Anthropic's enterprise skills guidance
Anthropic's Skills for enterprise tells admins how to vet, evaluate, deploy and manage Agent Skills at scale. This page maps each recommendation to what skillsvault does, and says plainly where it only helps in part.
What skillsvault is
skillsvault decides which skills reach your agents and which may run: a registry, review, signed policy, a runtime gate and an audit log. It doesn't execute or sandbox skills; your agent does.
Security review and vetting
The guide rates seven risk indicators. skillsvault's scanner checks every published version for each, and an AI review reads every file for intent the patterns miss.
| Risk indicator | skillsvault | How |
|---|---|---|
| Code execution (bundled scripts) | Covered | Shell commands and package installs are read as capabilities, download-and-run (curl … | sh) is flagged high, and compiled binaries are flagged because no one can review them. |
| Instruction manipulation | Covered | Instructions that keep something from the user ("do not mention this to the user", "silently send…") or override the agent's rules ("ignore previous instructions") are flagged high. |
| MCP server references | Covered | A call to another server's tool (mcp__server__tool) is named, so the reviewer can check that server is trusted. |
| Network access | Covered | Every host a skill references is listed, and a capability policy can block a host (network:pastebin.com) on every machine. |
| Hardcoded credentials | Covered | Private keys and AWS, GitHub, Anthropic, OpenAI, Slack, Stripe and Google keys are flagged. |
| Filesystem access | Partly | Paths a skill writes are listed and can be blocked by policy. Broad reads aren't analysed. |
| Tool calls | Covered | Shell use and package installs are capabilities you can warn on or block. |
The guide's review checklist asks for a person to read every file, check adversarial instructions, network calls, credentials and redirects, and confirm script behaviour in a sandbox. In skillsvault a reviewer sees the full diff, the scanner's findings with the line they came from, the AI review, and what the gate would decide, before approving a skill or a change. Running scripts in a sandbox is left to you.
Scanning on every surface. The guide notes that Anthropic's own skill scanning covers claude.ai and Cowork, not skills uploaded through the API. skillsvault scans every version it stores, whichever agent it is delivered to.
Evaluating skills before deployment
| Dimension | skillsvault | How |
|---|---|---|
| Triggering accuracy | Covered | Test triggering in the editor writes realistic prompts that should and shouldn't invoke the skill, routes them against your registry, and reports precision and recall. The latest result is kept as the skill's evaluation status. |
| Coexistence | Covered | The same test includes prompts that belong to your other skills, and every skill page lists similar skills that compete for the same prompts. |
| Isolation behaviour | Partly | The scorecard flags references to files the skill doesn't contain, and the graph flags links to missing or banned skills. |
| Instruction following, output quality | Not covered | skillsvault doesn't run skills against a model to grade their output. |
Lifecycle
- Create and review. Members propose skills and changes; owners, admins and governance officers approve them. Authors who can't publish are reviewed by someone else, which is the separation of duties the guide asks for.
- Test. Trigger tests and the scorecard run in the editor; the skill's page shows when it was last tested, and flags a result older than the current description.
- Deploy. Approved versions reach machines through the signed policy bundle and
skillsvault pull, and agents through MCP. - Monitor. Every run the gate decides is in the audit log with the person and machine; the leaderboard shows usage, and the weekly digest says what needs attention. This is the application-level logging the guide recommends, since the Skills API has no usage analytics.
- Iterate or deprecate. Every version is immutable and comparable; a skill can be deprecated (agents get a warning) or banned (blocked everywhere), and any earlier version can be restored.
Organising skills at scale
The guide recommends an internal registry that records, for each skill:
| Field | In skillsvault |
|---|---|
| Purpose | Description and intent, searchable in the registry and by agents over MCP. |
| Owner | Every skill has an accountable owner; unowned skills are flagged on the dashboard. |
| Version | The current version and every earlier one, each pinned by content hash. |
| Dependencies | What the scanner reads it as using: hosts, environment variables, paths, shell, packages and other MCP servers. |
| Evaluation status | The last trigger test, with its date and results, on the skill's page and in the evidence report. |
Recall limits and role-based bundles. Too many skills with overlapping descriptions make an agent pick the wrong one. Similar-skill detection and trigger tests show where descriptions collide so you can merge or sharpen them. Teams are the guide's role-based bundles: a skill can be for everyone or for chosen teams, and each person's agents are offered only the skills meant for them, through skillsvault pull and MCP.
Distribution and version control
- Pin versions. A machine installs exactly the version the signed bundle names; nothing changes until a new version is approved and made current.
- Roll back. Restoring an earlier version publishes its content as a new version, so the history stays linear and audited.
- Verify integrity. Every version is stored by SHA-256, the policy bundle is Ed25519-signed, and
skillsvault pullrefuses content that doesn't match the signed hash. - Across surfaces. The guide warns that custom skills don't sync between the API, claude.ai and Claude Code. skillsvault's one registry serves Claude Code (plugin,
pulland the gate), claude.ai and Claude Desktop (MCP tools and prompts), and the other agents that load skills. Uploading skills to a Claude API workspace (/v1/skills) is not yet supported.
Where to read more
- OWASP Agentic Skills Top 10: the same exercise against the OWASP list.
- Policies: Block, Warn, capability policies and exceptions.
- Connect via MCP: tools, prompts and sign-in.