieval, and three skill-use strategies: full injection of the single top-ranked result, LLM-driven selection from a top-50 shortlist, and an OpenClaw-style progressive disclosure setup where the agent pulls full skill content on demand instead of all at once.

FORTIS treats the skill layer — the abstraction that routes a request to a specific skill and then to specific tools — as a privilege boundary , not an organizational nicety. It scores two things separately: whether a model picks the minimally sufficient skill from an overlapping library (Task 1, 600 queries), and whether it then executes that skill without escalating into tools broader than it's permitted (Task 2, 1,543 queries). The benchmark spans three domains — email, e-commerce, filesystem operations — built from 60 skills and 174 tools across a five-level privilege hierarchy, from observation-only (L0) to bulk administrative control (L4). Ten frontier models go through it, among them GPT-5.5, GPT-5.4, Claude Opus 4.7, Claude Sonnet 4.6, Gemini 3.1-Pro, Gemini 3 Flash, Qwen 3.6-Max, Kimi K2.6, and DeepSeek-V4-Flash, under both clean requests and everyday ambiguous phrasing. Nothing adversarial.

MMG2Skill formalizes guide-to-skill learning : turning human-written how-tos scraped off the web — app tutorials, wiki recipes, strategy guides — into procedures a vision-language model (VLM) agent can actually execute. MMG2Skill-Bench backs the idea with 130 success-inferable tasks spread across three domains: OSWorld-style desktop GUI control (40 tasks), Minecraft crafting and building (30 tasks), and the card games Doudizhu and Mahjong via RLCard (60 tasks), each one paired with a real multimodal guide pulled from the wild. The framework itself runs as a closed loop with four stages — compile the guide into an editable SKILL.md (procedures, when they apply, what success looks like, how to recover from failure), run a fixed VLM agent conditioned on that skill file, read the resulting trajectories for root-cause diagnoses, and rewrite the skill accordingly — all without ever touching a benchmark score.

Agent skills aren't just documentation anymore — they're bundles of instructions, scripts, and tool bindings that can steer an agent's reasoning before any tool executes, then trigger real side effects once one does. Most defenses cover only one side of that: scanning a skill's files before install, or gating individual tool calls at runtime. Nothing connects what a skill declares it needs to what it actually does once running. SkillGuard closes that gap with a skill manifest — a JSON schema declaring the resources a skill needs — checked against a runtime permission layer that intercepts every tool call and enforces deny-by-default on anything undeclared. High-stakes actions get escalated to the user for approval. Underneath sits a taxonomy of eight resource groups — storage, code repository, network, execution, hardware, system, secrets, agent ecosystem — broken into 41 distinct labels such as READ_FILE and WRITE_FILE, built on the classical least privilege and complete-mediation principles that systems like Android's permission model already lean on. Testing whether that taxonomy actually covers what real skills do meant checking it against 1,260 skills mined across 63 categories on the SkillsMP marketplace — the top 10 by star count plus 10 random picks per category — with every observed action mapped onto it.

SkillJuror isolates Skill organization as a variable independent of content — a distinction most Agent Skill benchmarks conflate. It starts from a shared source Skill bundle and builds two knowledge-matched variants: a flattened Baseline that keeps every command, threshold, and helper contract in one file, and a Progressive Disclosure (PD) version that reorganizes the same content behind a short root SKILL.md pointing to on-demand references. A three-tier construction audit — deterministic file and path gating, an LLM rubric check across 968 items, and human adjudication on the 3 that failed — confirms the pair differs only in layout, not in task knowledge. Both variants then run through the same Codex/GPT-5.4 harness across 82 SkillsBench tasks, five trials per condition, 1,230 trials total, with every trajectory logged for downstream analysis.

SkillMAS couples two adaptation loops that agent frameworks usually run separately: skill evolution (refining a library of reusable procedures) and MAS restructuring (changing which executor handles what). Both loops draw on the same evidence surface — verified execution traces — rather than retrieval frequency. Utility Learning credits only skills and executors that were actually exercised in a verified trace, not ones merely pulled into context, and tracks a separate Executor Utility signal per team member. Skill edits stay bounded: clean successes turn into reusable motifs, failures enter a patch pool only when analysis isolates one dominant editable cause, and proposals get deduplicated and pruned instead of piling up. Restructuring is evidence-gated too — it fires only when retained failures and Executor Utility point to a genuine organizational mismatch, capped at one edit per round. Testing spans ALFWorld (embodied manipulation), the OS task from Lifelong Agent Bench (command-line execution), and τ-Bench (retail workflows).

SAGE trains an LLM agent to build and reuse a library of executable skills by extending GRPO (Group Relative Policy Optimization) with two additions. Sequential Rollout chains two similar tasks from the same scenario into a single rollout, so skills the agent writes while solving the first task are still sitting in its skill library when it tackles the second — letting the reward signal from successful reuse flow back to the skill-writing step. A Skill-integrated Reward then stacks bonus credit on top of the normal pass/fail outcome reward — one bonus when a generated skill actually gets used by the next task, another when a task successfully reuses an earlier one. The agent writes in a DynaSaur -style unified format — a callable function it writes and immediately invokes, rather than calling raw APIs directly — so skill creation and task-solving happen in the same step, not as a separate post-hoc phase.

Retrieval for agent skill libraries has been treated as a search problem: find the k most relevant skills and hand them to the agent. GoSkills treats it as a presentation problem instead. It builds anchor-centered skill groups offline from a typed skill graph — clusters of at most three skills carrying explicit roles like prerequisite, formatter, or checker. At query time it picks an anchor group, pulls in supporting groups through a separate group graph , caps the result to a bounded set of atomic skill payloads, and renders everything into a fixed four-field execution contract : Start, Support, Check, Avoid. Nothing about the downstream agent, the skill payload format, or the execution environment has to change — GoSkills sits in front of an existing library rather than replacing it.

SkillCoach splits agentic skill-use into four dimensions scored separately — skill selection, skill following, skill composition , and skill-grounded reflection — pulled from real agent rollouts instead of fixed up front. Each task gets its own self-evolving rubric : a first draft built from the gold skill's steps, then reworked across rounds of judging real trajectories, proposing local patches, and keeping only the ones that clear a validation gate on held-out data. That rubric score runs alongside the task's external pass/fail verifier, never inside it — a trajectory that stumbles into the right answer gets scored differently from one that followed the skill as written. To stress-test selection, agents face a distractor-augmented skill library : gold skills buried among overlapping, superficially similar decoys meant to mimic a crowded enterprise repository.

An automated pipeline turns any agent skill into a battery of executable tests. It reads the skill's content, provisions whatever the task needs — CLI tools, credentials, a specific runtime — drafts a realistic task description, and writes two hidden scoring rubrics, then runs a validation pass to confirm the task doesn't leak its own answer. Applied to 500 real-world skills pulled from public registries and sourced from roughly 100 organizations, including Anthropic, Google, ElevenLabs, and Shopify, the pipeline generated about 1,000 tasks. Each one was solved twice — once with the skill available, once without — across 19 proprietary and open-source model configurations spanning Claude, GPT, Gemini, GLM, DeepSeek, Kimi, MiniMax, Qwen, and Nemotron. That produced roughly 38,000 scored trajectories, graded on two separate rubrics: did the output actually work ( goal completion ), and did it follow the skill's encoded conventions ( instruction-following ).

EvoClawBench asks a narrow, closed-loop question: can an agent turn evidence from its own task runs into a reusable skill that makes a fresh run better, after paying the cost of authoring it? The benchmark spans 100 tasks (502 sub-problems) across coding, data, office, security, operations, and domain-document workflows — finance, legal, healthcare, procurement and more. Every task runs through three conditions: a direct baseline with no skill involved, PreSkill (write a skill before ever attempting the task, then solve using only that skill), and PostSkill (attempt the task once, then summarize a skill from that run's evidence and solve again in a fresh workspace). Two agent runtimes, OpenClaw and nanobot, each ran five model backends — GPT-5.4, GPT-5.4 mini, Qwen3.6-Plus, DeepSeek-V4-Pro, and MiniMax-M2.7 — through all three conditions on identical tasks.

ContractSkill converts a draft web-agent skill into a contract artifact — a structured record of the goal, preconditions, an ordered list of steps (each carrying a selector, action, optional arguments, and post-assertions), postconditions, recovery rules, and termination checks. A deterministic verifier walks that structure against the live page and returns one of five typed error codes — element not found, wrong page state, an unmet postcondition, a step-budget timeout, or an invalid input — pinpointing exactly which step broke and why. That code drives fault localization . Five narrow patch operators then swap a brittle selector, insert a missing precondition or postcondition, add a recovery fallback, or correct an argument — touching only the broken step instead of regenerating the whole procedure.

DataCOPE builds data-analysis skills without ever seeing a labeled example. Instead of grading trajectories against ground-truth answers, it manufactures its own quality signal out of the agent's exploration: for open-ended report tasks, an Adaptive Checklist Verifier writes a task-specific checklist, scores each report by how much of the checklist it verifiably covers, and rewrites the checklist itself whenever the agent starts gaming it; for fixed-answer reasoning tasks, an Answer Agreement Verifier clusters trajectories by their final answer and uses self-consistency — the relative size of a trajectory's answer cluster — as a secondary confidence signal. A Data-Analytic Agent samples the trajectories, the verifier sorts them into contrastive high- and low-quality groups, and a Skill Manager rewrites a Markdown skill file from that contrast, looping through generation, verification, and distillation with no human ever touching the exploration set.

SkillFlow introduces 166 tasks across 20 workflow families spanning five domains — finance and economics, operations and supply chain, healthcare and life sciences, governance and strategy, and data and document intelligence. Every family runs on a shared Domain-Agnostic Execution Flow (DAEF), an abstract workflow skeleton that holds a task's operational structure constant while individual tasks within the family escalate in difficulty. Agents operate under an Agentic Lifelong Learning protocol: they start with an empty skill library, work through a family's 8-9 tasks in sequence, and after each one they receive the execution trace plus a verifier-written rubric describing what was missing or wrong. From that feedback they write a skill patch — adding, revising, or deleting entries in the library — before the next task begins. The domain never changes under them; only the skill library they carry forward does.

Agent skills split into two halves: a deterministic script side that runs known code, and a non-deterministic LLM side that decides what to call next. This paper treats capability-containment — proving a skill's tool calls never exceed what its manifest declares — as a property of that whole system, not just the script, and closes it with three methods built to compose rather than compete. First, abstract interpretation walks a capability-effect lattice to over-approximate what the script's code can actually do, reusing existing dataflow engines (Semgrep, CodeQL, Pyright) instead of building new analyzers from scratch. Second, the tool-call dispatch function gets wrapped in a refinement type that mechanically rejects any call whose inferred capability falls outside the manifest's declared set, no matter what the LLM asks for. Third, SMT-bounded model checking with Z3 tests the parent paper's biconditional correctness criterion against a session-length horizon, so any violation surfaces as a concrete counter-example trace rather than an abstract failure.

SkillRL splits an LLM agent's raw rollouts into two streams and distills each differently: successful trajectories become demonstrations, failed ones get compressed by a teacher model (OpenAI o3) into short failure lessons — the point of failure, the flawed reasoning, and the general principle to avoid repeating it. Both feed a two-tier SkillBank : general skills that apply across an entire environment, and task-specific skills retrieved by embedding similarity to the task at hand. Before reinforcement learning starts, a cold-start SFT phase teaches the Qwen2.5-7B-Instruct backbone to actually retrieve and apply skills — handing skills to an untrained model turns out to buy almost nothing on its own. During GRPO training the library keeps growing through recursive skill evolution : after each validation epoch, failures in weak task categories get fed back to the teacher model, which proposes new or refined skills, so the SkillBank and the policy improve in tandem instead of the library staying frozen.

ComfyClaw treats ComfyUI workflow construction as typed graph editing, not prompt rewriting. An agent inserts and connects nodes, tunes samplers, attaches LoRAs, and applies regional conditioning; invalid edits get reverted automatically. A region-level VLM verifier decomposes each prompt into a checklist of binary requirements, scores the image against them plus a holistic 1-10 detail score, and turns any failures into localized repair instructions — regional prompting to isolate a specific limb, for instance — that drive the next edit pass. Successes and failures get clustered across batches of prompts and distilled through a skill evolution loop that creates, revises, reinforces, merges, or deletes entries in a library of versioned Agent Skills , with each candidate mutation tested on synthesized held-out prompts and committed only if it doesn't degrade held-out performance.

Self-evolving agents that keep accumulating skills need a curator — a mechanism that retires a skill once its observed pass rate drops to a set threshold, which is what keeps a growing library from drifting below a no-skill baseline. That non-divergence guarantee, built into the Ratchet governance recipe this paper extends, assumes the judge scoring each trial is unbiased. Reference-free tasks like long-form report writing have no ground truth to check answers against, so the only available judge is an LLM judge — and LLM judges run systematically biased, not just noisy. That bias splits into two distinct failure modes, mathematically and behaviorally: symmetric noise, where labels flip in either direction at random, and false-pass bias , where real failures get reported as passes. Both get tested on a 155-slice citation-grounded report-writing testbed — a deterministic five-check grader stands in for ground truth, with corruption injected on top — then cross-checked on MBPP+ code generation, where unit tests play the same role.

