Source-linked AI summary
Agent Skills for Large Language Models: Architecture, Acquisition, Security, and the Path Forward
Renjun Xu, Yang Yan
TL;DR
General-purpose LLM agents lack specialized, composable procedural expertise, motivating a modular skill abstraction. The survey synthesizes the architecture, acquisition, deployment, and security of agent skills, with reported gains in task performance and efficiency alongside substantial vulnerabilities. It proposes architecture-aware governance and identifies open problems for trustworthy skill ecosystems.
Problem
General-purpose models provide broad knowledge but lack the specialized procedural expertise that real-world tasks demand, while fine-tuning is costly and RAG passages are passive.
Method
The survey systematically analyzes the SKILL.md architecture, progressive disclosure, MCP relationships, acquisition methods, deployment settings, security studies, governance, and open challenges.
Results
26.1% of analyzed community skills contain at least one vulnerability, while the survey reports SAGE achieving 72.0% Task Goal Completion on AppWorld.
Takeaways & Limitations
Agent skills shift LLM capability extension toward modular expertise, while trustworthy deployment requires graduated permissions aligned with provenance and verification.
Takeaways & Limitations
The proposed Trust and Lifecycle Governance Framework is a governance proposal rather than an empirically validated system, and standardized skill verification remains open.
Abstract
from arXiv · showhide
The transition from monolithic language models to modular, skill-equipped agents marks a defining shift in how large language models (LLMs) are deployed in practice. Rather than encoding all procedural knowledge within model weights, agent skills -- composable packages of instructions, code, and resources that agents load on demand -- enable dynamic capability extension without retraining. It is formalized in a paradigm of progressive disclosure, portable skill definitions, and integration with the Model Context Protocol (MCP). This survey provides a comprehensive treatment of the agent skills landscape, as it has rapidly evolved during the last few months. We organize the field along four axes: (i) architectural foundations, examining the SKILL$.$md specification, progressive context loading, and the complementary roles of skills and MCP; (ii) skill acquisition, covering reinforcement learning with skill libraries, autonomous skill discovery (SEAgent), and compositional skill synthesis; (iii) deployment at scale, including the computer-use agent (CUA) stack, GUI grounding advances, and benchmark progress on OSWorld and SWE-bench; and (iv) security, where recent empirical analyses reveal that 26.1% of community-contributed skills contain vulnerabilities, motivating our proposed Skill Trust and Lifecycle Governance Framework -- a four-tier, gate-based permission model that maps skill provenance to graduated deployment capabilities. We identify seven open challenges -- from cross-platform skill portability to capability-based permission models -- and propose a research agenda for realizing trustworthy, self-improving skill ecosystems. Unlike prior surveys that broadly cover LLM agents or tool use, this work focuses specifically on the emerging skill abstraction layer and its implications for the next generation of agentic systems. Project repo: https://github.com/scienceaix/agentskills
1 Introduction
The paper presents agent skills as a modular layer for supplying procedural expertise that general-purpose models and passive retrieval lack. It surveys the architecture, acquisition methods, deployment settings, and security governance of this emerging paradigm.
- Motivation: The paradigm addresses the gap between broad model knowledge and the specialized procedural expertise required by real-world tasks.Fine-tuning is costly and limited in composability, while retrieved passages cannot prescribe workflows or adapt permissions.
- Motivation: Agent skills package domain-specific instructions, code, references, and assets for on-demand capability extension without retraining.They are filesystem-based packages discovered and loaded when relevant tasks arise.
- Architectural context: Skills and MCP form complementary layers: skills provide procedural guidance, while MCP connects agents to external data and tools.This combination supports a standardized agentic stack for packaging expertise and accessing external capabilities.
- Scope and contributions: The survey focuses specifically on the skill abstraction layer, which prior surveys of LLM agents, tool use, and GUI agents did not examine directly.Its scope covers architecture, acquisition, deployment, security, governance, and open challenges.
- Scope and contributions: Its contributions include a systematic architecture analysis, an acquisition taxonomy, deployment assessment, security synthesis, a governance framework, and seven open challenges.The governance framework maps acquisition provenance through verification gates to graduated deployment permissions.
