Perspective · for the practitioner
A thousand skills is inventory, not capability.
The library holds 1,000+ skills — but a raw skill is not the deliverable. Dropped into a function unchanged, it can score worse than the team’s own code. On one real app, the off-the-shelf jailbreak skill caught 0–2 of 15 attacks; the app’s own shipped guard caught 8.
Counts are never the headline — a raw skill is potential, not capability.
The tension
Anyone can browse a catalogue. Turning a generic procedure into a measured result for your tools and process is the actual work.
“How does a generic skill become something that actually moves my function’s number?”
The answer
Author the generic core once, then bind it to your reality.
A skill is an executable procedure (a SKILL.md) — trigger, prerequisites, workflow, verification, and the framework controls it satisfies. Its power is the fit-point interface: the named places the generic core must be adapted to a function, so “fit, don’t replace” is mechanical, not aspirational.
A monitoring skill fitted to a Splunk SOC binds its deployment type, security indices, CIM data models, and threat-intel lookups. A different SOC is a different configuration — the template never ships as-is.
What makes it real
The loop that turns a fitted skill into a measured result.
The fit isn’t the finish line — the before/after is. Five moves, run on the function’s own data, turn a configuration into a grade you keep.
Until that before/after runs on your own data, the numbers are modeled, not measured — labelled that way everywhere. See the configuration run on a real app in the StoryBond case study, and the loop deployed end to end in How it works.