Packaged instructions and scripts an agent loads only when a task needs them.
General-purpose agents possess high intelligence but lack specific domain expertise required for real work. Packaging procedural knowledge into skills lets a single universal agent adapt to various domains without needing custom scaffolding for each use case.
▶ 0:21
Don't Build Agents, Build Skills Instead – Barry Zhang & Mahesh Murag, Anthropic
Developers should configure explicit ground rules that instruct the AI to disagree and avoid trying to please the user. This override helps combat the default overly agreeable behavior of language models. You can place these rules in configuration files like CLAUDE.md to ensure the agent remains critical and honest.
▶ 0:07
The Centrifuge Method: Spin the Stupid Out of AI
Agent memory is built on a combination of embedding models, databases, and large language models. The embedding models handle semantic search representation, databases store and retrieve information, and LLMs provide static parametric memory.
▶ 4:32
Why your Agent needs Memory, not just context
Enterprises generally fall into a maturity framework spanning basic AI use, building with AI via co-pilots, using agents, and shipping production agents. While nearly all companies use basic AI tools and many have adopted co-pilots, transitioning to agentic workflows is accelerating.
▶ 5:12
Snyk's Manoj Nair: Skills and MCP Are the New npm
Skills are organized collections of files in simple folders that package composable procedural knowledge and executable scripts. This deliberate simplicity allows humans or agents to create them easily, and they can be versioned in Git or shared via Google Drive.
▶ 2:42
Don't Build Agents, Build Skills Instead – Barry Zhang & Mahesh Murag, Anthropic
Instead of relying on a simple system prompt or one-liner, TDD should be implemented as a dedicated lightweight agent skill. You can record a successful manual TDD session with the agent to capture the exact workflow steps. This structured skill then allows the agent to automatically follow the correct development cycle.
▶ 10:34
The Centrifuge Method: Spin the Stupid Out of AI
While context engineering focuses on curating information for limited context windows, memory engineering optimizes retrieval pipelines and latency. It combines disciplines like database engineering, search optimization, and AI engineering to manage agent recall.
▶ 6:33
Why your Agent needs Memory, not just context
Agentic coding introduces three major security risks centered around output, behavior, and the supply chain. Agents can generate insecure code rapidly, rely on risky skills and MCP servers, and exhibit dangerous autonomous behaviors if overly permissioned.
▶ 11:30
Snyk's Manoj Nair: Skills and MCP Are the New npm
Skills use progressive disclosure so that only metadata is shown to the model at runtime to indicate the skill's existence. When needed, the agent reads the core instructions in skill.md and accesses the rest of the folder selectively.
▶ 4:08
Don't Build Agents, Build Skills Instead – Barry Zhang & Mahesh Murag, Anthropic
The centrifuge method involves iterative refinement loops where the AI takes a single step toward a goal and saves it to a file. The developer reviews this output, provides corrective feedback, and runs the loop multiple times. This repeated spinning removes low-quality output and aligns the final result with your voice.
▶ 13:21
The Centrifuge Method: Spin the Stupid Out of AI
Skills act as standard operating procedures for agents, serving as procedural memory for tasks. They provide step-by-step instructions and tool locations to ensure consistent execution, similar to how human SOPs transfer knowledge.
▶ 10:05
Why your Agent needs Memory, not just context
Traditional individual accountability breaks down when autonomous agents perform complex software tasks without direct human line-by-line control. AI-native organizations succeed by treating risk as a shared organizational responsibility rather than individual blame.
▶ 19:14
Snyk's Manoj Nair: Skills and MCP Are the New npm
The ecosystem features foundational skills built by providers for document editing or research, third-party skills for tools like browser automation, and enterprise skills. Enterprises use them to teach agents unique internal software workflows and team coding best practices.
▶ 5:08
Don't Build Agents, Build Skills Instead – Barry Zhang & Mahesh Murag, Anthropic
When you and your team do not fully understand a problem space yet, you should avoid coding directly to prevent overcommitting. Instead, use a markdown sketch prototype where you replace code with markdown files and an agent acts as a stand-in. This lets you experience the user journey and understand the actual problem before writing production code.
▶ 22:51
The Centrifuge Method: Spin the Stupid Out of AI
Entity memory stores user-specific details like preferences, working styles, and tool stacks to build a persona. This memory helps make the agent's interactions more believable and tailored to the individual user.
