Before You Install That AI Skill, Read This

You do not need to build every AI skill from scratch. You need to know which ones to trust.

It is Tuesday morning, and Priya is pasting the same brief for the fourth time

Priya runs a six-person marketing agency in Manchester. Good clients, tight deadlines, no time to waste.

Every client post starts the same way. She opens a fresh chat with her AI, and she re-explains everything. The brand voice. The format. The rule that this client hates exclamation marks. The three examples of posts that worked. Then, finally, the actual task.

She does this for the first client. Then the second. Then the third.

The brand voice was manual. The format was manual. The house rules were manual.

On Monday she saw a post from a developer she follows. Six words: "you can just install this once." She did not know that was a thing you could do.

Here is the quiet truth most owners miss. The instructions were never the problem. Typing them again every single morning was.

What is an AI skill?

A skill is a set of instructions you write once, saved as a file, that your AI tool loads by itself the moment it becomes relevant. You stop repeating yourself.

That is the whole idea. In the words of one widely shared tutorial, a skill is "a set of instructions that you create once, and then Claude remembers that skill forever, and pulls it in as it needs it." Instead of re-typing the same prompt in every new chat, the tool reaches for the right instructions at the right moment on its own.

Under the hood a skill is not exotic. It is a plain-text file, usually named skill.md, sitting in a small folder. You can open it and read it like a page in a notebook. Some skills add a few extra files next to it, a brand guide, a price list, an example document, so the AI has everything it needs in one place.

Think of it as the difference between explaining your job to a new hire every morning, and writing them a one-page standard operating procedure they keep on their desk. The skill is the SOP. The AI is the new hire who actually reads it every time.

If the idea of writing your own from scratch appeals to you, we walked through exactly that in Claude Skills: bottle what you are best at. This piece is about the other half of the story: the skills you did not write.

So why is everyone suddenly talking about skills?

Because skills stopped being something you build, and became something you can install.

Whole libraries of ready-made skills now exist. Tools like Claude, Claude Code, and Cowork ship with built-in ones from Anthropic, and public collections such as Superpowers let you add a capability the way you add an app to your phone. Matt Pocock, a developer followed by more than 300,000 people, summed up the shift in a single line that went round the timeline last week: "Superpowers gives the agent superpowers. My skills give you superpowers."

Read that twice, because it is the point. The value is not that the machine gets cleverer. It is that your way of working gets captured, and handed back to you as something you can run on demand.

For a small business, that changes the maths. You no longer have to invent every workflow yourself. You can borrow the best ones. The catch is knowing which ones to trust.

Is installing a skill just copy-pasting a prompt?

No, and the difference is the whole reason to pay attention.

A prompt is a one-off. You type it, you read the answer, you move on. A skill is a file your AI will follow again and again, often while you are not watching. That is exactly what makes it powerful. It is also what makes a bad one dangerous.

A skill can tell your AI to open files on your computer, read a spreadsheet of customer details, or send information to an address on the internet. When you built the skill yourself, you know it does none of that. When you downloaded it from a marketplace, you are trusting a stranger's instructions with your business data.

Are downloaded AI skills safe?

Skills you write yourself are safe. Skills you download are only as safe as the words inside them, and some can quietly reach into your files or send data out. So before you run a downloaded skill, open the file and read it. Every time.

This is not paranoia. The same tutorials teaching people to love skills are careful to flag it. As one guide put it, a downloaded skill "could access files on your computer if it is in the instructions. Claude does not know that it should not do that." Another creator's rule for any skill he installs is blunt: check the security notes first, then decide.

The good news is that the check is fast, because a skill is just readable text. You are not auditing code. You are reading a set of plain-language instructions and asking whether you are comfortable with what they say. Most owners can do it in about a minute.

The 60-second check before you install any skill

Here is the routine. Do it once per skill, before the first run. After that, the skill is yours to reuse freely.

1. Open the file. Find the skill.md and read it top to bottom. If a skill will not let you see its instructions before you run it, that is your answer. Walk away.
2. Which files can it touch? Look for anything that reads, opens, or uploads files and folders. A writing skill has no business rummaging through your accounts folder.
3. Does it send anything out? Scan for web addresses, links, or anything that "posts" or "sends" data somewhere. If it phones home to an address you do not recognise, that is a red flag.
4. Do you understand every step? If a line makes no sense to you, do not run it. Either delete that line, or ask your AI in a separate chat to explain it in plain English before you decide.
5. If in doubt, trim it or build your own. You are allowed to edit a downloaded skill. Keep the parts you like, cut the parts you do not, and you are back in control.

That is it. One read, three questions, one decision.

Build it or install it? A simple rule

You do not have to choose a side. The best setups mix both. Here is the rule of thumb we use with clients.

A smart move is to install a good generic skill, then edit it until it fits. You get a running start and a result that is still yours.

Priya's Tuesday, replayed

Now run Priya's morning again, with the check in hand.

She finds a content-engine skill in a public library, the kind that turns one brief into a blog post, a LinkedIn post, and a short newsletter, all in the same voice. She does not run it yet. She opens the skill.md and reads.

Most of it is exactly what she wants: a clear structure, sensible steps, a slot to drop in a brand guide. But one line tells the AI to post every draft to a web address she has never heard of. Red flag. She deletes that single line.

Then she does the one thing that turns a borrowed skill into her skill. She adds her own files next to it: the agency brand guide, three posts that landed well, the exclamation-mark rule. She saves it.

The next client post takes two minutes, not twenty. On brand, in her voice, without a single line of the brief re-typed. Her junior can run the exact same skill and get the exact same quality. The thing Priya knew, that used to live only in her head, now lives in a file her whole team can use.

What you have a month from now

Start with one. Pick a single repetitive task you already hand to an AI, and either install a skill for it or write a two-paragraph one yourself. Run the 60-second check. Use it for a week.

In a week, that task stops being a task. It becomes a button.

In a month, you have three or four of them, and the parts of your business that used to depend on you remembering the steps now just happen the same way every time.

In six months, a new hire is productive on day one, because the way you work is written down and runnable, not trapped in the founder's head.

Same team. Same tools. A library that finally works the way you work.

The first skill is the hard one, because it is unfamiliar. The tenth is easy. If you want a hand finding the one task worth starting with, that is exactly what the first days of our AI Readiness Sprint are for.