A skill library doesn't have to get big before it starts working against you. Two Databricks researchers pin down exactly when: past the handful of skills a task actually needs, agents get measurably worse. They define an oracle skill set for each task — the skill or skills that, tested alone, lift pass rate by at least 4 percentage points over no skill at all — then track the pass-rate gap between an agent given only that oracle set and the same agent buried in the full library. A probability identity over which skills the agent actually invokes splits that gap cleanly into two effects: skill shadowing , where the agent picks the wrong skill more often as the library expands, and context overhead , where a longer list of skill descriptions hurts execution even when selection is right. They bound both effects mathematically and test the split on SkillsBench , running Claude Haiku 4.5 and Sonnet 4.6 agents against libraries of 52, 102, and 202 skills across 38 (task, model) pairs and 2,545 trajectories.

SkillGen turns an agent's own rollouts into a single, human-readable skill file instead of asking a person to write one. It collects successful and failed trajectories from a base agent, then runs contrastive induction over both: failures are clustered, each is matched to its nearest successful neighbor, and the behavioral gap between the two is extracted as the reusable signal — not a paraphrase of what happened, but the specific delta that explains why one run succeeded and a similar one didn't. Candidate skills are written into a fixed three-part schema (task context, success pattern, failure-avoidance pattern) and pushed through a generation-verification-refinement loop before anything ships.

SkillFortify bills itself as the first formal-methods framework for agent skill supply chains: six components, each carrying a proof instead of a heuristic. Start with the DY-Skill attacker model , a Dolev-Yao adaptation spanning the skill lifecycle -- install, load, configure, execute, persist -- proven maximal, meaning no stronger symbolic adversary needs modeling. A static analyzer built on abstract interpretation checks skill code against a capability lattice : four authority levels (none, read, write, admin) crossed with eight resource types -- filesystem, network, environment, shell, skill-invoke, clipboard, browser, database. Its soundness proof means a clean report isn't a best guess; it's a bound on what the code can actually do at runtime. Capability-based sandboxing, formalized as an object-capability model , comes with its own proof that it blocks 'authority amplification' -- a child skill inheriting permissions its parent never had. A dependency graph resolves through SAT solving into a deterministic lockfile, and a trust score algebra propagates trust multiplicatively down dependency chains, decaying it for skills that go unmaintained, with a proven monotonicity property. All six run against SkillFortifyBench, a 540-skill benchmark -- 270 malicious, 270 benign -- assembled from real attack campaigns.

LLM agent skills today live almost entirely as prose — SKILL.md -style files that bundle a skill's invocation rules, execution phases, and side effects into a single block of natural-language text. The Scheduling-Structural-Logical ( SSL ) representation pulls that block apart into three typed layers: a scheduling record for when and how a skill gets invoked, a structural graph of execution scenes (prepare, acquire, act, verify, and so on), and a logical graph of atomic actions with explicit resource boundaries. The three-way split borrows directly from Schank and Abelson's cognitive-linguistics work — Memory Organization Packets, Script Theory, Conceptual Dependency . An LLM normalizer (DeepSeek-V3.2) converts raw SKILL.md text into SSL's JSON schema; a 100-skill human audit found 83% of the normalized fields faithfully grounded in the source document.

Agent skills — reusable natural-language instructions that steer a model's reasoning without touching its weights — usually get built one of two ways: hand-written by a person, or extracted whole from a single successful trajectory. SkillComposer's case against both is that skill quality has two separate axes, generalization and specification, and no one-shot extraction step can serve both. So it breaks skill-writing into three trainable edits. Create turns a raw task trajectory into a skill. Merge folds two overlapping skills into one broader skill. Improve refines an existing skill against a fresh trajectory generated under its own guidance. All three train the same way, via rejection sampling : an edit only becomes training data if it lifts the executor's pass@1 by at least 0.4 over the unedited baseline. The resulting 4B-parameter composer runs three ways. Offline, create and merge build a static skill library ahead of time. Online, create and improve refine one skill per task with no library at all. Hybrid retrieves from the offline library, then specializes it per task.

SkillFuzz treats skill composition — not the individual skill — as the unit worth testing. An LLM first compiles each skill's natural-language instructions into a structured skill contract : preconditions, postconditions, state changes, domain scope, and action types, all mapped into a shared semantic space. A contract-guided Monte Carlo Tree Search then walks the combinatorial space of possible activations, steering toward compositions whose contracts look likely to interact once a branch shows signal, and sampling randomly where none has. Every candidate plan gets checked against a differential oracle — the plan the same task would produce with no skills active at all. The semantic gap between the two, plan drift , flags an implicit intent : an objective that shows up in the plan without being asked for by the task or promised by any single skill. None of it requires execution, so the whole check can run at admission time, before a marketplace ever lets an agent touch a real tool.

Most agent skill libraries come from one medium — hand-written instructions, or traces an agent left behind after solving a task once. Resource2Skill goes wider: it mines the tutorials, code repositories, articles, and reference files humans already produce for seven software-authoring domains — slide decks, spreadsheets, web pages, Blender scenes, Reaper audio projects, CAD drawings, Unreal Engine 5 builds — and runs each through multimodal skill distillation . A resource becomes a skill entry that keeps its structured instructions, a code snippet, a visual example, and provenance metadata bundled together. Entries land in a hierarchical Skill Wiki that an agent searches and composes from at task time. When nothing in the wiki fits, the same pipeline runs live as online skill acquisition , minting a new skill on the spot instead of leaving the agent to improvise.

SkillReranker treats skill selection as a graph-matching problem, not a similarity search. It decomposes a task into an ordered sequence of subtasks and intermediate sub-states, then parses every candidate skill the same way: a precondition state — what has to be true before it fires — and a completion state — what's true once it runs. Those states become nodes in a directed acyclic execution graph , with each skill wired in as an edge from whichever node matches its precondition to whichever downstream node matches its completion. That structure is a direct answer to what the paper calls the granularity gap : task requirements are specific, skill descriptions are written generic for reuse, and flat semantic matching keeps mistaking topical overlap for functional fit. Once the graph exists, SkillReranker walks it node by node, applying a split condition — comparing the strength of skills that complete before a node, start after it, or merely pass across it — to carve the task into intervals. Inside each interval, a cross-encoder scores the surviving candidates by summing the log-probability of two relevance checks, one against the full task instruction and one against just that interval's subtask text (equivalent to their geometric mean), and keeps the top scorer.

SkillGrad treats an agent's skill package — its metadata, always-loaded skill body, and conditional resource files — as a parameter to update, not a document to hand-edit. Each task run against the skill produces a trajectory; a diagnoser model reads the failures alongside contrastive successes and writes a text-based gradient — a plain-language statement of what needs to change and why. A momentum agent tracks these diagnoses across many runs and keeps only the patterns that recur, so a single bad trajectory can't swing the skill on its own. A separate patcher model executes the update as layer-aware edits : broadly useful fixes go into the always-loaded body, narrower ones into resource files that load only when needed.

Across four Qwen3 backbones (4B, 8B, 14B, and 32B parameters), the same skill text does not transfer cleanly from one model to another. A controlled granularity study on ALFWorld makes the point sharply: moderate-detail skills help the 4B model, more detail helps the 32B model, and all three skill variants tested actually reduce the 8B model's success rate compared to giving it no skill at all. MASA (Model-Aware Skill Alignment) is the fix for that mismatch — a two-stage pipeline that rewrites skill text for each target backbone without touching its weights. Stage one runs a hierarchical skill evolution loop: general, cross-task skills get refined by hill climbing, while task-specific skills go through UCB-driven tree search that branches and prunes candidate rewrites against environment feedback. Both stages condition on a model card — a structured profile of the backbone's architecture, training provenance, and known behavioral strengths and weaknesses. Stage two distills the search trajectories into a lightweight skill rewriter that reproduces the adaptation in a single forward pass — no further search needed at deployment.

Agent skills aren't single prompts — they're multi-field specs bound by hard platform limits: a description field truncated at 1,024 characters for routing, an instruction body capped at 5,000 characters and chopped down further via progressive disclosure , and a context budget shared with whatever other skills are co-resident. Optimizing a skill means hitting several of these targets at once, not just raising one accuracy score. Prior prompt optimizers dodge that reality — they either ignore the constraints outright or collapse performance and compliance into a single weighted number, which throws away any solution sitting in a non-convex fold of the trade-off surface. MOCHA replaces that weighted sum with Chebyshev scalarization : minimize the worst weighted gap to an ideal point, a formulation that reaches every point on the Pareto front , non-convex regions included. An exponential annealing schedule rides on top, letting the search roam broadly early and lock onto a specific trade-off direction as the budget runs out.

Corpus2Skill turns a document corpus into something an agent walks instead of queries. An offline compile pass embeds every document, clusters them hierarchically with K-Means, and has an LLM write a summary at each level, producing a tree of SKILL.md and INDEX.md files plus a cross-branch entity index — the same filesystem format and progressive disclosure mechanism used for procedural agent skills , repurposed here to describe what a corpus contains rather than how to do a task. At serve time the agent is preloaded with only skill names and one-line descriptions, then drills from a top-level summary through progressively finer INDEX.md files down to a specific document, backing out of branches that turn out thin. Five baselines take the comparison on WixQA, an enterprise customer-support benchmark of 6,221 support articles and 200 expert-written queries with gold answers: BM25, dense embedding retrieval, hybrid retrieval, RAPTOR-style hierarchical retrieval, and an agentic RAG agent with search tools.

Skill-as-Pseudocode (SaP) rewrites markdown skill libraries into typed pseudocode, so agents stop re-deriving schemas and call syntax from prose on every retrieval. The pipeline clusters similar procedural passages across a library and extracts a typed contract for each cluster. Before promotion, each contract has to clear a four-check deterministic verifier — coverage, binding, replacement, risk. Verified contracts get inlined into a rewritten skill file alongside restored concrete action templates, so one retrieval now hands the agent both a typed signature for what a skill does and syntax it can invoke directly.

SkillAudit swaps fixed-benchmark grading for skill-centered assessment : feed it an arbitrary skill package, it parses the SKILL.md, and generates capability-aligned tasks that probe exactly what the skill claims to do. Each task runs twice in an isolated sandbox — once with the skill installed, once without — same backbone model, same configuration, same rubric. That pairing is the baseline comparison principle : it isolates what the skill actually contributes from what the backbone could already do alone. A separate two-stage safety pipeline runs in parallel. An LLM first scans the package against 21 predefined risk patterns across five categories; every flagged risk then becomes a live runtime probe — an agent actually attempting the risky action — and only a confirmed trajectory, file change, or network call counts against the skill.

daVinci-kernel splits CUDA/Triton kernel generation across three roles under one shared LLM backbone. A Selection Agent retrieves candidate optimization techniques through BM25 pre-filtering plus LLM reranking, and a Policy Agent writes the kernel across multiple turns, conditioned on whichever techniques got selected. The third role, a Summary Agent, turns a rollout's winning trick into a new reusable entry for the shared skill library — but only once execution-based verification confirms the speedup reproduces at least 1.2x when the technique is re-run on its original task, not merely praised by a judge model. All three roles are cold-started with SFT on diversity-filtered demonstrations, then jointly optimized end-to-end with multi-turn REINFORCE and per-agent advantage estimation, so the policy, the retriever, and the summarizer improve together rather than in separate stages.

VIGIL is a runtime reference monitor for agent skills. It abstracts raw tool calls into typed events, then grounds each skill's natural-language specification into a policy that names the actual arguments, outputs, and artifact identities appearing in that specific run — closing the gap between generic prose ("validate before use") and a checkable rule. Each grounded policy compiles into a quantifier-free SMT query evaluated against the whole trace, not one call at a time, so a violation can hinge on event order, an argument value, or something produced several steps earlier and only consumed later. The policy language covers six temporal forms — absence, precedence, response, bounded response, resolution, and until — and when the solver finds a policy broken, its unsatisfiable core points to the exact invocation to block before that call's effects land.

HarmfulSkillBench starts as a sweep, not a benchmark: every one of the 98,440 skills published on ClawHub and Skills.Rest gets scored against a purpose-built harmful skill taxonomy -- cyber attacks, fraud and scams, privacy violation, sexual content generation, and more -- split into a Tier 1 prohibited-use band and a lighter Tier 2 high-risk band. The scorer is LLM-driven, tuned against 500 hand-labeled samples to an F1 of 0.82. Whatever clears the threshold feeds the benchmark itself: 200 harmful skills across 20 categories, drawn from both registries plus original entries, each pushed through four evaluation conditions that isolate one variable at a time -- a bare harmful request with no skill present, the same request delivered through a pre-installed skill, and skill-delivered variants where the harmful intent is stated outright or left implicit in the skill's own instructions.

