Someone sends you a folder, or you find one on GitHub, and it claims to teach your AI assistant to do something useful. Installing it takes about two minutes once you know where it goes — and the two minutes before that, spent reading it, matter more than the install.

If you’re not sure what a skill is yet, start with How to build your own AI skill and come back. The short version: a skill is a folder containing a SKILL.md file that tells an assistant how to do one specific task. Both Anthropic and OpenAI adopted the same open format, so a skill written for one usually runs in the other.

First: read it

A skill is a set of instructions your assistant will follow, sometimes with scripts attached and sometimes with permission to reach the network. That is useful and it is also the risk. Anthropic’s own guidance is blunt about it — install only from sources you trust, and review the contents before enabling.

You don’t need to be technical to do this well. Open SKILL.md and read it like a document, because that’s what it is. Four questions:

  1. Does the instruction text match the title? A skill called “format my notes” that also contains instructions about sending things somewhere is not a formatting skill.
  2. Is there a scripts/ folder? If so, someone should look at what those scripts do before you run them. If nobody can, don’t install it.
  3. Does it reach outside your machine? Anything fetching a URL, calling an API, or posting data is a thing you’re consenting to.
  4. Where did it come from? A named author with a public repository is a different proposition from a ZIP attached to an email.

The specific failure to have in mind is prompt injection: instructions buried in a file that your assistant reads and treats as commands. A skill is exactly the kind of file that can carry them. This isn’t a reason to avoid skills; it’s a reason to read them, once, before enabling.

Don’t put anything into a skill you wouldn’t want repeated — credentials, keys, anything private. Skills get shared, and they travel with the folder.

Claude, in the desktop app or browser

Claude takes a ZIP file.

  1. Check Settings → Capabilities and make sure code execution and file creation is on. Skills won’t appear without it.
  2. Go to Customize → Skills.
  3. Use the create/add control and choose the option to upload a skill.
  4. Select your ZIP.
  5. Toggle the skill on, then test it in a new conversation.

The ZIP has to contain the folder, not the loose files. This is the error almost everyone hits once:

✓ weekly-update.zip → weekly-update/ → SKILL.md
✗ weekly-update.zip → SKILL.md

On a Mac, right-click the folder and choose Compress; on Windows, right-click → Send to → Compressed folder. Both do the right thing as long as you compress the folder rather than its contents.

The other common rejections: the folder name doesn’t match the name field inside SKILL.md, there’s no SKILL.md at all, or the name or description contains characters the uploader won’t take.

Once enabled, a skill is available to Claude anywhere your account is — including the Microsoft 365 add-ins, if you use those.

Claude Code

No upload, no ZIP. Skills are just directories, and Claude Code watches them, so a skill you drop in during a session becomes available without a restart.

Personal — available in every project:

mkdir -p ~/.claude/skills && cp -R ./weekly-update ~/.claude/skills/

Project-specific — lives with the code, and travels with the repository if you commit it:

mkdir -p .claude/skills && cp -R ./weekly-update .claude/skills/

Invoke it with /weekly-update, or just describe the task and let it trigger itself. The command name comes from the directory name, so if you rename the folder, you rename the command.

One trap worth knowing. Cowork sessions don’t read ~/.claude/skills/ on your machine — they load the skills enabled on your Claude account instead. So a skill installed only into Claude Code won’t show up in Cowork, and the fix is to upload it through Customize → Skills as well. If you use both, expect to install twice.

Codex

Codex reads skills from directories too, and picks them up automatically.

Personal, across every project:

mkdir -p ~/.agents/skills && cp -R ./weekly-update ~/.agents/skills/

Inside a project — Codex looks in .agents/skills from your working directory up to the repository root, so a skill at the root is available from any subfolder:

mkdir -p .agents/skills && cp -R ./weekly-update .agents/skills/

Invoke it with $weekly-update — that is, $ plus the skill name. If a newly-added skill doesn’t appear, restart Codex.

There’s also an installer for curated skills, run from inside Codex:

$skill-installer linear

And you can switch a skill off without deleting it, by adding an entry to ~/.codex/config.toml:

[[skills.config]]
path = "/path/to/skill/SKILL.md"
enabled = false

Restart Codex after editing that file.

ChatGPT

In the ChatGPT app, skills are uploaded through settings — find the Skills section, choose to create or add one, and upload from your computer. ChatGPT scans the skill before it becomes available, which usually takes a moment.

Invoke a skill explicitly with @skill-name, or let it trigger from the description as normal.

Availability here depends on your plan and, in a shared workspace, on what an administrator has allowed — that’s the part most likely to differ from what you see written anywhere, so check the current documentation if the option isn’t where you expect.

Moving a skill between the two

Because both platforms implement the same open standard, this mostly works without modification. Take the folder, put it in the other tool’s location, done.

Two things don’t always survive the trip:

  • Optional platform-specific files. A Codex skill may include an agents/openai.yaml for display name, icon, and invocation policy; a Claude Code skill may use frontmatter fields like allowed-tools. The other platform ignores what it doesn’t recognise, so this is harmless — the skill still runs, it just loses that extra behaviour.
  • Assumptions about tools. A skill that expects to run shell commands or read local files will do less in a browser chat than it does in a terminal. Nothing breaks; it quietly does a smaller version of the job. Worth testing rather than assuming.

After installing

Run it once deliberately, by name, and read the output properly. Then try it a second time by describing the task in your own words, to see whether it fires on its own — a skill that never triggers automatically usually has a vague description, and you can edit that line yourself.

Then be ruthless about pruning. Every enabled skill takes up a little of the assistant’s attention, and a long list of skills you installed once and forgot makes the ones you rely on less reliable. Turn off what you don’t use.

Keeping this current

Install locations and menu names are the parts of this that change. When something on screen doesn’t match what’s written here, believe the screen and check the source:

Written 31 July 2026. Verified against both sets of documentation on that date.

If you want the layer underneath this — what these systems actually are, where they fail, and the vocabulary to follow the conversation — The AI Primer is the plain-English version. $23.97.