A Skill is only as good as its distribution

Skills put your company's know-how into AI without a project. How we close the quarter. How we review a supplier contract. How we triage a ticket. An expert writes it down once, in the open SKILL.md format, and every assistant that loads it follows the playbook. Tools are the verbs. Skills are the playbooks.

Without a playbook, people re-teach their assistant the same thing every week, and every assistant does it a little differently. The Skills worth governing are your own: the next model will absorb generic ones, but not your way of working.

Who a Skill is for

Writing one takes an afternoon. We know, because we run Palma on Skills ourselves.

Then the questions start. They are the same at every company we talk to, whether it has ten Skills or a few hundred.

1. Does it reach everyone?

One company we talked to kept a copy of every Skill in four apps: Claude, ChatGPT, Microsoft Copilot Studio and Cursor. Four uploads per change, and four versions to keep in step.

A Skill that lives inside one assistant is a bookmark. A Skill that lives in one place and reaches every assistant is a company asset. People keep the assistant they like, and the Skill comes with them. A copy on a laptop is a fork, and forks drift.

Palma delivers Skills through the one connector each employee already has, over MCP, the open standard that connects assistants to tools. Publish once, attach it to the right teams, and it's in every assistant they use: 18 of them, Copilot Studio included. Assistants find Skills through search and load tools and slash prompts. That way they load only the Skill they need, not your whole library in every prompt. Token spend stays down as the library grows. Assistants that support the new MCP Skills standard also get them natively. Access follows your identity groups. When someone leaves the team, the Skill leaves with them.

2. Is anyone using it?

A platform lead at a large enterprise told us they could not tell whether anyone used the Skills their team had published. Their assistant's compliance API showed the chats, not the Skills. They were curating a library with no idea who read it.

Installed isn't used. The model decides when to load a Skill. So measure Skills the way you would measure a product: loads and people per Skill, per assistant, over time. Then look at the other side: what people searched for and did not find. That list is your backlog.

Because every search and every load passes through the connector, Palma sees both. Skill analytics shows loads, people and adoption per assistant for every Skill, and the searches that found nothing. For companies with a works council there is a reduced mode. Palma governs actions, not people. It sees what agents do, not the chats.

3. Does it still work?

Skills rot. A Skill names a tool, the vendor renames the tool, and the Skill keeps loading and keeps failing on step one. The agent burns tokens on every attempt. One manufacturer's platform team put it plainly: people keep using Skills that are no longer up to date.

Treat a Skill like software. Every version kept, edits held as drafts until someone publishes, an owner with a name, and a check that the tools it needs exist where it is served.

Palma keeps every version and holds edits to a live Skill as drafts until they are published. Authors try each draft in their own assistant before anyone else sees it. Palma checks that every tool a Skill needs is available to the team the Skill is served to, and flags the ones that would break. When a vendor changes a tool, Palma spots it, shows every team and rule affected, and the owner decides. When a Skill has had its day, you deprecate it and then archive it, and Palma won't archive a Skill that something still uses. Next, we're building staged rollouts: canary releases and version pinning per team.

4. Is it safe, and who owns it?

Security teams read a SKILL.md for what it is: instructions that steer an agent, pulled from a repository or saved from a chat, often with scripts attached. That is a supply chain. Hidden instructions, exfiltration tricks and pasted credentials all fit in a text file.

The second half of the question is ownership. A Skill with no owner has nobody to call when it breaks, and nobody to answer for what it tells the agent to do.

Palma checks every Skill version before it can be served: against more than 100 vendor credential patterns and 8 threat categories. If you switch it on, an EU-hosted AI reviewer adds a second opinion. A flagged version is held back and the last clean one keeps running. Taking a Skill company-wide can require a second reviewer, while releases to your own team stay fast. Every Skill has one accountable owner and can have collaborators, and a private copy can't shadow the official one.

A Skill tells the agent how. It doesn't decide what the agent may do. Palma checks each tool call at the moment it happens, whichever Skill asked for it, and catches personal data before an agent sends it out.

5. Does it get better?

A Skill is never finished. The people using it find the gaps first, so make it easy for them to say so, and keep a person in charge of the fix.

In Palma, assistants file improvement suggestions with evidence from real use. Similar reports are grouped in the owner's inbox, and whoever filed one hears the outcome. Requests for Skills that don't exist yet are captured too, so the backlog writes itself. Agents can't edit Skills themselves.

What this adds up to

Superpowers for every employee, with control for central IT. Your experts write the playbook once. Palma gets it into every assistant, tells you whether it is used, catches it when it breaks, keeps it safe with a name on every Skill, and makes it better from real use.

Most AI governance blocks people. Ours distributes power.