Agent Skills vs MCP vs Plugins: What Each Is and When to Use It
An agent skill is a SKILL.md folder an agent loads on demand; MCP is a live protocol to tools and data; a plugin bundles both. What to use when.
25 articles with this tag.
An agent skill is a SKILL.md folder an agent loads on demand; MCP is a live protocol to tools and data; a plugin bundles both. What to use when.
npx skills add installs a skill folder into every agent directory it detects. The exact syntax, the 79 agent paths, and the check to run before you install.
One command installs a registry skill on every machine you use, into each agent's own directory, verified against the publisher's SHA-256 tree hash.
10 DevOps and CI/CD skills installed and scored out of 50. A 1,004-line Docker hardening playbook leads at 45/50; four more cover pipelines and rollout.
We scored 15 CSS and design skills out of 50. @wshobson/responsive-design leads at 44/50 on container queries, fluid typography and CSS Grid.
10 data analysis skills installed and scored out of 50. Three tie at 42/50: a 428-line dashboard playbook, a 14-row chart guide, a 3-script CSV toolkit.
Five of 11 Rust and Go skills we installed are worth using. Apollo's 2,430-line Rust handbook scores 45/50 — full scored comparison and sources.
11 AI/ML skills installed and scored out of 50. @wshobson/rag-implementation leads at 44/50 with five advanced retrieval patterns, including hybrid search.
We read 10 cloud infrastructure skills and scored five out of 50. Terraform state migration and Cloudflare's 12 Workers anti-patterns tie at 43/50.
The 5 best Next.js skills for Claude Code, Cursor and Windsurf, scored out of 50. Top pick: @vercel-labs/next-best-practices at 45/50.
We scored 8 git workflow skills out of 50. Five deliver: rebase playbooks, safety-gated branch cleanup, changelog pipelines. Winner: git-advanced-workflows.
13 API skills installed and scored out of 50. The top five ship 25 files across 7 frameworks, RFC 9457 agent-facing errors, and Apollo's schema rules.
18 security auditing skills installed and scored out of 50. The top five ship 146 vulnerability vectors, 11 language footgun guides and live dependency checks.
13 SQL and database skills installed and scored out of 50. The top five ship 33 prioritized Postgres rules, EXPLAIN analysis and zero-downtime migrations.
Five of 12 TypeScript skills made the cut. @mcollina/typescript-magician leads at 45/50 with 14 rule files. Here is what the other seven got wrong.
We read 11 documentation skills and scored five out of 50. Anthropic's doc co-authoring and React's 885-line reference style guide tie at 43/50.
We scored 11 performance skills out of 50. Vercel's 64-rule react-best-practices wins at 47/50; Callstack's 6,388-line React Native guide takes 45/50.
We scored 14 refactoring skills out of 50. GitHub's 10-smell refactor skill wins at 43/50; Dify's complexity-scoring React skill takes 42/50.
We installed and scored 23 code review skills out of 50. @sanyuan0704/code-review-expert leads at 42/50 with a 7-step workflow and P0-P3 severity.
Five of 17 React skills scored 42/50 or better. @vercel-labs/next-best-practices leads at 46/50 with 20 reference files. Here is what each one fixes.
Five of 18 testing skills scored 40/50 or better. A 61-file Playwright library leads at 46/50. What each one enforces and which framework it fits.
We installed and scored 20 Python skills. These 5 deliver — from 736 lines of async patterns to Sentry's zero-false-positive Django auditor.
A demo is a replayable agent session pinned to one skill version. 2,625 exist across 30,433 SkillSafe skills. How to record, upload and pin one.
Skills can rewrite themselves from real usage: a forked sub-agent runs, the main agent observes, edits the file, and saves a new immutable version.
Koi Security found 341 malicious skills in 2,857 listings. SkillSafe scans before sharing, re-scans on install, and blocks archives that changed in between.