What are Agent Skills?

An Agent Skill is a small folder that teaches an AI coding agent how to do one specific job: write a commit message the way your team does, review a pull request, set up a Cloudflare Worker, run a database migration safely. Instead of repeating the same instructions in every chat, you install the skill once and the agent picks it up when the task comes up.

What is inside a skill#

At minimum a skill is one file, SKILL.md, with a short YAML header (the frontmatter) and Markdown instructions:

---
name: conventional-commits
description: Writes commit messages that follow Conventional Commits. Use when the user asks to commit.
---

# Conventional Commits

1. Run `git diff --staged` and read the changes.
2. Pick the type: feat, fix, docs, refactor, test, chore …

• name identifies the skill (lowercase letters, digits and hyphens).
• description is the most important line: the agent reads it to decide whether the skill is relevant for the current task.
• The body holds the actual instructions, examples and checklists.

Skills can bring more files: reference documents, templates, small scripts. The SKILL.md links to them, and the agent only opens them when it needs them.

How agents use skills#

Agents load skills in stages, which keeps the context window small:

1. At start-up the agent only sees each skill's name and description.
2. When a task matches a description, it reads the full SKILL.md.
3. Linked files and scripts are read or run only if the instructions call for them.

This is why a precise description ("Use when …") matters more than a long body.

Skills, rules, subagents and commands#

Denofy lists more than skills. All of them are plain files in your project or home directory:

The exact folders depend on the tool; the CLI reference lists all install targets.

Why verification matters#

A skill is instructions your agent follows — sometimes including shell commands. A malicious or careless skill can ask the agent to download and run code, read secrets or send data somewhere. That is why Denofy scans every version, stores it immutable and SHA-256 hashed (GitHub imports pinned to a commit), shows a security grade and lets you read the full report before you install. See Writing secure skills.

Next steps#

• Getting started: install your first skill in a minute.
• Create a skill for your own workflow.
• Browse verified skills.