2 Background and Scope
The paper situates skill engineering as a higher-order capability layer that evolves beyond ephemeral prompts and atomic tool calls. It narrows its review to agent skills and their immediate ecosystem, with extended attention to software-facing computer-use environments.
- Capability-extension paradigms: Prompt engineering elicited useful behaviors but produced instructions that were ephemeral, non-modular, and difficult to version or share.The paper places this paradigm in the 2022–2023 period.
- Capability-extension paradigms: Tool use and function calling enabled external API access, but tools remained atomic operations that did not reshape task understanding.The paper places this paradigm in the 2023–2024 period.
- Capability-extension paradigms: Skill engineering bundles instructions, workflow guidance, scripts, documentation, and metadata for dynamic loading during coordinated multi-step tasks.The paper describes this as a higher-order abstraction emerging from 2025 onward.
- Related work: Earlier work explored generated skill libraries and tool creation, whereas Agent Skills emphasizes human-authored, portable, and governed packages for product environments.The comparison includes Voyager, CREATOR, Large Language Models as Tool Makers, and Toolformer.
- Review scope: The survey searches major research and technical-publication venues for skill- and tool-related work while explicitly excluding broad agent-architecture and tool-use surveys.Computer-use agents receive extended treatment because software-facing skill packaging matured there.
3 Architectural Foundations
Agent Skills use progressive disclosure to expose minimal metadata first, procedural instructions when triggered, and deeper resources on demand. MCP complements this architecture by supplying standardized connectivity rather than procedural intelligence.
- SKILL.md specification: A skill directory centers on SKILL.md, whose YAML frontmatter supplies a name and description that the agent pre-loads at startup.This metadata enables large skill libraries without loading their full contents into context.
- Progressive disclosure: The three-level progressive-disclosure design loads metadata, instructions, and additional resources in stages to reduce context consumption while preserving deep procedural knowledge.Level 1 acts as a table of contents, Level 2 as chapter content, and Level 3 as technical appendices.
- Skill execution: When a request matches a skill description, the agent injects its instructions and resources into context and activates pre-approved tools and permissions.Execution changes the agent’s preparation and execution context before response generation.
- Skills and MCP: MCP standardizes agent connections to external data and tools through JSON-RPC 2.0 primitives for tools, resources, and prompts.The protocol supplies connectivity, while skills provide procedural guidance for using and interpreting those connections.
- Skills and tools: Advanced Tool Use adds programmatic tool discovery, code-mediated calling, and tool learning to deepen skill–tool integration.The cited report describes up to 85% lower token overhead from tool search and accuracy rising from 79.5% to 88.1% in its stated benchmark.
4 Skill Acquisition and Learning
The survey organizes skill acquisition into human authoring, reinforcement learning, autonomous discovery, structured knowledge engineering, and compositional synthesis. Reported results show gains in task performance and efficiency, while larger libraries can impair skill selection.
- Human authoring: Human authoring remains the most immediately impactful modality, with skills expressible as short Markdown packages and scaffoldable from natural-language descriptions.Partner organizations have also produced production-grade skills encoding proprietary workflows.
- Reinforcement learning: SAGE uses sequential rollouts and a skill-integrated reward to preserve reusable skills across related tasks while rewarding their creation.The reward combines outcome verification with a signal for high-quality, reusable skills.
- Reinforcement learning: 72.0% Task Goal Completion and 60.7% Scenario Goal Completion were achieved by SAGE on AppWorld, an 8.9% absolute improvement over baseline GRPO without skill libraries.SAGE also required 26% fewer interaction steps and 59% fewer generated tokens.
- Autonomous discovery: SEAgent autonomously discovers skills through world-state assessment, curriculum generation, software-guidebook memory, and specialist-to-generalist training.On five novel OSWorld environments, it improves success rates from 11.3% to 34.5%.
- Structured skill engineering: CUA-Skill encodes computer-use expertise as parameterized execution and composition graphs with typed parameters, preconditions, and recovery mechanisms.It reports a 57.5% success rate on WindowsAgentArena.
- Compositional synthesis: Agentic Proposing dynamically composes modular reasoning skills during problem solving, with a reported 91.6% on AIME 2025 for a 30B-parameter solver.The cited evaluation presents composition as producing capabilities beyond any individual skill.
