LIVE
Anthropic says Claude helped trace the origin of NIST's mysterious ECDSA seeds16/10/26 · Anthropic|Reflection AI unveils Beam, a 501-billion-parameter open model16/10/26 · Reflection AI|Meta releases Muse Spark Open, a mixture-of-experts model built for local Mac Studio inference15/10/26 · Meta|Meta releases Muse Spark Open, an open-weight multimodal model15/10/26 · Meta|Google DeepMind outlines safety measures behind Gemini 4 Argon13/10/26 · Google DeepMind|Tev-Gym: A Training Recipe to Fix Sparse Rewards in Long-Horizon Agents13/10/26|Google DeepMind references Gemini 4, code-named Argon13/10/26 · Google DeepMind|Google DeepMind unveils Gemini 4 Argon, a robotics-focused variant13/10/26 · Google DeepMind|Character.AI files for Chapter 11 bankruptcy, sells assets to Disney13/10/26 · Character.AI|Study Shows AI Models Can Provably Conceal Arbitrary Capabilities13/10/26|Websites are increasingly shutting out AI agents18/10/26|NVIDIA RTX Spark laptops bring local AI to premium Windows PCs17/10/26 · NVIDIA|Anthropic says Claude helped trace the origin of NIST's mysterious ECDSA seeds16/10/26 · Anthropic|Reflection AI unveils Beam, a 501-billion-parameter open model16/10/26 · Reflection AI|Meta releases Muse Spark Open, a mixture-of-experts model built for local Mac Studio inference15/10/26 · Meta|Meta releases Muse Spark Open, an open-weight multimodal model15/10/26 · Meta|Google DeepMind outlines safety measures behind Gemini 4 Argon13/10/26 · Google DeepMind|Tev-Gym: A Training Recipe to Fix Sparse Rewards in Long-Horizon Agents13/10/26|Google DeepMind references Gemini 4, code-named Argon13/10/26 · Google DeepMind|Google DeepMind unveils Gemini 4 Argon, a robotics-focused variant13/10/26 · Google DeepMind|Character.AI files for Chapter 11 bankruptcy, sells assets to Disney13/10/26 · Character.AI|Study Shows AI Models Can Provably Conceal Arbitrary Capabilities13/10/26|Websites are increasingly shutting out AI agents18/10/26|NVIDIA RTX Spark laptops bring local AI to premium Windows PCs17/10/26 · NVIDIA|
Intermediate🔬

Anatomy of a skill: the SKILL.md dissected

Step 2/9 of the Skills & MCP learning path. A SKILL.md file dissected line by line: the frontmatter, the trigger description, the instruction body, the bundled scripts. Why 20 well-structured lines can be worth three weeks of development.

12 min readPublished August 31, 2026· Updated September 17, 2026
📖 SKILLS the expertise manual SKILL.md + scripts loaded on demand ◉ you are here, steps 2 → 4 🧠 MODEL decides and orchestrates always sees the description loads the body if relevant context window 🤚 MCP the hands DBs, APIs, files, email… tools exposed to the model steps 5 → 8 reads calls result 🗺️ The path map, step 2/9: opening the manual Active zone: Skills. MCP waits its turn (steps 5 to 8).

A skill from the outside: a folder, not magic

Before opening the hood, the overview. A skill, on disk, is this:

meeting-summary/
├── SKILL.md          ← the core: frontmatter + instructions
├── scripts/          ← optional: deterministic supporting code
│   └── format_check.py
└── templates/        ← optional: templates, reference examples
    └── example-summary.md

Three observations that frame everything else:

It is text. No binaries, no proprietary format, no compilation. A skill can be read, diffed, and versioned in Git like any other file in the repository. That is a precious property, for review, for audit, for maintenance, and a limit you must know: everything in it will be readable in plain text inside a conversation context.

The SKILL.md is mandatory, the rest is optional. A minimal skill fits in a single file. Scripts and templates only appear when they bring something text cannot guarantee, more on that below.

The folder is self-contained. A well-designed skill does not depend on another skill to work. If you feel the need for an "import", that is the sign of a bad decomposition, back to the drawing board.

The frontmatter: the permanent storefront

Now let's open the file of our connecting thread, the meeting-summary skill we will build for real at step 3. Here is its header:

---
name: meeting-summary
description: Writes meeting summaries in the house format,   Decisions / Actions / Open points sections, factual tone, one
  page maximum. Use whenever someone asks for a meeting summary,
  minutes, a decision log or a meeting recap.
---

Two fields, and one fundamental asymmetry to understand:

name : the identifier. Short, lowercase, hyphenated. It is used to reference the skill (logs, management, explicit invocation). Purely technical role.

description : the storefront. It is the only part of the skill the model sees at all times. Everything else in the file, the instructions, the examples, the rules, is invisible until the model has decided, on the sole basis of this description, that the skill deserves to be loaded.

Read that last sentence again; it is the central mechanism: the model does not "rummage through" your skills on every request. It consults a catalog of descriptions, and loads, or not.

The description under the microscope

Since everything hinges there, let's dissect the one from our thread. It answers two questions, in this order:

1. What does the skill do? : "Writes meeting summaries in the house format : Decisions / Actions / Open points sections, factual tone, one page maximum." Concrete, specific, verifiable. Not "helps with document writing": that is a description that triggers nothing because it could trigger everything.

2. When to use it? : "Use whenever someone asks for a meeting summary, minutes, a decision log or a meeting recap." Note the choice of words: these are the phrasings users actually type, including "minutes". The description speaks the language of the requests it must intercept.