SkillMOO treats a coding agent's agent skill bundle as something to search over, not a fixed asset written once. An LLM optimizer agent proposes edits — pruning a skill, substituting one, reordering the bundle, rewriting content — while a separate solver agent runs the edited bundle against a task. NSGA-II ranks the resulting candidates each generation on two objectives at once, pass rate and inference cost, keeping only the Pareto-efficient ones. Both agents run on GLM-5, evolving a population of 4 over 3 generations. The pipeline goes up against all 16 SkillsBench software-engineering tasks — build repair, code migration, data engineering, performance debugging, ML reproduction among them — each one repeated across 10 independent runs.

SkillSec-Eval breaks the agent skill lifecycle into six stages — authoring, storage, retrieval, planner selection, execution, evolution — and gives each one its own threat taxonomy. Badhe and Tiwari run the framework against 327 real skills pulled from the SkillMCP repository across 15 clusters spanning DevOps, cloud operations, and data engineering, then throw five attack families at it: tampered signatures and provenance at storage, gamed semantic retrieval via keyword stuffing and cloned listings, fake planner-facing recommendations, chained tool calls at execution, and permission creep hidden inside version updates.

Auto-Robotist is a self-evolving LLM agent for evolutionary robot design that turns each generation's simulator results into a structured, natural-language skill library instead of discarding them once the next population is bred. Each entry pairs a structural archetype — a recurring body-plan pattern — with evidence-grounded positive and negative rules, anchored to the actual evaluated designs that produced them, so the memory stays inspectable rather than folding into model weights or a population's genome. During search, the agent retrieves relevant skills to steer LLM edits of elite robot bodies, while keeping a standard genetic algorithm mutation path open for exploration. After each evaluation round, the agent maintains that library itself — adding skills earned from the newest evidence, catching and correcting ones that no longer hold, merging entries that have drifted into duplicates.

ClawHub Security Signals pairs each of 67,453 latest public OpenClaw skill versions — redacted SKILL.md content plus sanitized bundled files where present — with a ClawScan verdict (clean, suspicious, or malicious) and independent evidence from three scanner families: VirusTotal, static heuristic analysis, and NVIDIA's SkillSpector , which raises semantic agentic-risk advisories rather than malware-reputation signals. The release isn't trying to estimate how many skills are actually malicious. It's asking a narrower question: pointed at the same skills, do these three scanners even agree with each other?

COSPLAY runs two roles inside one system: a decision agent that plays a game by drawing on a skill bank , and a skill-pipeline agent that mines the decision agent's own unlabeled rollouts, extracting new skills and refining the ones already banked — each one shipped with a skill contract instead of a bare snippet. The two roles co-evolve : a better bank improves play, and better play produces better rollouts to mine next. The proving ground is long-horizon tasks — game environments where success depends on chaining skills across many timesteps under delayed reward and partial observability . Six such environments were tested, split between single-player and multiplayer social-reasoning games, with an 8B base model measured against four frontier LLM baselines.

SkillMutator targets a blind spot in Agent Skills security: attacks that only emerge from how a skill's natural-language SKILL.md and its executable code interact, not from either file read on its own. A SKILL.md can read as a completely benign workflow while an implicit directive buried in the prose steers the agent to exfiltrate sensitive files — the accompanying script stays clean when checked by itself. The benchmark turns this into a moving target: an adversarial mutation process iteratively rewrites malicious skills against scanner feedback until the injected behavior reads as indistinguishable from a legitimate workflow, covering 13 attack categories across four threat groups that range from technical exploits like exfiltration and privilege escalation to semantic tricks like brand hijacking and supply-chain moves like configuration weakening. The training corpus runs 1,219 mutations generated over 68 community-authored skills; evaluation draws 48, 63, and 76 surviving mutations from three adversarial oracles of increasing strength (GPT-4o-mini, GPT-5.4-mini, and GPT-5.4) applied against 17 of Anthropic's official Agent Skills.

Agent skill libraries decay quietly. An API migrates, a pinned dependency bumps a version, and the skill built against the old one keeps executing — misfiring in small ways until something downstream finally breaks. The real problem is granularity, not coverage: existing monitors flag whether an external value changed at all, not whether the skill actually depends on it. A version string sitting in a comment and the same string pinned inside a dependency spec look identical to a value-level monitor, but only one of them is an operational obligation. SkillGuard reframes this as skill drift -as- contract violation : it parses a skill document into environment contracts — typed records of which external values the skill's execution actually relies on — labels each operational or incidental, and checks only the operational ones against known drift events or live registry and URL evidence. Failed contracts double as repair instructions, pointing an LLM at exactly which assumption went stale rather than asking it to guess. The benchmark behind these numbers, DriftBench , releases 880 pairs: 174 constructed drift cases, 107 real drifts pulled straight from PyPI, npm, GitHub Actions, and Docker Hub changelogs, and 599 no-drift and hard-negative pairs built specifically to catch a monitor that over-fires on incidental change.

The first large-scale empirical study of software-engineering skills starts with a brutal filtering funnel: 775,790 skills pulled from four public marketplaces — ClawHub, SkillHub, SkillNet, and SkillsMP — shrink to 11,497 after deduplication, rule-based and LLM-based relevance filtering, and dead-link removal. Every surviving skill gets mapped onto an eight-stage SE lifecycle taxonomy running from requirements through release, then broken down further by activity, measured for length and internal structure (plain instructions versus scripts versus full agent workflows), version history, and — wherever a marketplace exposes one — its own safety or quality score.

Skill injection is usually treated as a retrieval problem: rank candidates, keep the top K, paste their descriptions in unchanged. That static treatment turns out to be the bottleneck, not the skills themselves. On one tau2-bench airline task with an 82-skill library, per-skill benefit over a no-skill baseline ranges from -0.20 to +0.40: an insurance-policy skill that shares surface keywords with the request actively hurts, while four unrelated policy-reference skills each help substantially. Feed the whole library in at once and pass rate collapses to 24.8% on average across benchmarks — worse than injecting nothing at all (40.2%).

MetaSkill-Evolve doesn't stop at letting an agent revise its own skills — it lets the agent revise the machinery that does the revising. Each search branch pairs a task skill with a meta-skill : five components (Analyzer, Retriever, Allocator, Proposer, Evolver) that define how rewriting happens in the first place. Task skills update every iteration; the meta-skill updates only every H iterations, on a slower clock, and it does so by running that same five-agent pipeline on itself — one level of recursion, no separate model or training objective. Frontier selection then decides which branch to expand next, weighing the skill's current utility against an estimate of meta-productivity (how much gain the meta-skill has recently been producing) and a cooling term that keeps any one branch from dominating the search.

Liu et al. build a 34,198-skill test bed by pulling metadata from two community skill hubs, skillhub.club and skills.sh, then downloading the full SKILL.md folders from their GitHub sources -- keeping only permissively licensed, well-formed, de-duplicated entries. Against that collection they run three models, Claude Opus 4.6, Kimi K2.5, and Qwen3.5-397B-A17B, through six settings of increasing realism on SkillsBench's 84 tasks (three runs each): skills hand-picked and forced into context, hand-picked without forcing, hand-picked with distractor skills mixed in, retrieved by the agent itself from the full 34k with the right skill still in the pool, retrieved with it removed from the pool, and a no-skill floor. A second track scores five retrieval strategies by recall@5 -- a single-shot dense-embedding lookup versus four agentic variants where the model itself issues search queries and judges what comes back -- and tests two ways to fix up whatever skill gets retrieved: query-specific refinement , which adapts the skill to the task at hand, and query-agnostic refinement , a one-time edit made with no particular task in view.

SkillsVote treats the full lifecycle of an agent skill — collection, recommendation, attribution, and evolution — as one governance problem instead of four separate ones. The starting point is a million-scale open-source skill corpus, profiled for what environment each skill assumes, how well-formed it is, and whether its claims can actually be checked; only skills that clear the verifiability bar get synthetic tasks built against them. At use time, an agent skips flat similarity lookup and instead runs agentic library search over structured skill folders, surfacing the instructional context a task needs before execution starts.

Researchers built SkillInject, a benchmark of 202 injection-task pairs that measures skill-based prompt injection — adversarial instructions planted inside agent skills , the third-party extensions that hand an LLM agent new tools, knowledge, and code paths. The attacks run the full spectrum, from blatantly malicious injected commands to subtle instructions folded into otherwise legitimate skill content, built to blend in rather than stand out. Each test pairs an injection with a genuine task and scores the agent on two axes at once: whether it dodges the harmful instruction, and whether it still finishes the legitimate one.

MMSkills packages each reusable procedure as more than a script. Alongside a compact descriptor and text procedure, it attaches state cards — when to apply the skill, when not to, and which visual cues confirm progress or failure — plus multi-view keyframes captured at different crops and points in the task. An agentic trajectory-to-skill generator builds this library automatically: it clusters public, non-evaluation interaction trajectories by workflow, drafts a procedure per cluster, grounds each step in the screenshots where it actually happened, and audits the result before it enters the library. At inference time, branch loading keeps the main agent's context clean. Candidate state cards and keyframes get checked against the live screen in a disposable side branch, and only a distilled decision — what applies, what to do, what to avoid, how to verify — passes back to the agent doing the task.

SkillAxe treats skill quality as a diagnosis problem, not a rewriting problem. It runs each task twice — once with a skill injected, once without — and scores the gap along four axes. An LLM judge calls the direction and magnitude of the quality shift. Trigger precision checks how cleanly a skill's description separates tasks that should activate it from ones that shouldn't, measured as embedding-space distance between positive and negative trigger phrases. Instruction compliance gets a fault attribution pass that splits a broken rule into two diagnoses: the agent ignored good guidance, or the guidance itself was bad. And solution-path coverage asks how much of the space of valid approaches a skill's content actually supports. None of this needs ground-truth labels, hand-written test suites, or environment reward signals — the improvement brief comes entirely from comparing agent behavior with and without the skill.

Ctx2Skill builds a skill file straight from a raw, unlabeled context using a five-role self-play loop — no human-written skills, no external verifier. Each round, a Challenger agent writes probing tasks and pass/fail rubrics from the context and its own skill set, a Reasoner agent tries to answer them guided by its current skill set, and a neutral Judge scores every rubric pass or fail. Failed cases go to a Reasoner-side Proposer–Generator pair that diagnoses the missing knowledge and rewrites the Reasoner's skill file; cases the Reasoner solves too easily go to a matching Challenger-side pair that tightens the next round's tasks. Left unchecked, a loop like this drifts toward increasingly narrow, extreme tasks — the authors call it adversarial collapse — so a Cross-Time Replay mechanism keeps two small probe sets, the hardest failure and easiest success seen each round, and picks whichever historical skill file scores best on both, rather than defaulting to the final round.

CoWork-X splits agent cognition into two clocks. A Skill-Agent handles every in-episode decision by retrieving from a structured skill library built as hierarchical task networks (HTN) — state queries, operators, and method decompositions compiled into an editable Python file — with zero LLM calls during play. After each episode, a separate Co-Optimizer LLM reads the trajectory logs (runtime failures, 100-timestep stagnation flags, action-type breakdowns) and patches the library under explicit budget constraints and drift regularization , keeping a best-performing historical version on hand for rollback. The setup runs on a two-agent, symmetric version of the DPT-Agent Overcooked-AI -style burger-preparation benchmark, starting from a deliberately broken skill library — syntactically valid HTN rules whose operators skip precondition checks entirely — across 30 episodes.

Skill1 trains one policy, via reinforcement learning, to run all three stages of a skill library lifecycle end to end: it writes a text query and re-ranks candidates to pick a skill, solves the task conditioned on that pick, then distills a new skill out of its own trajectory. The departure from prior work sits in credit assignment . Prior systems wire each stage to its own reward source — a heuristic match score for selection, a self-assessed quality score for distillation, task outcome for utilization — training three objectives that never talk to each other. Skill1 derives every signal from one binary task-outcome value instead, split into a low-frequency trend (an exponential moving average of each skill's success rate that supervises re-ranking through an NDCG-style ranking reward) and a high-frequency variation (current outcome minus the best retrieved skill's trend, which only pays out when a distilled skill beats the library's existing ceiling). One GRPO update per rollout batch trains query generation, re-ranking, and distillation together.

SkillOpt is a text-space optimizer : it treats an agent skill document — the natural-language file prepended to a frozen model's context — as something you train rather than hand-write. A separate optimizer model reads batches of scored rollouts, proposes bounded add/delete/replace edits under a textual learning-rate budget, and keeps an edit only when the resulting skill strictly beats the current one on a held-out validation gate . Rejected proposals don't just vanish — they land in a rejected-edit buffer , so the optimizer stops re-proposing what already failed, and every few steps a slower 'meta' update folds cross-epoch patterns into a protected region of the file that per-step edits can't touch. None of this runs at deployment — only the resulting best_skill.md ships, alongside the still-frozen target model. Testing spans six benchmarks — search QA, spreadsheet automation, office and document QA, math reasoning, and embodied tasks — seven target models from frontier-scale GPT to small Qwen, and three execution harnesses: direct chat, Codex, and Claude Code.