- Library-scale limitations: Skill libraries have a critical-size limitation: beyond a threshold, skill-selection accuracy degrades sharply.This indicates a practical limit on how many skills one agent can effectively manage.
5 Deployment: Agents, Benchmarks, and the Computer-Use Stack
Computer-use agents are a central deployment domain for skills because GUI tasks require reusable perception–grounding–action sequences. Recent architectures and benchmarks show rapid progress, while harder, longer-horizon, and hybrid settings still expose substantial gaps.
- GUI Agent Architectures: CUAs combine skill libraries, perception and grounding modules, MCP connectivity, and operating-system actions in a unified execution stack.The architecture treats GUI operation as a coordinated perception–grounding–action loop supported by reusable procedural knowledge.
- GUI Agent Architectures: 47.5% on OSWorld and 73.3% on AndroidWorld were reported for UI-TARS-2 after scalable trajectory generation and stabilized multi-turn reinforcement learning.UI-TARS-2 extends UI-TARS with a data flywheel for trajectory generation and multi-turn RL stabilization.
- GUI Agent Architectures: 18.9% and 32.7% relative improvements over Claude Computer Use and UI-TARS, respectively, were reported for Agent S2 on OSWorld.Agent S2 uses a compositional generalist-specialist framework with Mixture-of-Grounding for precise GUI localization.
- GUI Agent Architectures: 45.0% on OSWorld-Verified was achieved by OpenCUA-72B, alongside AgentNet, a dataset spanning three operating systems and over 200 applications.OpenCUA is presented as a comprehensive open-source framework for computer-use agents.
- GUI Grounding: Up to 20% absolute improvement was reported for UGround, while Jedi improved OSWorld agentic success from 5% to 27% through scaled or synthesized grounding data.UGround used 10 million GUI elements from 1.3 million screenshots; Jedi scaled grounding data to 4 million examples.
- GUI Grounding: 47.3% on ScreenSpot-Pro was achieved by a 7B model, outperforming UI-TARS-72B by 24.2 percentage points with 3,000 training samples.The result came from reinforcement-learning-based self-evolutionary training.
- Benchmark Landscape: 72.6% versus 72.36% on OSWorld-V indicates parity with the published human baseline, but benchmark-specific saturation does not establish generalized human superiority.More challenging professional, long-horizon, hybrid GUI-code, software-maintenance, and function-calling settings continue to expose gaps.
6 Security of Agent Skills
Agent skills introduce a significant attack surface because trusted natural-language instructions can control executable behavior and agent permissions. Empirical studies find widespread vulnerabilities and motivate a graduated governance framework using verification gates, trust tiers, and runtime monitoring.
- Attack Surface: Prompt injections embedded in long SKILL.md files and referenced scripts can exfiltrate internal files or passwords and bypass system-level guardrails.A prior benign task-specific approval with “Don’t ask again” can carry over to closely related harmful actions.
- Vulnerabilities at Scale: 26.1% of 31,132 analyzed skills contained at least one vulnerability across 14 patterns spanning prompt injection, data exfiltration, privilege escalation, and supply-chain risks.The skills were collected from two major marketplaces and analyzed with SkillScan, combining static analysis and LLM-based semantic classification.
- Vulnerabilities at Scale: Skills bundling executable scripts were 2.12× more likely to contain vulnerabilities, while 5.2% exhibited high-severity patterns strongly suggesting malicious intent.The association was statistically significant with OR=2.12 and p<0.001.
- Vulnerabilities at Scale: Among 157 confirmed malicious skills with 632 vulnerabilities, researchers identified Data Thieves and Agent Hijackers, with one actor accounting for 54.1% of confirmed cases.The dataset was constructed by behaviorally verifying 98,380 skills from two community registries.
- Security Motivation: The current implicit trust model is untenable because skill risk includes installation-time maliciousness and later misalignment among purpose, instructions, scripts, dependencies, and runtime behavior.The governance problem therefore includes lifecycle alignment, not only initial screening.
- Governance Framework: Four sequential verification gates use static analysis, semantic classification, behavioral sandboxing, and permission-manifest comparison as defense in depth.G1 flags known signatures, G2 detects intent mismatches, and G3 identifies side effects invisible to static analysis.
