install agent
skills safely.

What should you check before installing an agent skill?

Treat a skill as code plus instructions, not as passive documentation. Read SKILL.md, follow every relative link, inspect scripts and package manifests, and search for commands that read credentials, modify files, make network requests, or weaken approval controls. Verify the maintainer, repository history, license, requested tools, and exact revision you intend to use.

If the source is unfamiliar, use the agent skill security checklist before installation. Start in a disposable project with no production credentials. A skill whose stated job is formatting Markdown should not need cloud-admin access, outbound uploads, or unrestricted shell execution.

How do you install an Agent Skills folder?

1. Open the source. Read the complete SKILL.md and inspect every bundled script, reference, asset, dependency, and requested permission before copying or running anything.
2. Choose the scope. Use a project scope when the skill belongs to one repository or team. Use a personal scope only when you trust it across every project you open.
3. Use the client directory. Copy the entire skill folder, not only SKILL.md, into a skills directory supported by your AI client.
4. Reload and discover. Restart the client or reload its skills configuration, then use its skills menu or listing command to confirm discovery.
5. Test on a reversible task. Run one prompt that should activate the skill and one nearby prompt that should not. Verify the actual result and tool calls.
6. Pin and maintain. Record the source and revision, review updates before applying them, and remove the folder if behavior or trust changes.

project-root/
└── .agents/
    └── skills/
        └── pull-request-review/
            ├── SKILL.md
            ├── scripts/       # if supplied
            ├── references/    # if supplied
            └── assets/        # if supplied

The name in the skill's frontmatter should match the folder name. Do not flatten supporting files or rename paths without updating their references. For a catalog entry on skillZs, use the displayed install command only after opening its source and audit information on the individual skill page.

Which skill directory does each AI client use?

These paths are not interchangeable guarantees. Products add support and optional fields over time, so consult the official documentation for the version you run. Keep portable instructions in the standard format and document any client-only tool names or frontmatter.

How do you verify that an installed skill works?

• Confirm the skill appears in the client's skills menu or listing command.
• Ask a realistic prompt that closely matches the frontmatter description.
• Check that the client reports loading the expected skill rather than guessing from general knowledge.
• Inspect tool calls, changed files, network requests, and the final artifact.
• Run a nearby negative prompt that should not activate the skill.
• Repeat the same fixture after every update.

Discovery proves only that the folder loaded. Verification proves that its behavior is correct. A useful test has an observable acceptance condition—for example, a review skill must identify a seeded defect and remain silent on a clean fixture.

How should you update or remove agent skills?

Record the upstream URL and commit, compare changes before updating, and rerun the activation and outcome tests. Avoid silently tracking an unpinned branch in sensitive environments. To remove a file-based skill, delete its complete folder from the relevant skills directory, reload the client, and confirm it no longer appears. Revoke credentials or permissions that existed only for that skill.

Next, learn how to create your own skill, understand Agent Skills versus MCP, browse the open catalog, or compare coding and agent skills.

What do people ask about installing agent skills?

Which official sources document installation?

This guide was checked against the Agent Skills specification, Claude Code skills documentation, OpenAI Codex skills documentation, Cursor skills documentation, VS Code Agent Skills documentation, Gemini CLI skills documentation, Google's Gemini CLI codelab, and OpenAI's ChatGPT Skills documentation.