Skills
Read this if: you need the architecture boundary for reusable instruction bundles.
Skip this if: you are looking for runtime-enforced workflows or in-process extension code.
Go deeper: Playbooks, Gateway plugins, Sandbox and policy.
Skill boundary at a glance
| Surface | What it provides | Enforced by runtime? | Best use |
|---|---|---|---|
| Skill | Reusable instructions and workflow guidance | No | Teaching the agent how to approach a task |
| Playbook | Deterministic workflow spec | Yes | Multi-step controlled execution |
| Plugin | In-process gateway extension | Yes, at gateway boundary | New routes/tools/commands |
Purpose
Skills are instruction bundles the agent can load on demand to perform specialized workflows consistently. They are guidance, not enforcement. The safety boundary remains in tool policy, approvals, and sandboxing.
In the compiled runtime prompt, skills live in the system prompt as Skill guidance: sections. They are intentionally lower-precedence than:
- system/runtime safety rules
- tool schemas and tool contracts
- the current user request
That keeps skills useful for workflow consistency without letting them override policy or tool contracts.
Load sources and trust posture
Local precedence is workspace when trusted, then managed, user, and bundled. Shared mode loads shared managed skills before bundled skills and never loads workspace or user tiers.
workspace_trusted defaults to false; omitted modern and legacy configurations agree. Persist explicit true only when workspace guidance is deliberately accepted. Workspace skills can be model-writable when mutation tools are exposed. User skills under the Tyrum home are same-UID writable and may shadow bundled skills; a same-UID child can alter either writable tier. Precedence is prompt provenance, not confinement or persistence protection. Manifest meta.id controls identity and is not required to equal the directory name. Discovery later uses that ID as a path segment, so an ID/directory mismatch is a residual fallback and shadow-selection risk rather than a validated invariant.
Bundled skills are:
tyrum-docs, for Tyrum product and operator guidancecoding-agent-cli, for bounded foreground coding-agent CLI delegationcoding-agent-cli-background, for durable background CLI lifecycle guidance
Effective requirements and status
requires.tools is enforced per turn as an all-of requirement against complete effective available tools after profile, state, process availability, match-target registration, and confinement resolution. Prompt-selected tool filtering does not decide skill availability. requires.mcp and requires.nodes are not yet enforced.
Turn context reports expose loaded inventory in loaded_skills and post-requirement guidance in enabled_skills. Runtime status skills and skills_detailed are loaded, not effective: status has neither a selected execution profile nor a reliable background-supervisor availability snapshot.
Foreground process configuration
Foreground guidance is subagent-only. Use a WorkBoard-dispatched subagent with execution_profile: executor_rw, and configure its agent with exact tools.allow: ["process.run"]. A process.run grant on an agent used only in a main interaction turn exposes neither the tool nor guidance. The background skill works independently in interaction when all four lifecycle tools are explicitly exposed and available.
Key rules
- Skills must never be treated as a bypass around tool policy or approvals.
- Skills must be framed as advisory workflow help, not as hidden policy or hard requirements.
- Operator surfaces should show skill provenance so users can distinguish bundled, user, and workspace sources.
- Marketplace discovery is acceptable only with reviewable provenance and explicit enablement.
- Skills must reference secret handles rather than embedding raw secret values.