QuantumBlack: Skills Key to AI Native Org Success

Building digital platforms involves a complex, iterative process that extends beyond simple product creation. This journey encompasses the development of code modules and the subsequent deployment of products. Once launched, the focus shifts to continuous optimization of product performance and proactive resolution of incidents.

This cyclical process, as described by Imad Touil, demonstrates that the moment a product is launched, the work of refinement and maintenance truly begins, leading back into further development cycles for ongoing improvement and issue resolution.

Agentic workflows consist of four core components: hooks, MCP services, sub-agents, and skills. While hooks trigger events, MCP services provide utility tools, and sub-agents help minimize the context window, these elements alone do not deliver sufficient structured value to workflows.

Skills emerge as the critical component, acting as essential containers for an organization's accumulated know-how. This makes them indispensable for structuring agentic workflows effectively and providing a framework for valuable organizational knowledge.

The concept of agent skills has seen rapid adoption and standardization within the AI community. Anthropic published the first article on skills just eight months ago, and within two months, an open standard for skills had already emerged, signaling widespread consensus and integration.

By February of this year, most agents had adopted this approach, even if not immediately visible. Imad Touil noted that when an agent is in its "thinking" phase, it can be observed pulling skills to perform its tasks, highlighting the ingrained nature of this new standard.

While models can perform well on complex tasks such as software engineering and cybersecurity without specific skills, the application of deterministic skills leads to demonstrably superior outcomes. Initial performance without skills provides a baseline, but the introduction of structured, deterministic skills significantly enhances consistency and reliability.

Imad Touil confirmed that with deterministic skills, "the outcome was clearly higher than without it." This indicates that skills improve task execution by ensuring more predictable and accurate results, surpassing the capabilities of raw model performance alone.

These principles dictate that skills must be reusable, modular, and readily discoverable to maximize their utility across various applications and teams. The design should avoid monolithic structures in favor of specialized skills tailored for specific tasks, thereby promoting efficiency and reducing complexity.

Adopting a composable design is crucial as it prevents conflicts and redundancies that often arise in less structured environments. Furthermore, skills should leverage progressive disclosure, a technique that significantly reduces token costs by only exposing necessary information at the relevant stages of an agent's operation. Imad Touil emphasized this, stating, "Skills need to be reusable, right? Need to be modular. Need to be disco- like you can discover your skills. Specialized skills, that is where the value. You should not build like a one skill like a monolith."

This transformation allows companies to operationalize their knowledge in a structured manner.

The progressive disclosure pattern, when applied to skills, ensures that tools are used optimally, only surfacing capabilities when contextually relevant. For instance, data retention policies can be implemented as skills, demonstrating regulatory compliance directly within agent operations and ensuring adherence to legal frameworks.

Managing skills through a catalog-driven approach is essential, particularly when dealing with regulatory compliance. This involves structuring skills in a composable manner to integrate various regulatory requirements seamlessly, such as data retention policies and GDPR rules.

These composable skills ensure deterministic outcomes and facilitate robust audit reporting, critical for demonstrating adherence to legal and internal standards. As Imad Touil explained, for regulations like GDPR, "You will need the GDPR rules that need to be respected," highlighting the necessity of such a structured framework.

This manifests through duplicated efforts by non-collaborating teams, leading to wasted resources and inconsistent implementations.

The absence of consistent testing and model validation results in quality degradation. Furthermore, challenges in discoverability and ownership mapping make it difficult to ascertain who owns which skill and how to find existing solutions, while unvetted scripts and prompt injection attacks introduce significant security vulnerabilities. Imad Touil explicitly warned, "However, if you don't govern skills, we will start creating new class of technical debt."

Achieving composability in skill development is not an automatic outcome; it requires deliberate design and a robust governance framework to ensure alignment across all building efforts. Security is paramount, necessitating comprehensive security pipelines to prevent the execution of insecure code within agentic systems.

