S = (C, π, T, R)
Choose the right context.
An applicability condition gates the skill against the observation and current goal. Reuse starts with knowing when the procedure belongs.
SYSTEMATIZATION OF KNOWLEDGE · 2026
SoK: Agentic SkillsBeyond Tool Use in LLM Agents
Reusable procedures change how agents act. What makes them composable, verifiable, and safe?
University of Technology Sydney · CSIRO Data61
S = (C, π, T, R)
Make the procedure executable.
The policy maps observations and history to actions or other skill invocations. It may be natural language, code, a learned controller, or a hybrid.
S = (C, π, T, R)
Know when to return.
A termination condition identifies completion or failure. A caller needs a stopping boundary before skills can be safely composed.
S = (C, π, T, R)
Expose a reusable contract.
A callable interface specifies the name, parameters, and return type. It turns procedural knowledge into something other components can invoke.
01 LIFECYCLE
A skill is a living
system component.
Follow the procedure from a recurring task to a governed, versioned capability.
01/ 07
Find a recurring capability.
Identify repeated tasks, execution failures, or workflow bottlenecks that justify a reusable procedure.
Task patterns → candidate skill
02/ 07
Refine through feedback.
Exercise the procedure, inspect outcomes, and revise the steps with execution feedback or supervision.
Attempts → refined procedure
03/ 07
Keep the transferable procedure.
Compress useful trajectories into an artifact with clear applicability and execution boundaries.
Trajectories → reusable module
04/ 07
Give the skill a durable home.
Index, version, and retrieve skills so that selection does not require loading every procedure into context.
Module → versioned library
05/ 07
Connect skills into workflows.
Route and decompose tasks, compose subskills, and define recovery paths when a step fails.
Subskills → executable workflow
06/ 07
Verify the outcome.
Evaluate correctness, robustness, efficiency, generalization, and safety with reproducible harnesses.
Execution → outcome evidence
07/ 07
Revise, regress, or retire.
Use evidence to update the library, rerun regression checks, and retire skills that become unreliable.
Evidence → next version
Lifecycle model · Paper §4. Stages can recur and overlap; the sequence is an explanatory view.
02 PATTERN EXPLORER
Seven patterns.
Different control surfaces.
Explore how packaging and execution change the trade-offs. A system can combine several patterns.
Design pattern / P1
Load only what is needed.
Expose compact metadata first; load full instructions after selecting a skill.
Lower context cost; selection depends on retrieval quality.
Risk → Metadata poisoning
Verify provenance and treat retrieved metadata as untrusted input.
Design pattern / P2
Make procedures executable.
Package reusable procedures as scripts with concrete runtime behavior.
Testable behavior; executable code also expands the attack surface.
Risk → Malicious code payloads
Sandbox execution and restrict filesystem, network, and tool permissions.
Design pattern / P3
Put constraints in the controller.
Enforce ordered steps, checks, and termination outside the model’s free-form reasoning.
Strong process control; rigid workflows need explicit recovery paths.
Risk → Workflow bypass
Enforce critical gates in the runtime and preserve audit trails.
Design pattern / P4
Turn experience into a library.
Generate and refine persistent skills from execution feedback.
Adaptation can compound useful knowledge or propagate errors.
Risk → Skill drift
Version skills and use regression tests before promoting updates.
Design pattern / P5
Join guidance and execution.
Combine natural-language instructions, executable blocks, and supporting assets.
Flexible packaging; boundaries between instructions and code can be ambiguous.
Risk → Instruction injection
Separate data from instructions and review executable components.
Design pattern / P6
Operate on the skill library.
Use skills to create, modify, or compose other reusable skills.
Extends reuse into skill management; mistakes can affect downstream modules.
Risk → Error amplification
Validate generated skills and track the provenance of derived artifacts.
Design pattern / P7
Reuse across a shared ecosystem.
Distribute versioned packages with dependencies and compatibility requirements.
Broad reuse makes package provenance and supply-chain governance essential.
Risk → Supply-chain compromise
Use provenance, review, signing, version pinning, and revocation policies.
Design patterns and security analysis · Paper §5 and §7.
03 TRUST & GOVERNANCE
Disclosure is a boundary.
Execution is another.
A skill can be useful and still be unsafe. The paper separates exposure to metadata from permission to execute.
Read the threat model ↗T1 Metadata only+
Inspect descriptions and applicability without executing the skill body. Even metadata can poison retrieval or selection.
T2 Instruction access+
Load natural-language instructions in a runtime-enforced read-only mode. Without a separate execution approval channel, instruction access can indirectly trigger actions.
T3 Supervised execution+
Run with explicit approval, restricted permissions, and an inspectable execution record.
T4 Autonomous execution+
Grant higher autonomy only with stronger provenance, verification, sandboxing, and monitoring. Trust may need to be revoked after drift.
04 EVIDENCE
Curation changes
the outcome.
SkillsBench evidence summarized in the survey: curated skills help on average; self-generated skills can hurt.
Rounded pass rates; +16.2 pp is the lift reported by the source.
−1.3pp
Self-generated skills
Average change relative to the no-skills baseline in the cited open-ended setting.
Benchmark evidence is context-dependent. These results do not establish that every curated skill helps, or every generated skill fails.
Evaluation and limitations · §8–9 ↗05 / CITATION
Continue with
the paper.
Read the complete argument, assumptions, and references in the preprint.
arXiv:2602.20867 ↗@article{jiang2026agenticskills,
title = {SoK: Agentic Skills -- Beyond Tool Use in LLM Agents},
author = {Jiang, Yanna and Li, Delong and Deng, Haiyu and Ma, Baihe and Wang, Xu and Wang, Qin and Yu, Guangsheng},
journal = {arXiv preprint arXiv:2602.20867},
year = {2026},
doi = {10.48550/arXiv.2602.20867}
}