The comparison that makes the principle obvious:

❌ description: Helps produce quality documents for the team.
   → too vague: never loaded (or wrongly loaded on everything)

❌ description: Summary skill v2, replaces the old version,
   approved by Marc in March.
   → talks about the skill, not the task: the model finds
     no trigger signal in it

✅ description: Writes meeting summaries in the house format
   [...] Use whenever someone asks for a meeting summary,
   minutes, a decision log or a meeting recap.
   → what + when, in the users' own words
💡
THE concept of this step: progressive disclosure. Descriptions always visible (tiny cost, paid permanently), body loaded on demand (real cost, paid only when useful). This mechanism is what allows a library of dozens of skills without saturating the context window, and it is what makes the description the "SEO" of your skill: poorly indexed, it does not exist.

The body: the instructions

Once past the frontmatter gate, the body of the SKILL.md is loaded in full. This is where the expertise lives. Here is our thread's body (abridged, the full version is the deliverable of step 3):

# Meeting summary, house format

## Mandatory structure
1. **Context**, one line: date, attendees, purpose.
2. **Decisions**, what was settled. One decision per bullet,
   past tense, no conditionals.
3. **Actions**, who / what / by when. Never an action without
   an owner and a deadline; if either is missing, record it
   under Open points.
4. **Open points**, what remains to be settled, with the
   planned next step.

## Tone and style
- Factual. No commentary, no interpretation of intentions.
- One page maximum. Beyond that, summarize harder, no
  appendices.

## Edge cases
- Raw notes unreadable or contradictory: produce the summary
  of the clear points, explicitly list the gray areas under
  Open points. Never invent a decision.
- Sensitive HR or individual information: do not include it;
  flag its existence to the requester, outside the summary.

Three writing traits to remember, valid for all your future skills:

Imperative and concrete. "One decision per bullet, past tense", not "decisions should ideally be phrased clearly". A skill is a procedure, not a charter of good intentions.

Edge cases are written down. Contradictory notes, sensitive data: ambiguous situations are settled in the file, calmly, by you, rather than improvised by the model, in the moment, differently each time. That is exactly the value of a documented procedure: repeatability in non-nominal cases. ISO 27001-certified readers will recognize the principle.

Nothing superfluous. Every loaded line costs tokens and attention. Version history, acknowledgments, the project's political context: out. A skill body is judged like a runbook, whatever does not help execution has no place in it.

Bundled scripts: when text is not enough

Last compartment of the folder: supporting scripts. The dividing rule is simple,

Text for judgment, code for determinism.

Writing a synthesis, adapting a tone, settling an edge case: judgment → instructions. Verifying that an output respects a format, converting data, applying an exact transformation: determinism → a script the model executes, rather than an operation it does "in its head" with approximation risk.

In our thread, scripts/format_check.py verifies that the produced summary contains the four sections in order, a mechanical quality control, exactly the kind of task you do not leave to improvisation.

Security reflex (it returns in force at step 4): a skill can bundle scripts, and those scripts execute. Adopting a third-party skill without reading its SKILL.md and its scripts/ folder means running unaudited code, the very definition of supply-chain risk. House rule: read everything, beforehand, systematically.
📚Going deeper

For the geeks: the numbers behind progressive disclosure. Order of magnitude on our thread: the description ≈ 60 tokens, always visible; the full body ≈ 600 tokens, loaded on demand. With 20 skills on this template: ~1,200 tokens of permanent catalog versus ~12,000 tokens if everything lived in the system prompt, a 1-to-10 ratio, paid on every request, multiplied by the team's volume. The optimization reasoning is the same as in our LLM cost guide. Design corollary: the description must be sufficient to decide, never to do, if your description contains instructions, it is too long; if your body must be read to know when to trigger, the split is wrong.

📚Going deeper

For the geeks: what a SKILL.md is not. Three anti-patterns seen in the enterprise. Not a vault: no API keys, no credentials, the file is loaded in plain text into the context; secrets live on the MCP side and in environment variables (step 7). Not a permission system: writing "never access production" in a skill is a wish, not a control, actual rights are managed at the level of the exposed MCP tools (step 8). Not a knowledge base: if you paste 40 pages of product documentation into the body, you have reinvented a bad RAG, the skill holds the procedure, bulky knowledge stays in its own system with tooled access. The skill/RAG/MCP boundary from step 1 is not academic: each anti-pattern above is a boundary violation.

The three description pitfalls that kill a skill: 1. ❌ Too vague : "helps with writing": the model cannot tell when to trigger → never loaded, or loaded on everything 2. ❌ Self-centered : it describes the skill (version, author, history) instead of the task → no trigger signal 3. ❌ No user vocabulary : it says "structured post-meeting synthesis" when your teams say "minutes" → the rendezvous is missed

📍 Skills & MCP path, step 2/9

  1. 🗺️ The map before the territory
  2. 🔬 Anatomy of a skill ← you are here
  3. 🛠️ Create your first skill
  4. 🏛️ Skills in the enterprise: governance
  5. 🔌 MCP: the protocol explained
  6. ⚡ Use an existing MCP server
  7. ⚙️ Build your minimal MCP server
  8. 🛡️ Secure your MCP servers
  9. 📡 The ecosystem: where to find, where it moves

Next step → Create your first skill: we write the full version of our connecting thread, from requirements to testing, with the five-step method for a description that triggers every time.

To place this step on the big map: step 1, the map before the territory.

Tags
skillsmcpagentsparcours-skills-mcpskill-md
⚡ FICHE #008Agentic pentesting: same model, opposite results.3 MIN

Read next