Furthermore, granular access control is essential for managing sensitive business logic, ensuring that only authorized agents and users can access or modify critical skills. Imad Touil underscored this, stating, "Composability is not something that comes by default. You need to have a governance way to align what you're building and how to design it."

To successfully implement organizational skill adoption, the first step is enabling individual contributors to create, test, improve, and utilize skills. This fosters a bottom-up approach to skill development, empowering engineers to contribute their expertise directly. However, for these individual contributions to scale and provide structured value, a centralized platform becomes indispensable.

This platform serves as the foundation for managing skill metadata, ensuring discoverability through robust search capabilities, and handling critical aspects like dependency management and automatic version updates. Crucially, a centralized platform facilitates the integration of observability and evaluation frameworks, allowing organizations to monitor skill performance, identify areas for improvement, and maintain overall quality. Imad Touil outlined this, saying, "Now, how to bring this to your organization? First of all, you need to allow at the individual level to create, test, improve, and use the skills."

While technology provides tools, it cannot solely address the complex challenges of governance in an AI-native organization. Effective governance requires human-led, cross-functional oversight, involving key roles such as architects, engineering leads, infrastructure leads, and cybersecurity leads.

These individuals must collaboratively own specific domains related to skill development and deployment. This ensures that skill updates are not only technically sound but also align with broader organizational policies, strategic goals, and security requirements, providing a structured approach to skill evolution. Imad Touil noted, "That is where you should have your architects, your engineer leads, infra leads, etc. and cyber leads actually sitting down owning part of those domains."

The simulation tracked variables such as skill contribution, utilization, duplication, quality, and security.

The results clearly demonstrated that a lack of visibility into existing skills leads to significant cost increases, degraded quality, and substantial gaps in productivity. This highlights the critical need for structured skill management to avoid these detrimental outcomes in real-world organizational settings.

Engineers resort to "vibe coding," engaging in trial-and-error to understand and implement regulatory requirements correctly, which is highly inefficient.

This unstructured approach also results in excessive token consumption due to imprecise engineering instructions and generates inconsistent quality across teams. The overall quality becomes dependent on individual human maturity levels, rather than a standardized, reliable process, creating significant challenges for compliance and operational efficiency. Imad Touil observed, "If we don't have a skill about the regulation, that is someone is vibe coding back and forth and trying to figure out exactly how to steer the engineer to implement it properly."

Implementing governance fundamentally transforms how skills are developed and utilized within an organization. Once a skill is governed and published, it becomes a standardized, discoverable asset for all teams.

Consequently, when a new engineer or agent attempts to build a similar capability, the coordinated agent harness automatically identifies and pulls the existing skill. This eliminates redundant development efforts, directly addressing core governance issues like duplication, inconsistencies, and security risks. Imad Touil explained, "The moment you govern, you publish one skill, the next engineer trying to build a new skill, the coordinate agent harness will identify the skill that is already available and pull it."

Skills are not isolated entities but rather integral components of larger, comprehensive workflows. By establishing a centralized platform for all workflows, organizations can achieve a unified approach to managing both skills and broader operational processes. This centralization allows engineers to leverage existing infrastructure patterns and standardized practices across various projects. Moreover, such a platform enables a feedback loop where improvements made to individual skills or workflows can be pushed back to the centralized system, benefiting the entire organization and fostering continuous enhancement.

A skills registry is rapidly emerging as a critical component, often integrated within Internal Developer Portals (IDPs), centralizing this capability for many organizations.

Skills evaluation involves assessing their quality through static testing, ensuring adherence to best practices and performance standards. However, the concept of auto-evolving skills, while promising, carries inherent risks and requires stringent guardrails and strong governance to prevent unintended consequences and maintain control over system behavior. Imad Touil highlighted the widespread adoption, noting, "The good news is all of the players that's been solving the IDP problem like internal developer portal, they already start centralizing this capability."