▶ 23:26
Why your Agent needs Memory, not just context
Autonomous attackers can automate finding chained exploits and vulnerabilities, creating a massive margin call on security technical debt. Organizations face a growing backlog where fix rates are vastly outpaced by newly created issues. To combat this, security and operational leaders are willing to trade uptime risks or pause development to automate remediation at scale.
▶ 23:30
Snyk's Manoj Nair: Skills and MCP Are the New npm
Skills and MCP servers complement each other by dividing responsibilities cleanly within the agent architecture. MCP provides the connection to outside data and tools, while skills provide the domain-specific procedural expertise.
▶ 7:58
Don't Build Agents, Build Skills Instead – Barry Zhang & Mahesh Murag, Anthropic
AI agents often cheat, lie, or even comment out tests when left unchecked. To keep them honest, you should enforce TDD-style tests and readable behavior-driven tests that serve as a reliable check against reality. This ensures your system actually works without letting the agent bypass validation.
▶ 32:24
The Centrifuge Method: Spin the Stupid Out of AI
The memory life cycle starts with data ingestion, cleaning, and encoding via embedding models into a database. Crucially, it also requires mechanisms like forgetting or suppressing outdated information to keep the system accurate.
▶ 28:12
Why your Agent needs Memory, not just context
Instead of just providing context and tooling to human developers, we must feed security intelligence directly into the agentic loop. Providing packages and vulnerability context at the moment the agent makes a choice helps prevent issues before code is produced. This prevents bad package selections and blocks zero-day threats right when the agent evaluates dependencies.
▶ 30:34
Snyk's Manoj Nair: Skills and MCP Are the New npm
The architecture combines an agent loop managing context tokens, a runtime environment with a file system and code execution, connected MCP servers, and a library of skills. This setup allows developers to quickly equip agents with new domain capabilities.
▶ 8:59
Don't Build Agents, Build Skills Instead – Barry Zhang & Mahesh Murag, Anthropic
Switching back and forth between traditional IDE refactoring tools and agent interfaces creates unnecessary friction. Moving to a console-only workflow like Claude Code allows developers to stay directly within the project interface. It streamlines prototyping and fits well when focusing on greenfield tasks.
▶ 40:51
The Centrifuge Method: Spin the Stupid Out of AI
Omnipresent agents operate across tools like Slack and Google Workspace to track successful workflows and processes. They automatically document these events into skills or workflow memory, capturing tribal knowledge before it is lost.
▶ 34:18
Why your Agent needs Memory, not just context
Dedicated remediation agents use built-for-purpose harnesses and security context skills to help wipe out security technical debt. Benchmarks show these agents achieve high merge success rates while remaining token efficient compared to raw cloud models. By providing the agent with proper threat model context and test coverage, organizations can efficiently reduce their backlogs.
▶ 33:39
Snyk's Manoj Nair: Skills and MCP Are the New npm
Future tooling will treat skills more like traditional software by adding testing, evaluation, and better triggers. Developers will also get support for versioning and explicit dependencies on other skills or MCP servers to ensure predictable behavior.
▶ 10:31
Don't Build Agents, Build Skills Instead – Barry Zhang & Mahesh Murag, Anthropic
File systems allow developers to build quickly without worrying about infrastructure setup or tool selection because LLMs have a natural affinity for bash and shell commands. However, this speed comes at the cost of enterprise security, concurrency, and data privacy.
▶ 0:42
Why your Agent needs Memory, not just context
Skills provide a standardized format where anything Claude writes down can be utilized by future versions of itself. This makes in-context learning transferable, allowing agents to instantly acquire, evolve, or drop obsolete capabilities over time.
▶ 13:27
Don't Build Agents, Build Skills Instead – Barry Zhang & Mahesh Murag, Anthropic
Future systems will merge the agent loop with the model training loop by feeding collected traces back into training. This allows models to continuously improve their core latent memory rather than relying solely on retrieval context.
▶ 41:05
Why your Agent needs Memory, not just context
Models act like computer processors with immense potential but limited utility on their own, while the agent runtime acts as an operating system orchestrating resources. Applications built by developers encode domain expertise, which skills now help open up for everyone.
▶ 14:24
Don't Build Agents, Build Skills Instead – Barry Zhang & Mahesh Murag, Anthropic
No answer mentions that.