Agent Skills (SKILL.md): the open skill format and the agents that support it

Agent Skills is an open file format for giving AI agents reusable know-how. Anthropic introduced skills for Claude on October 16, 2025 and opened the format as a standard on December 18, 2025. The spec lives at agentskills.io, code under Apache-2.0 and docs under CC-BY-4.0. Its showcase lists 46 clients that support the format, among them Claude Code, Cursor, GitHub Copilot and a single ChatGPT & Codex entry, so they all read the same SKILL.md format, though each client decides where it looks for skill folders.

#What is inside a skill?

A skill is a directory with at least a SKILL.md file: YAML frontmatter, then Markdown instructions. The spec defines six frontmatter fields. name and description are required: name is 1 to 64 characters of lowercase letters, digits and hyphens matching the directory name, description up to 1024 characters. Optional: license, compatibility (up to 500 characters), metadata and the experimental allowed-tools. Optional scripts/, references/ and assets/ directories sit alongside. Loading is progressive: roughly 100 tokens of name and description at startup, the full body when a task matches, bundled files as needed.

#Where do agents look for skills?

.agents/skills is the cross-client convention the implementation guide recommends, in a project and in the home directory, so a skill one client installs is visible to others that scan it. Clients usually scan their own directory too, and the guide notes some also scan .claude/skills, where many skills already live. Claude Code's docs list ~/.claude/skills and .claude/skills, not .agents/skills. Understanding skills covers the layout.

#How portable is a skill between agents?

A skill using only the six spec fields travels best. Clients may add their own properties, which the spec points at the metadata map. Claude Code goes further: its frontmatter reference lists 20 fields, six from the spec and the rest its own, such as when_to_use and hooks. Each client documents its own setup, so check before assuming a field carries over to OpenClaw. Uploads to claude.ai and the Skills API are stricter: no XML tags in either field, no anthropic or claude in a name, and no syncing across surfaces, so each needs its own upload.

#Is it safe to install someone else's skill?

Treat a third-party skill as untrusted code. Anthropic's docs warn that a malicious skill could lead to data exfiltration or unauthorized system access, and tell you to audit every bundled file. skills.sh says it cannot guarantee the quality or security of the skills it lists. Claude Code's docs add that a project skill can grant itself broad tool access through allowed-tools in a folder you never vetted. The skill security guide and the skill security audit set out the checks.