AI Skills
What a skill is
Section titled “What a skill is”A skill file is guidance an AI coding tool loads on demand when it recognises a matching task — the conventions, edge cases and refusals of a specific API, written down once instead of pasted into a prompt each time.
The difference from the MCP server is worth being precise about, because they are easy to confuse:
| What it does | |
|---|---|
| MCP server | lets an agent read your data — posture, controls, vendors, incidents |
| Skills | teach an agent how to write code against this API |
An agent can use both: the skill to write a correct integration, the server to run it against a real organization.
What the first skills would cover
Section titled “What the first skills would cover”The candidates come from the places this API is genuinely easy to get wrong, and every one of them is documented prose today that an agent has to be pointed at by hand:
- The response envelope. Every
/v1reply is wrapped in{ success, data, timestamp, requestId }, and a client that reads the body directly works right up until it doesn’t. - Cursor pagination, and which endpoints use it rather than page numbers.
- Bulk vendor import — match keys, why a blank cell never overwrites, and
reading
summary.failedrather than the HTTP status. - Uploading documents, including that there is no generic “upload a file” endpoint and why.
- Webhook receivers — signature verification, and that the signing secret is returned exactly once.
- Scopes, and reading a
402as a plan boundary rather than a bug.
Until then
Section titled “Until then”Both are usable now, and the second is the cheapest thing to try: point your
tool at llms.txt and it has the documentation in full.
Telling us what to build
Section titled “Telling us what to build”The list above is a guess informed by the API, not by your integration. If a different part of this surface is where your agent keeps going wrong, that is the more useful thing for us to know — and the changelog is where these will be announced when they ship.