跪拜 Guibai
← All articles
Backend

Agent Skills Are Not Just Prompts: What Breaking Them Taught Me About Writing Stable AI Behavior

By 薛定谔的悦 ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Teams adopting agentic coding tools often blame the model when a Skill misfires, but the real failure is usually in the description, untested boundaries, or overloaded files. Fixing those three things costs far less than rewriting prompts and produces behavior that survives rephrased requests.

Summary

A Skill starts as a simple markdown file telling an agent when to act, how to act, and when to stop. The first trap is stuffing rules into the body while writing a vague description — agents use progressive loading and decide whether to trigger almost entirely from the name and description alone. Boundary test cases catch more failures than longer prompts ever will. As Skills grow, splitting into references, assets, and scripts keeps the main file navigable, but splitting too aggressively forces the agent to jump across too many files and increases errors. Scripts handle deterministic checks like date formats and field completeness; the model handles fuzzy judgment like whether a risk description is clear. External capabilities like knowledge bases and MCP tools belong at the connection layer, not inside the Skill file — a Skill declares dependencies but cannot supply credentials or network access. When multiple Skills coexist, they compete for triggering, so descriptions must be narrow enough to avoid collisions and coexistence tests must verify that a new Skill does not hijack tasks or escalate privileges.

Takeaways
Agents decide whether to invoke a Skill almost entirely from its name and description; the body text is only read after a match, so a vague description guarantees missed or false triggers.
Write the description as the exact phrases a user would actually type — "generate a weekly report from project records", not "helps with project tasks".
Before writing the Skill body, prepare boundary test cases: a normal request, an incomplete-data request, and a request that crosses a red line the Skill must refuse.
Splitting a Skill into references/, assets/, and scripts/ is useful only when it reduces context load per task; splitting files that must always be read together increases errors.
Scripts should handle deterministic checks like date format and field completeness; the model should handle fuzzy judgment like whether a risk description is clear.
Skills can declare dependencies on external capabilities but cannot supply credentials, network access, or permissions — those belong at the host or agent configuration layer.
Coexistence testing is mandatory: a new Skill must be run alongside existing Skills to check whether it steals triggers, degrades outputs, or routes read-only tasks into higher-privilege paths.
Enterprise Skills need Git versioning, PR review, pinned production versions, a rollback plan, and a named owner who can answer who maintains rules, who approves scripts, and who stops it when it breaks.
Conclusions

The most common debugging mistake is adding more body text for every failure, but triggering problems live in the description and connection problems live in permissions — neither is fixed by longer prompts.

Skill writing is closer to test-driven development than to prompt engineering: defining what counts as wrong before writing the procedure catches more failures than perfecting the procedure itself.

The industry spends too much energy debating the boundaries between Skills, MCP, Agents, and Workflows before building a single working end-to-end task; those boundaries become obvious once a real task runs.

Skills that mix tasks with different permission levels — such as reading customer records and reviewing contracts — create security and triggering problems that disappear immediately when split by access scope.

Concepts & terms
Progressive loading
The agent mechanism where only the Skill name and description are scanned during task matching; the full body text is loaded only after a Skill is selected for a specific task.
MCP (Model Context Protocol)
A protocol for connecting AI models to external tools and data sources. A Skill can declare which MCP tools it needs, but the actual connection, authentication, and permissions are configured at the host or agent layer, not inside the Skill file.
Skill coexistence testing
Running a new Skill alongside existing Skills in the same role to detect trigger collisions, output degradation, or unintended privilege escalation before production deployment.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