- Governance Framework: Four graduated trust tiers map provenance and gate results to permissions, from isolated instructions-only access for unvetted community skills to full capabilities for vendor-certified skills.The framework replaces binary safe/unsafe decisions with least-privilege deployment levels.
- Governance Framework: Runtime monitoring can demote or revoke skills after anomalous behavior and promote skills with clean histories.The framework maps progressive disclosure levels to trust: metadata at T1, instructions at T2+, and executable scripts at T3 or T4.
7 Open Challenges and Research Agenda
The survey identifies seven open challenges spanning portability, selection, composition, permissions, verification, continual learning, and evaluation. Together, these challenges constrain the development of scalable, governable skill ecosystems.
- Cross-Platform Portability: Cross-platform portability remains aspirational because skills may depend on platform-specific environments, tool signatures, and model behaviors.The proposed remedies are a universal skill runtime or compilation targeting different agent platforms.
- Skill Selection at Scale: Skill selection becomes combinatorially challenging as enterprise libraries grow to hundreds or thousands of skills.Tool Search partially addresses the problem, but the fundamental scaling challenge persists.
- Skill Composition and Orchestration: Multi-skill orchestration lacks principled solutions for conflict resolution, resource sharing, and failure recovery.Composition graphs and dynamic composition provide initial approaches.
- Capability-Based Permission Models: Implicit trust lets loaded skills direct agents to use any available tool, motivating explicit capability-based permission grants.The survey argues that declaring required permissions and requiring agent or user approval would reduce the attack surface.
- Skill Verification and Testing: Standardized skill verification and testing remain open problems, including checks for overreach, deadlocks, cascading failures, and permission escalation.The proposed evaluation scope includes negative tests for hallucinated procedures and adversarial skill chaining.
- Continual Skill Learning Without Catastrophic Forgetting: The interaction between dynamically loaded skills and base-model capabilities remains poorly understood, including whether skills can overwrite useful default behaviors.Self-distillation is identified as a promising path for continual learning without degrading existing capabilities.
- Evaluation Methodology: Current benchmarks emphasize task completion, leaving skill reusability, composability, and maintainability insufficiently measured.The survey calls for metrics that evaluate skill ecosystems rather than only individual agent runs.
8 Discussion
Agent skills can preserve institutional knowledge and create network effects through open standards, but their openness introduces urgent security and governance demands. The survey proposes graduated trust tiers while identifying a need to connect learned skills with inspectable, portable artifacts.
- Practical and Ecosystem Consequences: Open skill standards can preserve institutional knowledge through personnel turnover and increase platform value as more skills enter the commons.The survey presents skills as a digital analogue of standard operating procedures and describes network effects from shared contributions.
- Security and Governance: 26.1% of community-contributed skills contain vulnerabilities, motivating graduated trust tiers that align permissions with provenance and verification depth.The framework replaces binary accept-or-reject decisions with differentiated deployment capabilities.
- Acquisition and Deployment: Learned skills remain model-internal and therefore cannot be inspected, shared, or governed like human-authored SKILL.md files.The survey identifies externalizing learned skills as portable, auditable artifacts as a way to bridge acquisition and deployment.
9 Conclusion
The conclusion presents agent skills as a modular abstraction that has gained broad ecosystem adoption and organizes the field around architecture, acquisition, deployment, and security. It argues that future progress depends on inspectable learning, permission models, skill-quality evaluation, and governance that balances openness with safety.
- Conclusion: Agent skills package procedural expertise into composable, portable, dynamically loadable modules for specialized task requirements.The conclusion frames this as a shift from monolithic intelligence to modular expertise.
- Conclusion: Adoption across multiple frontier model providers followed Anthropic’s October 2025 launch and December 2025 open standardization.The conclusion uses this cross-provider adoption as evidence of convergence on the abstraction.
- Conclusion: The survey covers architectural foundations, acquisition methods, CUA-focused deployment, and security while identifying governance, portability, and composition as the next frontier.These dimensions and challenges define the paper’s overall synthesis of the field.
- Research Agenda: Future progress requires skill-learning methods that produce inspectable artifacts, usable permission models, skill-quality evaluation, and governance balancing openness with safety.The agenda targets ecosystem-level development rather than task completion alone.