Practical guide

Agent skills for Claude Code, Codex and Hermes

Agent skills are reusable written workflows that tell a coding agent how to approach a recurring job. Instead of pasting the same long prompt for every review, migration or deployment, you keep the process in a readable file and invoke it when the situation matches.

What an agent skill actually is

At its simplest, a skill is a folder containing a SKILL.md file. The front matter gives the workflow a name and description. The body defines when to use it, the sequence of checks, safety boundaries, commands to run and the evidence expected at the end.

The useful distinction is repeatability. A one-line prompt asks for an outcome. A good skill specifies a process: inspect the real target, reproduce the problem, rank hypotheses, use reversible actions first, run verification and report the exact result. The instructions remain visible, editable and versionable alongside the rest of your engineering practice.

Why use skills rather than one enormous system prompt?

• Smaller context: load the workflow needed for the current job rather than every possible rule.
• Reviewable behaviour: developers can inspect the Markdown before allowing an agent to follow it.
• Consistency: code reviews and releases use the same gates across sessions.
• Version control: process changes can be reviewed through ordinary Git history.
• Portability: plain Markdown is not tied to a proprietary binary format.

Install and inspect a free example

The free Code Review Gate is public and MIT licensed. List it without installing:

npx skills add skyestrela/ai-agent-skill-preview --list

Install a copy for Codex:

npx skills add skyestrela/ai-agent-skill-preview \
  --skill code-review-gate --agent codex --global --yes --copy

Or print the complete workflow into your terminal without installing it:

npx skills use skyestrela/ai-agent-skill-preview@code-review-gate

Agent names, discovery paths and supported capabilities change over time. Always follow the current documentation for your chosen agent and inspect third-party skills before use.

What makes a workflow trustworthy?

A skill should not merely sound confident. Look for explicit discovery steps, command evidence, handling for missing context, permission boundaries, rollback criteria and a clear distinction between findings and assumptions. Be wary of workflows that request credentials, execute destructive commands by default or claim security guarantees.

Written instructions do not remove the risks of agentic tools. Agents may still misunderstand a repository or run a command in the wrong environment. Production changes, payments, deletion and credential handling should remain behind explicit authorisation and environment-specific checks.

Free workflows versus the complete pack

The free repository provides four complete, MIT-licensed workflows: Code Review Gate, Bug Reproduction Brief, Dependency Risk Triage and Rollback Readiness Card. The paid pack contains ten engineering workflows covering review, debugging, test-driven development, PR shipping, security review, API scaffolding, migration recovery, deployment checks, refactoring and incident post-mortems. Each stays as ordinary Markdown; the download also includes the pack manifest, quickstart, changelog and single-user commercial licence.