This framework skips runtime code generation entirely: it pre-builds and validates a library of Adobe Illustrator scripts offline, then serves them by lookup instead of writing ExtendScript on the fly. Task ideas come from two directions. A top-down pass walks documented software functionality -- drawing, arranging objects, and so on. A bottom-up pass mines an API synergy graph -- built from which Illustrator APIs actually co-occur in working scripts -- using GNN link-prediction to propose tasks for API pairs the system has never seen paired before. Each candidate then runs through skill generation with trials: an LLM writes a script, an LVLM validator checks both the execution output and the resulting canvas state, and the LLM gets up to three offline attempts to fix what broke -- all before any end user asks for it.

SciVisAgentSkills packages tool-specific procedural knowledge for four scientific visualization platforms — ParaView, napari, VMD, and TTK — into self-contained, version-pinned agent skills . Each one pins software versions, distills official docs into working usage patterns, and borrows code straight from existing domain agents (ParaView-MCP, BioImage-Agent, GMX-VMD-MCP, TopoPilot). Failure-mode fixes get folded in too — headless rendering, viewport capture, the stuff that trips agents up in practice. The team ran these skills across two coding-agent harnesses — Claude Code on Sonnet-4.5, Codex on GPT-5.2 — against SciVisAgentBench : 108 expert-designed multi-step tasks across five suites — ParaView, molecular visualization, bioimage, topology, and object identification. Three trials per configuration, scored by a multimodal LLM judge (Claude Opus 4.6) plus deterministic completion checks and, for ParaView, image-similarity metrics.

ARISE trains a single policy to play two roles inside the same reinforcement-learning loop: a Skills Manager and a Worker. Before attempting a problem, the Manager scores every skill sitting in its cache by summing the policy's own log-probability of that skill's text conditioned on the query — no separate retriever model — and only prepends a skill to the Worker's prompt if the top score clears a confidence-gate threshold (0.35 by default). After the Worker's rollout, a dedicated extra rollout distills any successful trace into a compact five-field skill document — name, problem type, key insight, 2-3 step method, verification check — hard-capped at 220 characters. That document enters a two-tier cache-and-reservoir library through one of five operations: Add, Update, Evict, Load, Delete. A three-level reward — 2 for a correct answer that used a skill, 1 for a correct answer without one, 0 for any wrong answer regardless of skill use — biases GRPO 's group-relative advantage toward skill-augmented rollouts whenever both appear in the same batch, so the same gradient step that improves reasoning also curates which skills survive.

SkillMaster gives an LLM agent the right to edit its own skill bank instead of treating skills as content pushed in by an external teacher. After every training episode the agent enters a review phase and must call exactly one of three tools — propose a new skill, revise an existing one, or leave the bank alone — grounded in the trajectory that just played out. Whether an edit is worth keeping is decided by a counterfactual utility reward : the system reruns four related probe tasks under the old skill bank and the candidate-edited version, and only rewards edits that raise success rates or cut wasted steps across those probes. A modified GRPO variant, DualAdv-GRPO , keeps this skill-editing signal from destabilizing the task-execution signal by normalizing advantages for action tokens and skill-editing tokens separately before merging them into one policy update.

EvoSkill discovers and edits agent skills — structured folders of instructions and helper scripts — by watching a coding agent fail, then testing fixes at the skill level instead of touching prompts or model weights. The system splits into three roles: an executor runs tasks under the current agent program, a proposer diagnoses the failures and drafts skill edits, and a skill-builder writes the result into a reusable folder. Whether an edit survives comes down to a Pareto frontier of three competing agent programs — a candidate only replaces the frontier's weakest member if it beats it on a held-out validation split the proposer never saw. The base model, Claude Code running Opus 4.5, never changes; every gain has to come from the skill folder, not the weights.

An Agent Skill 's domain knowledge lives inside SKILL.md — a mandatory file with metadata up top and then a markdown body authors can write however they want. No required sections, no schema for the body. This study is the first systematic look at what actually ends up in that free space. The authors pulled 238 real skills from the skills.sh marketplace, working down from 133,149 listed packages by filtering on weekly downloads and repository diversity, then hand-coded the bodies into a taxonomy of 13 higher-level and 44 lower-level semantic components — task, introduction, references, principles, and so on. To judge quality, they ran a multivocal literature review across 29 online sources — docs, vendor guides, practitioner posts — and distilled 26 concrete authoring best practices. Violating each one gets a name: a skill smell . A hybrid detector, static rules for some smells and an LLM classifier for the rest, then scanned the corpus and tracked 142 skills with commit history (1,199 commits total) to see whether smells clear up as a skill matures.

LLM agent skill catalogs are heading into the same problem search ran into decades ago: too many candidates to hand a model all at once. The standard fix is progressive disclosure — a router picks a skill from just its name and description, and only the winner's full implementation body ever enters the agent's context. Zheng et al. test whether that shortcut holds once a registry gets large and crowded with near-duplicates. They built an approximately 80,000-skill benchmark derived from SkillsBench, split into an Easy tier and a Hard tier salted with 780 LLM-generated distractor skills engineered to look right while doing the wrong thing. Then they ran the same skill routing test twice across both encoder-only retrieval and retrieve-and-rerank baselines — once with the skill body visible to the router, once with it hidden.

OpenClaw-Skill builds a searchable tree of skills instead of a flat library. Its construction method, Collective Skill Tree Search (CSTS), breaks a long-horizon agentic task into an ordered chain of subtasks. For each one, several heterogeneous LLMs attempt it independently, and each resulting trajectory gets distilled into a candidate skill node. Every candidate is scored twice. A collective quality score averages judgments across multiple judge models; a transferability score hands the skill to models that never produced it and checks how well those outsiders perform using it as guidance. Only the top-scoring node per subtask survives into the tree, and the surviving path becomes supervised training data. Collective Skill Reinforcement Learning (CSRL) then layers a GRPO -style policy update on top: rollouts conditioned on different candidate skills for the same subtask are normalized against each other as one group, so the policy learns to prefer whichever skill actually worked, not whichever one it happened to sample.

Task success hides which parts of a skill an agent actually used. Skill coverage is a new test adequacy metric built to expose that: it parses each skill's natural-language instructions into semi-structured Skill Behavior Constraints (SBCs) — condition/behavior pairs in an EARS-style "when X, the agent shall Y" form — then checks every agent trajectory against every constraint, labeling each one "not covered," "pass," or "fail" from observable evidence: messages, tool calls, file state. Applied to SkillsBench , the framework extracted roughly 4,283 constraints across 202 task-linked skills. An LLM judge (DeepSeek V4 Flash) had to earn its keep against human annotators before being trusted at scale: 88.58% agreement on whether a constraint was covered at all, 81.89% on the full three-way label, against a human-human ceiling of 98.05% (κ=0.961) — proof the labeling rubric itself is reproducible, not just the judge.

SKILL0 trains an agent to stop needing its own skill files. That's skill internalization — procedural knowledge migrates from context into weights instead of getting reloaded every time the agent runs. The recipe starts with reinforcement learning (GRPO) on Qwen2.5-VL backbones, and it renders skill files and interaction history together as a single compact visual context — an image, not a wall of prepended text — which trims token overhead before any curriculum even kicks in. Then comes the actual mechanism: a training schedule that hands every rollout the full skill file at first and slowly takes it away. An offline pass groups skills by category and pairs each with matched validation sub-tasks; a Dynamic Curriculum then rechecks every few steps how much each file is still worth — accuracy with it minus accuracy without — and keeps only the ones still earning their keep, inside a budget that shrinks on a fixed linear schedule until it hits zero and the policy runs fully zero-shot .

MalSkillBench builds ground truth for detecting malicious agent skills — the SKILL.md packages that bundle natural-language instructions, scripts, and tool permissions for coding agents like Claude Code and Gemini CLI — by actually running them rather than trusting a label. A closed-loop Generate-Verify-Feedback pipeline seeds a three-dimensional taxonomy (attack vector × behavior × insertion strategy, 108 cells) with real malicious PyPI code and prompt-injection corpora, then drops each candidate skill into a Docker sandbox with syscall monitoring and an LLM judge; only skills whose malicious behavior actually fires get admitted. The result is 3,214 verified generated skills, plus 703 confirmed skills pulled from the wild and 27 drawn from existing tool test suites — 3,944 malicious skills in total, paired with 4,000 benign skills pulled from ClawHub for false-positive testing.

Medical-research agent skills carry a failure mode that general-purpose skill checks don't catch: a skill can run cleanly, pass every schema check, and still fabricate a citation or wander into diagnostic territory it has no business entering. MedSkillAudit is a two-gate pre-deployment audit built to catch exactly that, run before a skill ever ships. A structural veto gate checks crash rate, schema compliance, result determinism, and code-injection surface; a domain-specific research veto gate checks for fabricated citations or data, practice-boundary violations, methodological fallacies, and code usability. A final score blends a 25-criterion static check (weighted 0.4) with a dynamic execution rubric (weighted 0.6), sorting each skill into one of four release tiers: Production Ready, Limited Release, Beta Only, Reject. The team ran it against 75 real medical-research skills — 15 each across five categories: Evidence Insight, Protocol Design, Data Analysis, Academic Writing, and a catch-all Other. Two experts then independently scored every skill on the same 0-100 scale and disposition ladder, which let the researchers measure two things at once: how closely the system's verdicts tracked human consensus, and how closely the two humans tracked each other.

AutoSkill is a training-free plug-in layer that turns repeated user requests into versioned skill artifacts instead of treating them as disposable chat history. Two loops run in tandem. A serving loop rewrites the incoming query, ranks stored skills with a hybrid BM25+dense retrieval score, and injects only the ones that clear a similarity threshold. A background evolution loop extracts a candidate skill from the user's own queries — never the model's replies — and hands it to an LLM judge that compares it against its single nearest neighbor and decides add, merge, or discard. A merge doesn't concatenate text: it bumps the existing skill's version number and folds in only the new, non-conflicting constraints, so a skill like a writing-style preference accumulates as one evolving artifact rather than a pile of near-duplicate prompts.

Agent Skills — the Markdown files that tell an LLM agent which tools exist and how to use them — get rendered to HTML for human review. The model itself usually reads the raw Markdown instead, verbatim. Researchers at Shandong University built an attack around that gap: a hidden-comment prompt injection , a single HTML comment carrying high-priority instructions, appended to an otherwise clean, benign Skill. HTML comments disappear in rendered output — a human reviewer sees nothing unusual, but the model still gets the hidden text as context. They tested it with a plain developer request, 'format my code,' against two open models, DeepSeek-V3.2 and GLM-4.5-Air, comparing the clean Skill, the poisoned Skill, and the poisoned Skill paired with a short defensive system prompt.

SkillClone doesn't read a SKILL.md file as one flat document. It splits each into three channels — YAML frontmatter, natural-language instructions, and embedded code — and embeds each one separately with TF-IDF plus latent semantic analysis. The pairwise channel similarities then feed a logistic regression, alongside a whole-document TF-IDF score and a document-shape feature. The real trick is a set of quadratic cross-channel interaction terms. Take a pair with near-identical YAML, moderately similar instructions, and zero code overlap — because the code got refactored into separate sub-files. That pair still scores as a strong clone detection hit instead of getting diluted by the empty channel. A four-branch decision tree then sorts each detected pair into a classical clone type, with the sharpest focus on Type-4 semantic clones : same functional intent, different words, different code. Validation runs on SkillClone-Bench, a 300-pair benchmark built without manual labeling — half the positive pairs from verified GitHub fork lineages, half from seven controlled mutation operators, and a negative set deliberately stacked with same-category pairs that share vocabulary without being clones.

SkillCenter builds its library through a five-stage pipeline. Source acquisition feeds an LLM-based pre-filter called SkillGate , which screens raw material for actionability before any generation tokens get spent — auto-rejecting anything under 200 characters, then issuing a pass/maybe/fail verdict off a 0-10 suitability score. What survives moves through template-driven generation (four templates, keyed to source type) and an iterative improvement loop of up to three passes, each running a deterministic source grounding check that traces every retained claim back to an exact quotation in its source. A four-criterion publish gate — quality score, license compatibility, plagiarism ratio, placeholder density — catches roughly 3% of generated skills for falling under a 3-out-of-5 floor. Everything that clears it ships as an offline SQLite FTS5 database: keyword search, no embeddings, no vector store, no network call at query time.

