ai · security · skills

Perspective · for the practitioner

A thousand skills is inventory, not capability.

The library holds 1,000+ skills — but a raw skill is not the deliverable. Dropped into a function unchanged, it can score worse than the team’s own code. On one real app, the off-the-shelf jailbreak skill caught 0–2 of 15 attacks; the app’s own shipped guard caught 8.

One raw skilla generic procedureUnfitted → 0–2 / 15worse than the team’s own codeFitted → 15 / 15bound to the function’s own realitySame raw material.The configuration is what moved the number.

Counts are never the headline — a raw skill is potential, not capability.

The tension

Anyone can browse a catalogue. Turning a generic procedure into a measured result for your tools and process is the actual work.

“How does a generic skill become something that actually moves my function’s number?”

The answer

Author the generic core once, then bind it to your reality.

A skill is an executable procedure (a SKILL.md) — trigger, prerequisites, workflow, verification, and the framework controls it satisfies. Its power is the fit-point interface: the named places the generic core must be adapted to a function, so “fit, don’t replace” is mechanical, not aspirational.

Generic skillships with defaultstoolprocessdata-sourcepolicyidentityenvironmentFitted configyour SIEM, your process

A monitoring skill fitted to a Splunk SOC binds its deployment type, security indices, CIM data models, and threat-intel lookups. A different SOC is a different configuration — the template never ships as-is.

What makes it real

The loop that turns a fitted skill into a measured result.

The fit isn’t the finish line — the before/after is. Five moves, run on the function’s own data, turn a configuration into a grade you keep.

DiagnosePrescribeFitMeasureMatureMeasure = the function’s own data, skills-off vs skills-on — a task-level before/after. Then move the grade and repeat on the next gap.

Until that before/after runs on your own data, the numbers are modeled, not measured — labelled that way everywhere. See the configuration run on a real app in the StoryBond case study, and the loop deployed end to end in How it works.

← Back to Insights

Subscribe for the next essay.