# Skills A skill is an [Agent Skills](https://agentskills.io) package: a `SKILL.md` file (YAML frontmatter with a `name` and a `description`, then a markdown body) plus optional text files under `scripts/`, `references/` and `assets/`. Install one from a URL and Devii can use it. - **Private.** Your skills are visible only to you. An administrator may delete any skill. - **On demand.** Only the name and description of your *enabled* skills are added to Devii's system prompt. Devii loads the full body and bundled files with `get_skill` when a request matches. Installing, enabling, disabling or deleting a skill takes effect on the next turn. - **Untrusted text.** A skill is third-party text. It guides Devii within what you asked for; it never bypasses a confirmation, never grants a tool (`allowed-tools` is stored, not honoured), and its scripts are stored as text and never executed automatically. - **Install.** Pass a direct `.../SKILL.md` URL, or a directory URL (redirects to an index page are reduced to their directory and `SKILL.md` is fetched from there). Bundled files are fetched only when the body references them by relative path under `scripts/`, `references/` or `assets/`, on the same origin, as text, within the size and count limits. Anything skipped is reported with a reason. Installing the same `name` again updates it in place. Every endpoint follows the shared [Conventions & Errors](/docs/conventions.html) (auth, content negotiation, pagination, status codes); see [Authentication](/docs/authentication.html) for the four ways to sign requests.