Skillware is Fan and Lan's name for what an agent skill actually is once you stop treating it as a prompt: a three-layer object. The Skill Artifact is just the natural-language task spec. Wrapped around it sits the Skillware Unit — an independent software identity with its own addressable name, version, compatibility record, and provenance trail. The Agent Host is whatever runtime discovers, activates, and interprets the thing. Membership in the category isn't just declared; it's tested — three necessary conditions (behavioral primacy, independent software identity, compatible host execution) checked against 15 boundary cases, 12 that should count and 3 deliberately chosen not to. The evidence behind it is a frozen corpus, SkillMD-138K: 138,133 content-deduplicated SKILL.md files pulled from 20,556 repositories, plus 13 fixed-revision case studies of real implementations.

Researchers scraped 42,447 agent skills off two live marketplaces — skills.rest and skillsmp.com — and ran 31,132 unique packages through SkillScan, a three-stage detector chaining static/regex analysis, an LLM-Guard input screen, and a Claude 3.5 Sonnet classifier tuned to flag security patterns. The corpus got split three ways to keep the taxonomy honest: one slice built the pattern taxonomy, one calibrated detection rules, one validated it. Against 200 skills hand-labeled by two researchers with penetration-testing backgrounds (inter-annotator agreement κ=0.83), SkillScan hit 86.7% precision and 82.5% recall.

MIND-Skill turns skill-writing into a closed loop with two roles instead of one static write-up. An induction agent abstracts a successful task trajectory into a skill document; a separate deduction agent then tries to redo the task using nothing but that document, and the gap between the original run and the blind reconstruction becomes the training signal. Three losses score that gap. A reconstruction loss checks whether the reconstruction follows the same procedural steps; an outcome loss checks whether it actually succeeds against the live environment; a rubric loss scores the write-up itself on five axes — ground-truth independence, actionability, transferability, completeness, conciseness. All three are optimized together with TextGrad , natural-language gradient descent over the skill text, with the outcome loss as the primary objective and the other two breaking ties. The setup is tested on AppWorld (90 training tasks held out against 168 normal and 417 harder "challenge" test tasks) and BFCL-v3 (50 training / 150 held-out multi-turn tool-call instances). Baselines span ReAct, in-context learning, a single-pass "skill-extract" ablation of their own induction agent, and two concurrent methods — ACE and trajectory distillation -based Trace2Skill.

Evolving Programmatic Skill Networks builds agent skills as executable, typed programs — not prompts or embeddings — arranged in a directed graph that keeps growing and rewriting itself as the agent acts. The framework, called the Programmatic Skill Network (PSN) , grows through two linked mechanisms. Day to day, Reflect traces a failed run backward through the skill graph to pin down which specific subskill broke — a symbolic stand-in for backpropagation — and a maturity-aware update gate throttles how often a skill gets rewritten based on its track record, so reliable skills stop churning while shaky ones stay open to revision. Periodically, a refactoring pass collapses redundant or overlapping skills into one of five canonical patterns — parametric coverage, behavioral coverage, sibling specialization, common-subskill extraction, and duplication — with every rewrite gated behind a rollback check against recent tasks. Both mechanisms are evaluated on the MineDojo Minecraft tech-tree benchmark and on Crafter.

SWE-Skills-Bench tests whether packaging procedural knowledge as an agent skill changes outcomes on real software engineering work, not on synthetic coding puzzles. It starts from a pool of over 84,000 public skills and filters down to 49 spanning six SWE subdomains — deployment and DevOps, analytics and monitoring, API development, data science and ML, security and testing, and developer tools — each paired with an authentic GitHub repo pinned at a fixed commit plus a requirement document carrying explicit acceptance criteria. A requirement-driven verification framework turns each acceptance criterion into an executable pytest check, so every task instance (about 565 total, roughly 11 per skill) gets a deterministic pass/fail verdict instead of a judged score. Every task runs twice — once with the skill's SKILL.md dropped into the agent's context, once without — under a single fixed agent configuration (Claude Code driving Claude Haiku 4.5), so the skill's presence is the only thing that changes.

CUA-Skill turns human computer-use know-how into 478 atomic, parameterized skills across 17 Windows applications — File Explorer, Excel, Word, Chrome, VS Code, PowerPoint, and more. Each skill pairs a natural-language intent with an argument pool and a parameterized execution graph , a directed graph whose nodes are control states and edges are base GUI actions gated by UI predicates. A separate composition graph encodes which skills can legally follow which, turning a flat skill list into a navigable map of higher-level tasks. Built on top, CUA-Skill Agent handles the runtime work: hybrid lexical-and-semantic skill retrieval (Qwen3-Embedding-0.6B, top-5 candidates) narrows the catalog to candidates, argument instantiation treats enumerable and open-ended inputs differently, and a memory log of past attempts drives failure recovery — falling back to raw primitive actions when nothing cataloged fits.

OpenSkillEval builds its evaluation harness around real, evolving artifacts instead of a frozen benchmark: it pulls fresh presentation decks, web pages, posters, dashboards, and reports from the wild and turns each into a task an agent has to reproduce or extend. The benchmark spans five domains — slide generation, front-end web design, poster generation, data visualization, and report writing — yielding more than 600 task instances tested against 30 community skills pulled from repositories including clawhub.ai, skills.sh, openskills.space, and skillsmp.com. Each skill runs head-to-head against a no-skill baseline across a matrix of models and agent frameworks (Claude Code, Codex, and others), scored on both the execution trajectory — did the agent look at the skill, and when — and the quality of the final artifact.

SkillFoundry turns scientific papers, repos, notebooks, and docs into a maintained skill library, not a one-time scrape. It maps a target domain as a domain knowledge tree , then mines the branches with the most resources and the weakest verified coverage. Each artifact gets reduced to an operational contract — scope, inputs/outputs, execution steps, environment assumptions, provenance, and tests — and compiled into an executable skill package . A closed-loop validation pass then expands, repairs, merges, or prunes entries as new results come in, so the library keeps evolving instead of going stale.

Researchers ran 98,380 agent skills pulled from two community registries, skills.rest and skillsmp.com, through a four-stage detection funnel: static pattern matching against 14 rules tied to a six-phase kill chain , dynamic behavioral verification inside sandboxed containers, then manual dual-rater review (Cohen's κ=0.89) and vulnerability labeling. Static matching alone flagged 4,287 candidates. The full pipeline confirmed 157 as malicious — 632 distinct vulnerabilities spread across 13 attack techniques — with the dynamic-verification stage alone hitting 99.6% precision, a 90x jump over pattern matching by itself.

SkillProbe is a three-stage, multi-agent auditing pipeline built for agent skill marketplaces like ClawHub. First, a Gatekeeper stage filters for compliance violations and known-malicious patterns. Then an Alignment Detector checks semantic-behavioral alignment — whether a skill's declared behavior actually matches what its code does — sorting each skill into a four-way match / over-declaration / under-declaration / mixed classification. The final stage, a Flow Simulator, models combinatorial risk : individually benign skills chaining into dangerous behavior once an agent invokes several together. Brute-forcing every possible combination would mean an O(2^N) search, so the simulator instead matches against a fixed rule set, keeping cost linear in catalog size — O(N × number of rules). The whole pipeline is itself packaged as skills that drive specialized auditing agents, a design the authors call " Skills-for-Skills ." The team ran it across 2,500 real skills pulled from ClawHub, then separately re-audited the top 20 most-downloaded skills with 8 different LLM series to see how verdicts shift depending on which model is doing the judging.

Agents built on chain-of-thought reasoning treat every episode as new — even when the underlying subtask has been solved dozens of times, the reasoning chain gets thrown away the moment the episode ends. Skill-Pro converts finished trajectories into explicit, executable procedures instead of discarding them, formalized as a Skill-MDP : each stored skill bundles an activation condition (when to fire), an execution procedure (the ordered action sequence), and a termination condition (when to hand control back to the base policy). Improving that library without touching model weights is handled by Non-Parametric PPO . Hindsight attribution over a trajectory produces semantic gradients — natural-language descriptions of how a skill should change — and a PPO Gate reruns PPO's clipped-surrogate trust-region check against historical trajectories to decide whether the edited candidate is actually accepted into the library. Score-based maintenance , which scores each skill by its average advantage whenever it's active, prunes it back out the moment it stops paying its way.

SIGIL treats skill security as a lifecycle problem, not a one-time gate. Every approved skill gets anchored in a tamper-evident on-chain registry , published under one of four modes — Transparent (free plaintext), Licensed (paid access), Sealed (custodial use), or Committed (off-chain content, on-chain hash). Admission runs through a DAO audit committee : pluggable audit methods (static analysis, LLM review, sandbox checks) operating under a stake-and-slash economic model that penalizes bad calls. Every later load then passes through a Skill Verification Loader (SVL) , which re-checks the fetched skill against the exact record the auditors signed off on and enforces its permission manifest before any content reaches the model's context.

LLM agents built on skill libraries hit a bottleneck once the library grows: choosing what to load stops being a lookup problem and becomes a joint decision over subset, count, and order — three choices that retrieval and full-library approaches never handle together. SkillComposer treats this as structured skill composition . A frozen Qwen3-Embedding-0.6B encoder turns the task and skill metadata into a 256-dimensional vector; a compact autoregressive decoder (3 layers, 256 hidden dimensions, 4 attention heads) reads that vector and emits skill identifiers one at a time until a STOP token. Subset, count, and order all fall out of that single decoding pass. At inference the decoder doesn't work alone: its logits are fused with a TF-IDF relevance score and a separately trained set-membership head, what the paper calls retrieval-augmented decoding . Training data is 9,872 task-skill records built around a real, 196-skill human-curated library — 65 real SkillBench tasks plus synthetic single- and multi-skill compositions grounded in a 196-node skill dependency graph.

SPyCE trains multimodal agents that think with images by distilling every successful multi-step trajectory into a two-tier hierarchical skill library , rather than collapsing it into a scalar reward or dumping it into a static memory store. Execution skills capture local visual operations as condition-action-effect rules (rotate this, crop that, zoom on this region); workflow skills capture higher-level orchestration as a bottleneck description plus a sketch for which tools to call and in what order. A separate large model (Qwen3-VL-235B) mines both tiers out of the policy's own rollouts, merging near-duplicate skills by embedding similarity and pruning execution skills whose tracked success rate drops, while workflow skills stay largely fixed once established. During reinforcement learning , the policy first retrieves a matching workflow skill, decomposes the task conditioned on it, then retrieves execution skills that fit — so what gets retrieved directly shapes the next rollout, and that rollout regenerates the library for the round after.

SkillRet turns skill retrieval into its own measurable problem, separate from end-to-end agent benchmarks. The corpus starts at 22,795 public agent skills scraped from claude-plugins.dev, then narrows through five filtering passes — language, license (MIT/Apache-2.0 only), two rounds of deduplication — down to 17,810 skills, each tagged into a two-level taxonomy of 6 major and 18 sub-categories. These are long documents, not short tool blurbs: median length is 1,583 tokens, an order of magnitude past typical tool-retrieval benchmarks. Training queries (63,259) and evaluation queries (4,997) were generated separately over disjoint skill pools — Qwen3.5-122B-A10B for training, Claude Opus 4.6 for evaluation — then filtered for skill-name leakage and checked by both an LLM panel and human annotators. Just over half the evaluation queries name two or three skills at once, not one.

MemSkill treats the four hard-coded memory operations — insert, update, delete, skip — that most LLM agent memory systems run on as a starting point, not the final word. It organizes them into a shared skill bank , a set of structured, reusable routines for extracting, consolidating, and pruning information from interaction history. Three learned components run that bank: a controller, trained with reinforcement learning (PPO) and Gumbel-Top-K sampling, picks a small set of relevant skills for each turn without replacement; an executor applies whichever skills got picked to write memory in a single pass over a span of history, rather than turn by turn; and a designer periodically reviews the hard cases — where selected skills produced wrong or incomplete memories — clusters similar failures, and proposes refinements or entirely new skills. That closes the loop: the selection policy and the skill set itself both keep improving over time.

Skill optimization here becomes a form of zeroth-order optimization : treat a skill document as a text parameter that execution feedback nudges, no gradient required. The authors map existing self-evolution methods — single-trace reflection, contrastive diagnosis, coordinate-wise edits, edit-budget decay — onto the classical zeroth-order toolbox, then note what separates an agent rollout from blind numerical perturbation: a rollout is a readable trajectory, planning steps and tool calls and error messages all visible, which turns optimization into targeted debugging rather than random search. Working from PAC-learning theory and an "everything is a file" systems philosophy, they distill the requirements for a skill-optimization loop that actually generalizes down to three: store each rollout as its own flat file instead of folding it into a pooled batch, mine consensus across several failures instead of patching from one (skip this and a stability coefficient in their analysis inflates the generalization error), and gate every candidate edit against a validation set that never overlaps the training failures. Strip out everything else — mini-batch reflection pooling, textual learning-rate decay, rejected-edit buffers — and what's left is SkillOpt-Lite: stage the trajectory, explore with shell tools, mine consensus and write a minimal patch, validate and gate. Four steps, run by a standard coding agent.

