Security, Skills & Agentic Workflows

Building Skills: Procedures & Capability Enhancers

4 min read

An agent without skills is like a smart employee on their first day — intelligent but unfamiliar with your specific processes. Skills are text files that teach agents how to perform specific tasks. They are not code libraries or plugins. They are structured instructions written in natural language that the agent reads, understands, and follows.

Two Types of Skills

Skills fall into two categories based on what they teach the agent:

Procedure Skills

A procedure is a step-by-step sequence for completing a specific task. It answers the question: "How do I do this particular thing?"

Procedures are ideal for repeatable workflows where the steps are well-defined. Here is an example of a procedure skill that teaches an agent to publish a blog post:

name: publish-blog-post
type: procedure
description: Steps to publish a blog post to the website

steps:
  - name: validate-content
    instruction: >
      Check that the blog post has a title, author name, featured image,
      and at least 300 words of body content. If any element is missing,
      ask the user to provide it before proceeding.

  - name: format-metadata
    instruction: >
      Create frontmatter with these fields: title, author, date (today),
      tags (ask the user if not provided), and description (generate a
      one-sentence summary from the content).

  - name: optimize-for-search
    instruction: >
      Review the title and description for search relevance. Ensure the
      title is under 60 characters and the description is under 160
      characters. Suggest improvements if needed.

  - name: publish
    instruction: >
      Save the formatted post to the content/blog/ directory with the
      filename format YYYY-MM-DD-slug.md. Confirm the file was created
      and provide the expected URL path.

Each step is explicit and self-contained. The agent follows them in order, handling edge cases as described.

Capability Enhancer Skills

A capability enhancer gives the agent a new ability it did not have before. It answers the question: "What can I now do that I could not do previously?"

Unlike procedures, capability enhancers focus on teaching the agent how to use a tool or service. Here is an example that teaches image generation:

name: generate-images
type: capability
description: Generate images using the DALL-E API

context: >
  You now have the ability to generate images through the DALL-E API.
  When a user requests an image, follow these guidelines:

guidelines:
  - Always ask the user for a description if one is not provided
  - Generate detailed prompts that specify style, mood, and composition
  - Default to 1024x1024 resolution unless the user specifies otherwise
  - Present the generated image with the prompt used, so the user can
    request adjustments
  - Never generate images of real people by name
  - If the request is ambiguous, suggest 2-3 prompt variations and let
    the user choose

api_usage: >
  Call the image generation endpoint with the refined prompt.
  Include the size parameter and quality setting.
  Return the image URL to the user along with the prompt used.

The key difference: a procedure says "follow these steps," while a capability enhancer says "you can now do this — here is how."

Writing Effective Skills

Good skills share these characteristics:

Be specific, not vague: Instead of "write good content," specify "ensure titles are under 60 characters, include one header per 200 words, and use active voice."

Handle edge cases: What should the agent do when data is missing? When the API fails? When the user's request is ambiguous? Address these scenarios in the skill.

Include constraints: Define what the agent should NOT do. "Never publish without user confirmation." "Do not modify existing posts." "Limit generated images to a maximum of three per request."

Use clear naming: Name skills descriptively. publish-blog-post is better than blog-helper. generate-weekly-report is better than reports.

Skill File Structure

A well-organized skill file follows this pattern:

# 1. Identity — what is this skill?
name: skill-name
type: procedure | capability
description: One-line summary of what this skill does

# 2. Context — when should the agent use this?
triggers:
  - "when the user asks to..."
  - "when a new item appears in..."

# 3. Instructions — how should the agent execute?
steps:  # for procedures
  - name: step-name
    instruction: "What to do"

guidelines:  # for capability enhancers
  - "Guideline one"
  - "Guideline two"

# 4. Constraints — what should the agent NOT do?
constraints:
  - "Never do X without confirmation"
  - "Do not exceed Y limit"

Community Skills and Security

ClawHub (clawhub.ai) hosts a marketplace of community-created skills with over 3,200 available options. These cover common tasks like social media posting, email management, content creation, and data analysis.

Before using any community skill, security matters. ClawHub scans uploaded skills with VirusTotal to detect malicious content before they are listed. However, automated scanning is not foolproof. As we covered in the previous lesson, Cisco researchers found malicious skills in the OpenClaw marketplace. Always:

  1. Read the full skill file before installing — skills are plain text, so this takes minutes
  2. Check the author's profile — established contributors with multiple reviewed skills are more trustworthy
  3. Test in a sandbox — run new skills in an isolated environment before granting production access
  4. Review what the skill accesses — does a "blog publisher" skill really need access to your email? Question unnecessary permissions

Key takeaway: Skills transform a general-purpose agent into a specialized worker. Start by writing procedure skills for your most common workflows, then build capability enhancers for new abilities. Always review community skills before trusting them.

Next: How MCP provides a standardized way to connect your agent to external tools and services. :::

Quiz

Module 4 Quiz: Security, Skills & Agentic Workflows

Take Quiz
FREE WEEKLY NEWSLETTER

Stay on the Nerd Track

One email per week — courses, deep dives, tools, and AI experiments.

No spam. Unsubscribe anytime.