Topic
A SKILL.md file changes what every coding agent on a team does the next time it loads. How to write descriptions that trigger, keep skills small, version and review them, pick a distribution model from git to plugin marketplaces to a private registry, and roll a bad release back.
The model is not a security boundary. Eight concrete failures in LLM apps and agents, from provider keys in browser bundles to injected tool calls and runaway spend, each mapped to the OWASP LLM Top 10, with the code-level fix and an open-source agent skill that audits a codebase for them.
A Claude Code skill is a folder of instructions the agent loads only when a task calls for it. Six MIT-licensed skills for security, observability, cost, MCP, coding-agent governance and skill management, ranked on stated criteria, installed and linted in a clean repository.
Installing Claude Code takes a minute. Rolling it out to two hundred engineers without a surprise bill, a shared API key or an unknown MCP server on every laptop takes a plan: a provider choice, managed settings, one credential per developer, budgets, CI keys and a way to tell whether it is paying off.
A Codex skill is a folder with a SKILL.md file that the CLI and IDE extension find in .agents/skills and load when a task matches its description. Scan paths, the context budget, writing one that triggers, installing shared skills with npx skills, and six worth adding for LLM app teams.
Cursor loads Agent Skills from .agents/skills and .cursor/skills and lets the agent decide when each one applies. How that decision works, how skills compare with .cursor/rules and AGENTS.md, how to install shared skills with npx skills, and three skills that fix MCP sprawl and blind spots.
Every LLM bill is requests times tokens times price. A playbook for shrinking each factor without a quality regression: attribution, right-sized models, complexity routing, prompt trimming, prompt and response caching, Batch APIs, loop caps and budgets, plus the open-source llm-cost-reduction agent skill.
A practical explainer on LLM observability: the per-call record, time to first token, OpenTelemetry GenAI conventions, trace structure for agents, sampling and PII redaction, Prometheus alert thresholds, feedback joins and evals on production traffic, plus the open-source llm-observability-stack agent skill.
Connecting one MCP server takes a line of config. Running twenty safely across a team takes tool budgets, per-identity allow-lists, approval gates, sane transports, health checks and logs. The practices, checked against the 2026-07-28 MCP specification, and an open-source agent skill that audits a setup against them.
The skills CLI installs SKILL.md folders from GitHub into 79 coding agents, and skills.sh is the directory built on its telemetry. Every command in version 1.7.4, project and global scope, the symlink layout, the lock file and its hashes, and the warning printed on every install, checked against the source.