Most agent skills ship once and sit still. The same tool-usage mistake, the same brittle workaround, the same failure mode gets rediscovered independently by every user who hits it, because nothing carries that experience back into the skill itself. SkillClaw closes the loop by treating every session as signal: it pools the trajectories — what an agent tried and how it went — across every user of a skill, then runs an autonomous evolver over that pooled history. The evolver hunts for behavioral patterns that recur across different people's sessions, then decides whether the fix is tightening an existing skill or adding a new one. Updated skills land in a shared skill repository that syncs to every user automatically — nobody has to notice a fix shipped, let alone go pull it.

Skill-to-LoRA (S2L) treats a SKILL.md file as training data, not runtime cargo. Offline, a teacher model reads the full skill document and generates synthetic task-response pairs that demonstrate the behavior it describes; those pairs train a small LoRA adapter for that one skill, with the base model frozen the whole time. At inference, the adapter loads and the SKILL.md text disappears from the prompt entirely — what's left is a lightweight skill-id tag, and the model acts on a learned behavioral prior instead of re-reading procedure on every step.

SkillDAG models a large skill library as a typed directed graph instead of a flat embedding index. Five edge types — depends_on, specializes, composes_with, similar_to, conflicts_with — encode relationships cosine similarity can't see: prerequisite chains, narrower-vs-general variants, synergistic pairings, redundant duplicates, and incompatible combinations. Construction starts cold: each skill gets embedded twice, once for what it does and once for what it requires (a HyDE-style query expansion), and an LLM classifier assigns edge types between candidate pairs. At inference time the agent calls a single search() function that returns three parallel signals — top-K semantic matches, typed-edge neighbors from graph traversal, one-hop conflict warnings — and decides for itself how to weigh them, rather than have a fixed formula fuse them upstream. A propose-then-commit protocol lets the agent register new edges it discovers mid-episode, subject to acyclicity and non-contradiction checks, so the graph accumulates structure across runs instead of freezing at construction.

SkillLearnBench is the first benchmark built to test whether an agent can write its own agent skills well enough to matter, rather than testing skills a human already wrote. Researchers from Carnegie Mellon and Amazon AGI assembled 20 verified tasks across 15 sub-domains — software engineering, information retrieval, productivity tools, data analytics, content creation, and utilities — pulled from a community skill-usage taxonomy. Every task is checked twice before it counts: an agent with no skill must fail it at least half the time over ten tries, and a human-authored reference skill must be able to solve it. Four continual learning methods for generating skills from a task description are then pitted against each other: one-shot generation, self-feedback (the agent critiques and rewrites its own skill after one failed attempt), teacher feedback (an outside evaluator gives guidance across up to two QA rounds), and Anthropic's structured Skill-Creator pipeline. Six different skill-writing LLMs do the generating — three Claude models, three Gemini models — while Claude Sonnet 4.6 stays fixed as the agent that actually executes whatever skill comes out.

E-commerce visual assistants take one uploaded photo and have to route it to wildly different behaviors — product search, style advice, an encyclopedia lookup, a plain utility call — and each one needs its own response shape, tool calls, and domain constraints. SkillChain takes the hand-authored behavioral spec for each intent (a "Skill") and makes it evolve on its own, through three linked stages. A Skill Creator bootstraps an initial Skill Bank from task specs and real user trajectories behind a human reflection gate. A Route Optimizer mines live routing failures — ambiguous intent boundaries, missing skills, parsing errors — and updates, merges, or discards Skill descriptions, with a provable guarantee that routing F1 never regresses round over round. A Body Refiner closes the loop on content quality: a dual-path evaluator pairs rule-based structural checks with an LLM-as-judge that scores every response on four axes — tool-call rationality, card-composition compliance, content quality, constraint adherence — then aggregates that signal across many queries before rewriting the Skill body.

SkillJect is an automated framework for manufacturing poisoned agent skills, and it works two channels at once instead of leaning on a single hand-crafted trick. The artifact channel buries the actual malicious payload inside an auxiliary helper script bundled alongside the skill. The instruction channel rewrites SKILL.md around it, using a front-loaded inducement strategy : right at the top of the file, the helper script gets framed as a mandatory setup step, complete with a plausible file path and an executable example command, rather than as an optional or suspicious add-on. Tuning that framing is a closed-loop multi-agent process — a Victim Agent runs the skill on a real task, an Evaluate Agent reads the execution trace to judge whether the payload fired, was ignored, refused, or half-triggered, and an Attack Agent rewrites the instruction text, never the payload itself, for another pass.

SkillSelect-Serve treats a reusable agent skill as a Skill Service — a structured record of what it does, its input/output shape, which tools it needs, how many tokens it costs to load, and a risk label — rather than a passage to rank by text similarity. A five-stage pipeline builds these profiles from raw skill documents, then converts each incoming task into a structured requirement object without naming a candidate skill. Standard BM25/dense/cross-encoder retrieval pulls a high-recall candidate pool, and a task-conditioned suitability estimator scores each one. The final stage, constrained projection , is a greedy skip-and-continue packer: it walks the ranked list and admits a skill into the bundle only if the whole package still fits the token budget, stays under an aggregated risk ceiling, and draws only on tools the deployment actually has. Infeasible candidates get skipped, not stalled on — their budget rolls forward to the next-best option.

SkillLogic is a static-analysis framework that reads an agent skill file and extracts the logical relations binding its instructions together: preconditions that gate an action, postconditions that stay unmet until a follow-up step runs, constraints that narrow how an allowed action can be carried out, fallbacks that only kick in after a primary route fails, plus conjunctions, exceptions, overrides, and conflicts — eight relation types in all. Run against 5,224 public skills pulled from SkillsMP, the scanner found that 70% carry at least one such relation — most skills already demand that an agent reason about sequencing and precedence, not just execute a single command. The highest-confidence, highest-impact, locally-gradable relations feed into SLBench: 86 audited cases, each built around a seeded repository and a grader that checks execution artifacts — files written, configs changed, logs left behind — rather than the agent's own account of what happened.

Scale first: two public catalogs hold 118,000 agent skills between them — 28,990 on clawhub.ai, 89,280 on skills.sh. Running that catalog against eight LLMs and three harnesses (BareAgent, OpenCode, OpenClaw) on SkillsBench-style tasks turns up a blunt pattern: a skill isn't actually a portable unit. It's raw context that one model's harness happens to parse correctly and another's doesn't. SkVM's answer borrows from compiler theory — treat the skill as source code, the LLM as a heterogeneous processor, and decompose what the skill demands into primitive capabilities : 26 of them, spanning code generation, reasoning, tool execution, and procedure-following, each gated by a proficiency level. A one-time profiling pass scores how well a given (model, harness) pair supports each primitive, and that profile drives capability-based compilation , environment binding, and concurrency extraction before the skill ever runs — plus JIT code solidification and adaptive recompilation while it does.

SkillTTA treats skill-building as test-time adaptation : instead of shipping one skill per task family, it keeps a pool of past training trajectories, both successes and failures, tagged with lightweight, answer-free task metadata. At test time it embeds the incoming task and does trajectory retrieval , pulling a small top-k set of the most similar past runs by cosine similarity. A synthesis model then turns the current task plus that retrieved evidence into a one-off skill file, covering when to use it, likely failure modes, and non-prescriptive procedure notes, that a fixed solver conditions on for that single task; no weights change. Benchmarks pit this against a static skill library baseline that synthesizes one skill per trajectory cluster and reuses it as-is, plus a memory-learning baseline that updates through repeated interaction, across spreadsheet editing (SpreadsheetBench), household tasks (ALFWorld), and code generation (BigCodeBench).

Existing graph-based multi-agent design treats agents as closed-set entities : fix a roster of agents, roles, or groups first, then optimize who talks to whom. SIGMA drops that assumption. Given a task and a library of reusable skills, its skill-incidence graph predicts a skill-agent incidence matrix that assigns skills onto task-conditioned agent slots, builds each agent's embedding from the skills it was handed, and only then decodes a communication topology over the agents it just built. At runtime, skill-specific mailboxes route messages straight to the capability responsible for them — the incidence structure isn't just a planning artifact, it does the actual routing during execution.

Agents built on vision-language models rarely repeat themselves. Ask the same policy to complete the same web task twice and the click sequences drift, even though the underlying reasoning hasn't changed. The standard fix is self-consistency — sample several rollouts, vote on the majority action — which trades inference cost for stability and throws away the pattern it just discovered. A reusable agent skill splits that task-relevant signal differently: some of it verbalizes cleanly into a procedure card, some of it lives in perceptual detail that resists description. Storing both streams side by side, uncoordinated, just duplicates whatever the text already captured.

SkillsBench runs Agent Skills — structured procedural packages loaded into an LLM agent's context at inference time — through a controlled, paired test instead of a single-condition demo. The benchmark assembles 87 tasks across 8 domains (software engineering, natural science, cybersecurity, finance, and more), each shipped with a curated Skill and a deterministic verifier so pass/fail isn't a judgment call. The task pool itself passed through selection: 400 candidate submissions from 142 contributors, an automated gate (structural integrity, oracle execution, AI-text detection, leakage checks), then human review of at least 30 minutes per task, for a 22% acceptance rate. Every task runs three trials under matched no-Skills and curated-Skills conditions, across 18 model- harness combinations spanning OpenHands, Claude Code, Gemini CLI, and Codex CLI paired with models like GPT-5.5, Gemini 3.1 Pro, GLM 5.1, and MiniMax M2.7.

Agent skills are supposed to make agents cheaper and more capable, not the reverse. An audit of 55,315 publicly available skills finds the opposite happening at scale. 26.4% carry no routing description at all, and another slice sit under 20 tokens — both break or blunt the mechanism an agent uses to pick the right skill before it even reads the body. Once a skill is selected, the body doesn't fare much better: only 38.5% of its content qualifies as actionable core instruction. The rest is background prose and examples the agent didn't need, plus templates it never used. Reference files make the problem worse — a 100-skill sample alone carries 1.67M tokens across 505 files, all of it inherited on a single invocation whether or not the task touches it. SkillReducer's answer isn't a blunt compressor but a two-stage pipeline. Stage 1 rewrites routing descriptions, and generates them where missing, using delta debugging against a simulated routing oracle plus real-agent validation. Stage 2 classifies body content into core rules, background, examples, templates, and redundant material, then applies progressive disclosure : everything but the core rules moves into modules loaded only on demand, gated by a faithfulness check and a feedback loop that restores content if cutting it hurts task performance.

Most Skill-authoring pipelines still turn a pile of agent traces into a single block of prose. RWSA (Routing–Workflow–Semantics–Attachments) is a representation built to stop that: it splits a skill into a routing header — when the skill applies — plus three separate runtime layers: workflow (control flow, branches, verification checkpoints), semantics (each step's objective and decision rule), and attachments (tools, validation, rollback, state management). The accompanying W2S pipeline builds this bottom-up from raw evidence. It segments traces, drafts a local skill per segment, then aligns shared structure across traces of the same task — reconciling branch cases instead of averaging them away, and compressing duplication while keeping every claim tagged back to the evidence and confidence level that produced it. Before it ships, a feedback pass hunts for holes: missing branches or criteria, steps that are vague or out of order. It also flags contradictions between the routing, workflow, and semantics layers.

SkillGraph reframes an agent's skill library as a directed graph instead of a flat, similarity-ranked list. Each node is a skill distilled by a teacher model (OpenAI o3) from the agent's own successful and failed trajectories; each typed edge encodes one of three relations — prerequisite, enhancement, or co-occurrence — carrying a weight that strengthens or decays with experience. Given a new task, the system doesn't just pull the nearest skills by embedding distance: it seeds from task-relevant nodes, walks backward through prerequisite edges (depth 2) to recover what has to happen first, walks forward through a width-3 beam to find what builds on it, then topologically sorts the result into an ordered subgraph capped at eight skills — what the paper calls graph-aware retrieval . That ordered plan conditions the policy, and the graph keeps evolving during GRPO reinforcement learning: new skills get inserted from failures and near-duplicates get merged, while skills that succeed inconsistently get split apart and chronic failures get deprecated.

SkillEvolver treats skill-authoring as a closed loop, not a one-time artifact — and it never touches model weights; the update target is the skill's own prose and code. A meta-skill , loaded through the same CLI interface as any domain skill, drives an authoring agent through repeated cycles of exploring, patching, and auditing a candidate skill. Unlike trace-distillation methods that mine hundreds of pre-collected trajectories per domain, it works from a handful of trials on one newly arrived task. Each cycle spawns several trials built around genuinely different high-level strategies rather than resampled temperature, runs a contrastive skill update that isolates missing guidance by comparing traces that succeeded against ones that failed, and patches the artifact directly. The refinement signal comes specifically from watching a separate, fresh Domain-Skill Agent try to use the already-shipped skill and fail — not from the authoring agent grading its own exploration. Before a revision ships, an independent auditor session with no access to validation data runs nine mechanical checks for overfitting and deployment failure, including a silent-bypass check for skills that read as valid content but are never actually invoked at runtime.

Most skills start life one of two ways: an expert writes them by hand, or an LLM generates them in a single pass from a task description. Both are cold-start methods — neither one looks at what actually happens when an agent tries to execute the skill. SkillRevise closes that loop. It runs the current skill against a real task, captures the execution trace and verifier outcome, and turns that evidence into a structured diagnosis : what the verifier actually required, which specific behaviors caused the failure, and which parts of the skill already work and must be preserved. That diagnosis is matched against a fixed bank of seven general repair principles — reusable defect patterns like malformed schema fields or an unguarded tool failure — and only the principles whose evidence conditions are satisfied get bound to this repair. The revision itself is anchored: each edit specifies exactly what executor behavior it's supposed to change, not just what text to add.

LLM agents that compose multiple skills to solve a task depend on a retriever picking the right combination. That's a different problem from picking the right individual skill. A retriever can score every skill against a query correctly and still return two skills that each look relevant but cannot actually work together for that query — query-conditioned skill compatibility isn't recoverable from per-pair relevance scores. The fix here starts from a byproduct most LLM data-synthesis pipelines throw away: when an LLM decides whether a candidate skill belongs in a query's retrieval set, its rejections already record which skills should not be retrieved together for that query. Reject-as-Resource (R3) keeps those rejections and turns them into training signal instead of discarding them. Built on that idea, R3-Skill is a bilingual Chinese-English benchmark: 10,246 skills (deduplicated from 95,212 raw candidates) across 8 thematic domains, 41,592 accepted queries, and 32,828 of the LLM's own rejected pairings, tagged across an eight-class taxonomy of rejection reasons.

MCE reframes context engineering as a two-level search rather than a fixed pipeline. Instead of hand-designing the harness that decides how context gets built — the generation-reflection-curation loops and itemized-list schemas behind methods like ACE, or the brevity-biased prompt rewrites behind GEPA — a meta-level agent evolves the harness itself: executable "skills" that combine natural-language methodology, scripts, and validation logic. It refines these through agentic crossover , a deliberative reasoning pass over the full history of prior skills, their executions, and validation scores, rather than a fixed recombination rule. A separate base-level agent then executes whatever skill the meta-agent hands it, reading training rollouts and writing the actual context as files and code instead of filling in a predefined schema. The two levels co-evolve under a simple (1+1) evolution strategy, tested across five unrelated domains: XBRL entity tagging (FiNER), retrosynthesis prediction (USPTO-50k), symptom-to-disease classification, Chinese criminal-charge prediction (LawBench), and prompt-safety classification (AEGIS2). DeepSeek-V3.1 is the model under test (Qwen3-8B for the safety task), MiniMax M2.1 does the evolving, and the field it's measured against includes ICL, MIPROv2, GEPA, Dynamic Cheatsheet, and Agentic Context Engineering (ACE) .

HASP turns each stored agent skill into a small executable module called a Program Function (PF): a should_activate() check that watches the agent's current state and proposed next action, paired with an intervene() step that either rewrites the action outright or injects corrective context back into the reasoning trace. An external agent harness wraps the base policy (Qwen2.5-7B-Instruct throughout), retrieves candidate PFs at every step, and lets them fire before the action executes — no fine-tuning required to see a benefit. The same interface does double duty: each firing logs the original action, the repair, and the downstream effect, which becomes training signal for post-training via SFT, rejection sampling , or on-policy distillation , and recurring failures get mined into new candidate PFs that must clear executable validation plus a teacher's review before joining the shared skill library.

AgentSkillOS tackles a scale problem: as of late February 2026, the Claude skill ecosystem held more than 280,000 public skills, built almost entirely by decentralized third-party authors, with no structured way for a user or agent to browse that space. The fix runs in two stages. Offline, a capability tree organizes the pool through recursive LLM categorization — each node splits into child categories once its skill count exceeds a per-node capacity, collapsing even a 200,000-skill ecosystem into a shallow, browsable hierarchy. Past a size threshold, only the top-installed skills stay in this active tree (10,000 of 200,000 at the largest scale tested); the rest sit in a dormant, embedding-searchable index. At task time, the system walks the tree to shortlist candidates, prunes down to the top eight, and compiles them into a DAG-based orchestration plan under one of three named strategies (Quality-First, Efficiency-First, Simplicity-First) before executing skills in dependency order. Testing this against the obvious alternative — handing an agent the same skills unstructured — required a benchmark built for the purpose: 30 tasks spanning five artifact categories (data computation, document creation, motion video, visual design, web interaction), graded by pairwise LLM judging distilled into a Bradley-Terry model score.

A retriever can nail the capability family — the right general kind of skill for the job — and still hand back the wrong specific one. SkillResolve-Bench 1.0 names this failure same-capability execution-risk retrieval : each query pairs a helpful skill against a query-specific risky sibling — same capability, but wired to a stale resource, an unmet precondition, or the wrong procedure. The benchmark draws 661 helpful/risky pairs (630 from SRA-Bench, 31 from SkillsBench) and tests them against a 7,982-candidate pool that includes 6,660 public SkillRet skills, split query-disjoint at 446/68/147. A new metric, harmful sibling rate (HSR@K), tracks whether the risky sibling shows up in the top-K results at all.

CODESKILL treats skill-bank curation as something a model learns, not a heuristic bolted onto a frozen agent. A management policy — trained through a three-stage curriculum with GRPO — watches coding-agent trajectories and decides whether to extract a new procedural skill (a high-level task strategy, or a local event-driven reaction to something like a recurring command failure), revise an existing one against new evidence, or merge and drop entries during maintenance. Three signals shape the reward: a rubric-based reward from an LLM judge scoring grounding, reusability, and actionability; sparse execution feedback on whether injecting the candidate skill actually raised the frozen downstream agent 's pass rate on held-out tasks; and an alignment check on whether the agent's behavior matched what the skill claimed to trigger. Training uses a group size of six generations per prompt, a quality-reward weight of 0.25, and a KL coefficient of 0.02, optimized against a frozen Qwen3.5-35B-A3B coding agent.

Researchers screened GitHub for agent skill repositories with at least 20,000 stars and 2,000 forks and landed on six, including Anthropic's own anthropics/skills, obra/superpowers, and affaan-m/everything-claude-code. Those six repos alone had 67,264 public forks. Filtering out inactive branches, upstream-sync noise, and edits that never touched an actual skill package brought that down to 1,220 branch comparisons -- each one a developer's real, deliberate change to an existing skill. An LLM agent read every diff and built a taxonomy from the patch content itself rather than from commit messages; two human auditors checked a random sample and hit κ=0.83 agreement, solid enough to trust the result: 1,126 validated adaptation instances, sorted into 46 patterns across 13 families.

Multi-agent systems split a task across several specialized agents that talk to each other, and that coordination is expensive — every hand-off costs tokens and latency. Compile the same pipeline into a single agent backed by a library of skills , with each former agent's behavior turned into one skill the agent selects from, and the inter-agent messages disappear. That's the substitution tested here, across GSM8K, HotpotQA, and HumanEval, then pushed two ways: the skill library grows from a handful of entries to dozens, and separately gets seeded with near-duplicate competitor skills to see what actually breaks selection.

A full-lifecycle test bed for model-generated agent skills — experience generation, skill extraction , skill consumption — runs across five domains (ALFWorld, SpreadsheetBench, SWE-bench-Verified, SEAL-0, BFCL-v4), with six models serving as consumers — GPT-5.4 and its mini variant, Gemini-3.1-Pro and Flash-Lite, Qwen3.5-35B and 9B — five of which (all but Qwen3.5-9B, excluded as an unreliable extractor) also act as extractors. Utility is measured directly as the performance delta a skill produces on held-out tasks versus no skill at all, rolled into an Extraction Efficacy score per extractor and a Target Evolvability score per consumer. Across every extractor-target-domain combination, skills help 75% of the time — but the other 25% show negative transfer , and the risk isn't evenly spread: ALFWorld skills backfire in 47% of pairings, while SpreadsheetBench and SWE-bench-Verified hold steady at 13%. Being a strong task performer doesn't make a model a good skill writer: on SpreadsheetBench, Gemini-3.1-Flash-Lite extracts the highest-value skills despite GPT-5.4 posting the stronger raw baseline, and the same pool of extractors pays off very differently depending on which model ends up consuming the skill.

Web agents that click through visual interfaces usually get more capable by spending more at inference: sampling multiple rollouts, adding a verifier pass, or running an offline discovery phase before the real task starts. Trace VisualWebArena trajectories and the waste has a shape: agents loop on repeat actions that burn steps without changing the page state, tool-discovery phases quietly cost roughly 100 steps per tool once a library passes 50 tools, and most baseline pipelines reuse under 11% of their prompt through caching. PANDO answers with a single-rollout design — no sampling, no pre-evaluation discovery budget — built around a structured Skill Library of pattern-triggered rules and parameterized routines, a reflector that checks whether a step actually moved the task forward, confidence-based demotion for skills that keep failing, hierarchical routing that reserves expensive reasoning for novel planning, and a prompt layout built to keep prompt cache utilization high.

Most self-evolving agent frameworks quietly assume away the hardest case: deployment with nothing but a task prompt, no example skills, no successful past runs, no verifier to grade attempts. OpenSkill is built for exactly that gap -- what it calls open-world self-evolution -- via a three-stage pipeline. Stage 1 sends the agent out to query documentation, repositories, and the web for two separate things: knowledge for building the skill, and independently checkable verification anchors -- reference values, dataset statistics, documented output formats -- that never touch the benchmark's actual answer key. Stage 2 drafts one to four candidate skills and grades them with a virtual verifier , an isolated LLM session that writes a deterministic test suite grounded in those anchors rather than in ground truth, then runs up to three rounds of failure-diagnosis-and-rewrite until a skill clears its own self-built tests. Stage 3 freezes the winner and deploys it zero-shot to a target agent; the hidden ground-truth tests get touched only at that final step, never during construction.

Voyager pairs GPT-4 with three components instead of one clever prompt. An automatic curriculum proposes the next Minecraft objective by reading the agent's live state against its history of completed and failed tasks. A skill library stores the results as executable JavaScript functions, indexed by embeddings of their own descriptions and pulled back out via nearest-neighbor lookup. Before anything is committed to that library, an iterative prompting mechanism folds in game feedback and interpreter errors, and a dedicated self-verification critic judges whether the skill actually worked. None of this involves fine-tuning: GPT-4 (gpt-4-0314) is queried as a black box for curriculum, code generation, and verification; GPT-3.5 handles cheaper auxiliary text; embeddings come from text-embedding-ada-002.

STEVE is an embodied agent for Minecraft built from three linked modules: a vision encoder (EfficientFormer) that tokenizes what the agent sees, a LLaMA-2-13B instruction core split into four roles (planner, critic, curriculum generator, describer), and a code-action module that never writes new code. Instead, it matches each planned step against a fixed library of 210 skill scripts spanning eight categories — collecting and crafting among them — via skill retrieval , using cosine similarity between the step description and each script's embedding. Training runs in two stages: offline supervised fine-tuning on the STEVE-21K dataset (600 first-person gameplay clips across six terrains, 20K Minecraft QA pairs), then online fine-tuning inside the MineDojo/Mineflayer simulator across 5,000 episodes, with GPT-4 standing in as the expert supervisor.

SkillFlow treats skill selection as a search problem, not a context-stuffing problem. Given a task, it runs dense retrieval over roughly 36,000 community-contributed SKILL.md files scraped from GitHub, pulling back about 1,000 candidates with a bi-encoder. Two rounds of cross-encoder reranking narrow that further: a shallow pass on truncated text cuts to around 100 candidates, then a deep pass on full content cuts to about 10, before an LLM makes the final call and keeps five skills or fewer. The pipeline is evaluated on two coding benchmarks: SkillsBench, where 87 tasks come paired with 229 known oracle-matched skills, and Terminal-Bench, 89 tasks with no matched-skill ground truth at all.

Skill0.5 stops treating every agent skill the same way. The usual binary — full skill externalization , where skills sit in the prompt at ever-growing token cost, versus full internalization, where they're baked into weights at ever-growing risk of overfitting — gets replaced with a router that reassigns each task in real time, based on the model's measured pass rate over several sampled rollouts. Tasks with zero successes go through privileged distillation : the model is rolled out first with an enriched prompt containing general, domain-agnostic skills, its successful trajectories become a teacher target, and a token-level Jensen-Shannon divergence loss trains the ordinary skill-free policy to match that teacher's output distribution — folding general strategy into the weights without paying for it at inference. Tasks with middling success get standard GRPO to push up raw success rate. Tasks that are already succeeding often — precisely where an agent is most likely to have learned a shortcut instead of actually reading the retrieved skill — get re-run with the task-specific skill deleted from the prompt; if removing it barely hurts performance, that gap gets folded into the advantage as a penalty that suppresses the shortcut. Everything runs on Qwen2.5-7B-Instruct with GRPO (group size 8) and skill retrieval via Qwen3-Embedding-0.6B.

CoEvoSkills leans on a distinction Anthropic drew when it introduced agent skills : a tool is a single self-contained function, but a skill is a structured bundle of interdependent instructions, scripts, and reference files. Today those bundles are still hand-authored, and it shows — human-curated skills post uneven results on SkillsBench , helpful in most domains but actively degrading performance in others, such as Natural Science. The likely culprit is human-machine cognitive misalignment : a gap between how a person explains a task and how an agent actually needs to execute it. CoEvoSkills replaces manual authoring with two co-evolving LLM sessions: a Skill Generator that rewrites the skill bundle each round, and a Surrogate Verifier — an informationally isolated session that never sees the generator's reasoning or code — which writes and escalates its own test assertions. A held-out ground-truth oracle returns only a pass/fail bit, no test content; that opacity is the mechanism, not a limitation. When the surrogate's own tests pass but the oracle still fails, the blank signal is what forces the verifier to write harder tests, not any direct exposure to what actually went wrong.

SkillWeaver turns a web agent loose on a new site and runs a tight loop: the agent discovers candidate skills, executes them repeatedly for practice, then distills the successful attempts into small, callable API functions instead of raw click-by-click logs. Later rounds draw on that growing skill library , so the agent composes earlier APIs into more complex ones rather than relearning a site from scratch every time.

Agent Skills bundle a SKILL.md manifest with scripts, reference documents, and repository context, so auditing one before it loads means reviewing several files as a unit rather than screening a single prompt. Sorting a package into benign, suspicious, or malicious takes four stages: pull role-weighted evidence out of every file, route only the uncertain cases to a semantic verifier, arbitrate between competing attack-chain readings — a hidden override, a disguised data transfer, a remote bootstrap dependency — then check the verdict against the package's semantics-preserving rewrites , escalating to "malicious" only once every rewrite agrees. That pipeline is SkillGuard-Robust, tested on SkillGuardBench plus two public-ecosystem extensions, across five evaluation views spanning 254 to 404 packages each.

Skills-Coach puts a skill through a four-stage self-improvement loop. First, a task generator reads the skill's own specification and writes a test suite of standard, advanced, and boundary-case tasks. Then a Training-Free GRPO optimizer rewrites the skill's instructions and code in parallel — generating multiple variants and scoring them against each other, with no gradient updates and no backprop through model weights. A Comparative Execution Module runs the original and the optimized version on identical tasks inside isolated environments; a Traceable Evaluation Module then grades both against 51 explicit criteria spread across 8 dimensions, with the pass line set at 70% of the maximum score. Execution comes in two modes — a fast 'virtual' mode that estimates completion from keyword matches and hash-seeded pseudo-randomness, and a 'real' mode that actually runs the skill and inspects its output files, logs, and errors. To test the whole pipeline, the authors built Skill-X , a 48-skill benchmark drawn from the Anthropic, Clawhub, and Vercel Labs skill libraries — 29 instruction-only, 19 shipped with code.

SkillWiki treats an agent skill as a governed, versioned asset, not a stored prompt or memory snippet — the same move Wikipedia made for articles and Git made for code. The system ingests five kinds of raw material (trajectories, documents, API specifications, scripts, and historical skill files), then runs them through a knowledge-grounded construction pipeline that extracts reusable actions and workflows while keeping every skill linked back to its originating evidence via a Skill Provenance Graph . Each skill carries a lifecycle state — one of eight, from Raw Experience and Candidate through Verified, Released, Degraded, Deprecated, and Archived — and sits in a three-tier taxonomy of atomic, functional, and strategic skills. Nothing changes directly: edits pass through a Git-style governance workflow of candidate diffs, review, and release, run largely by autonomous self-management agents that flag breaking changes, with humans holding override authority at every step.

SKIM (SKIll coMpression) replaces a reusable agent skill's full instructions with a small set of learned soft tokens , so the skill no longer has to be pasted into every prompt in full. A compressor model reads the skill text alongside a fixed budget of learnable slot tokens, an MLP projector maps the result into the target model's embedding space, and a LoRA adapter teaches the target LLM to treat those soft tokens as if it had read the source text directly. Training moves from general to specific across three stages: it first reconstructs 60.9k collected skills to build general procedural knowledge representations, warms up next on procedural question-answering over 214.3k WikiHow-derived QA examples, and finally aligns on roughly 60k skill-conditioned QA examples via LoRA fine-tuning with the target model. Skill complexity varies enormously, so before deployment SKIM runs what the paper calls offline resolution selection : generate diagnostic questions from a skill, check how well answers at each token budget (256, 512, or full text) match the full-text answer, and lock in the smallest budget that clears a fidelity bar — all computed once, offline, before the skill is ever deployed.

XSkill splits a multimodal agent's reusable memory into two separate structures instead of one. A skill library holds stable, task-level workflows and tool templates in Markdown. A companion experience bank holds short, disposable condition-action notes in JSON, each capped at a few dozen words. Both are built and retrieved from the agent's actual screenshots rather than text logs alone. A rollout summarization step reads each image alongside the trajectory and records which visual cue — an inverted photo, a washed-out region — triggered which action. A cross-rollout critique then contrasts successful and failed attempts on the same task to decide what gets added or rewritten in the experience bank. A periodic consolidation pass merges near-duplicate entries and prunes the weak ones, so the knowledge base doesn't bloat over time. At inference, a task decomposition retrieval step breaks a new query into sub-needs and retrieves matching skill sections and experiences for each. It rewrites them against the current images and folds the result into the system prompt — a reference the agent can deviate from, not a fixed script.

Self-evolving agent loops assume a reliable evaluator already exists to grade each attempt. This paper drops that assumption and evolves the evaluator itself. The metric takes shape as an expression tree of small, single-purpose drawback detectors — deterministic checks, sandboxed executions, narrow LLM judge calls — combined through AND/OR/K-of-k voting. Candidates are selected for their agreement with a tiny ten-item anchored reference set (soft labels from a teacher model), then reweighted by consensus across detectors on a much larger pool of unlabeled outputs. The final score comes from a held-out locked set that no training loop ever touches. This metric loop runs alongside a skill-evolution loop — the authors' own prior system — in a paired setup they call Double Ratchet : the evolved metric grades the skill loop's training attempts, while the skill loop's actual held-out score is measured only against the untouched locked anchor.

The working assumption behind skill-augmented agents — write a reusable procedural note into a retrievable skill bank , retrieve it on a later task — is that a stronger model writes a more trustworthy skill. Zhang and coauthors test that assumption directly, and it fails: skills GPT-5.4 writes while training agents on ALFWorld and WebShop carry a mean marginal utility near zero, even though a real subset of them helps and the rest actively hurts. The catch is that once a skill lands in the bank, its effect on later rollouts tangles up with every other skill retrieved alongside it — there's no clean signal for what any single skill contributed. Their framework, SAPO (Skill-Augmented Policy Optimization), tests each candidate before it reaches long-term memory. For a given task and its currently retrieved skills, SAPO splits the normal rollout budget into two matched halves: base rollouts run under the existing skill context alone, skill-augmented rollouts run under that same context plus one new candidate drawn from the base trajectories. The reward gap between the two halves is the candidate's marginal value in that exact context, computed from rollouts the training loop was already generating — validation costs nothing extra.

GRASP treats agent self-improvement as edits to a small, versioned skill library , not an ever-growing memory dump. When an agent fails, the failure gets a mechanism-specific label, and a proposer drafts several candidate fixes — add, modify, or remove a skill — aimed first at whichever failure type is most common. Before anything gets written into the library, each candidate has to survive a regression gate : it runs against a held-out probe of past-failing and past-passing episodes, and only sticks if it fixes more than it breaks and stays under a hard cap on new regressions. Testing spanned five base models — gpt-oss-120b, DeepSeek V4 Flash, Gemini 3.1 Flash Lite, GPT-4.1, GPT-5.4 — on two FHIR-based clinical agent benchmarks, then checked whether the mechanism holds outside medicine.

SkillForge builds and maintains agent skills for cloud technical-support agents at Alibaba Cloud, closing a loop that most skill-authoring setups leave open. A Domain-Contextualized Skill Creator writes the initial skill by mining historical support tickets, tool-usage logs, and internal documentation — not a generic prompt working blind. From there, a three-stage pipeline (Failure Analyzer, Skill Diagnostician, Skill Optimizer) batches failed task executions, traces each one back to a specific section of the skill file, and rewrites only that section. The team ran it across five real cloud-support scenarios — Account, Domain, DNS, OSS, ECS — spanning 1,883 tickets and 3,737 tasks, with Qwen3-Max as the backbone and an LLM judge (validated at over 90% agreement with human experts) scoring each response against what a human engineer actually used to resolve the ticket.

Skill-R1 leaves the task-solving model frozen and trains something else entirely: a lightweight editor that rewrites the agent skill itself, generation after generation. Each round, the current skill induces a batch of rollouts from the frozen model (GPT-4o-mini here), a verifier scores them, and the editor reads those rollouts plus their pass/fail outcomes to write the next revision. Training uses a bi-level GRPO objective — an intra-generation term does the standard group-relative comparison among rollouts that share a skill, while an inter-generation term only rewards a revision if the population's mean reward actually climbed from the last round. Gradients never touch the task model, which is why the method works identically on open-weight or closed-source models — the paper calls this black-box compatibility .

Most reusable agent skills today are pure text — instructions, reasoning traces, summarized trajectories. For GUI manipulation, layout work, counting, and other visual-centric tasks, the knowledge worth reusing is spatial: hit regions, alignment, running state. Prose alone underspecifies or discards it, a gap this paper calls the textual bottleneck . Its fix is Visual Skill , a representation that pairs declarative text logic with explicit visual support and a binding rule for when to invoke it. Visual support comes in three forms — static priors (wireframes or annotated templates that fix a spatial convention across similar screens), dynamic priors (in-situ visual traces — anchors, counting marks, visited-region overlays — that carry state between steps), and interleaved visual skills (ordered text steps bound to the exact screenshot, frame, or region that justifies each one). AutoVisualSkill , the accompanying authoring pipeline, builds these artifacts automatically from a task trajectory — packaging textual logic, visual assets, and a binding manifest into one skill directory instead of compressing everything into prose.

Agent skill induction ( ASI ) lets a web-browsing agent mine its own successful task runs for reusable Python functions, instead of jotting down prose notes. Once a task finishes, the agent drafts candidate skill functions — say, a search_product(name) that chains together clicks and form fills — then rewrites the original trajectory to call those functions as a prefix and lets itself finish the task from there. A skill only earns a permanent slot in the agent's action space once that run clears three checks against the live environment: an LLM evaluator confirms the task was actually solved, the run actually invoked the new skill, and the skill's calls actually changed something on the page, not just executed without error. The setup is tested on WebArena (812 tasks spanning shopping, forums, dev tooling, content management, and travel/maps), with Claude 3.5 Sonnet running the agent, the evaluator, and the induction step itself, against a static non-adaptive baseline and against AWM , a prior method that induces the same kind of workflow knowledge but keeps it as free-text notes in memory instead of executable code.

SkillSafetyBench tests a blind spot in agent safety evaluation: the user's request stays completely benign, but the exploit rides in through the skill itself. The benchmark packages 155 adversarial cases across 47 executable tasks, 6 risk domains, and 30 canonical safety categories, and each case buries its attack not in the user's prompt but in skill-facing non-user attack surfaces — the helper scripts, wrappers, memory stores, retrieval corpora, and dependency manifests that ship alongside a skill and get treated as trusted workflow context. SkillSafetyBench pairs every case with a runnable environment and a case-specific rule-based verifier that checks concrete run artifacts — leaked payloads, poisoned memory records, malicious trace patterns — rather than judging the agent's final answer. The taxonomy and verifiers cleared expert review and a two-judge LLM-as-judge protocol alike, posting pass rates above 85% on camouflage quality, verifier-attack alignment, and taxonomy placement, with inter-judge agreement above 91% on every axis.

Agent skills look solved from the outside: descriptors load, tools get pre-approved, marketplaces push updates. Underneath that surface, a systematic review of 37 production agent systems and 51 research papers pulled out 342 distinct architectural practices — consolidated first into 50 candidate patterns, then distilled into a catalogue of 10 (five core, five supporting), and synthesized into a four-layer reference architecture: Supply Chain, Mediation, Execution Control, and Evidence & Feedback. The framing hinges on a distinction the authors name skill-in-use : a skill file sitting in a repo is inert, and its real architectural responsibilities only switch on once it's selected for a specific run, bound to authority limits, interpreted by a stochastic agent, and logged as evidence. Two patterns give that vocabulary teeth. Skill–Execution Authority Separation keeps a skill's reference to a capability from being treated as an automatic grant of it, and the Runtime Skill Bill of Materials is a per-run ledger of exactly which skill artefact, version, and scope actually participated.