There’s a quiet contradiction at the heart of the skills gold rush. Everyone is writing skills as SKILL.md files and sharing them like screensavers. But if your expertise is valuable, a text file is the worst possible container for it. The moment you hand someone the file, the secret is gone. They can read it, copy it, fork it, and re-share it in seconds.
You can’t sell something you give away on first contact. So how do you let an agent use your expertise without handing over your expertise?
The answer is architecture, not encryption
People reach for encryption first. It doesn’t work here. At the moment an agent reasons over a skill, the text has to be in plain form in its context — and whoever controls that context can read it. Encrypting a skill you ship to someone else is like locking a diary and taping the key to the cover.
The fix is to change who runs the skill. Instead of shipping the skill to the agent, you keep the skill on a server you control and expose it as a queryable endpoint. The agent doesn’t receive your skill. It receives a tool it can call.
This is exactly what MCP (the Model Context Protocol) is for. A Skuilds skill is an MCP server with a few tools:
list_sections— the agent discovers what the skill covers (titles, when to use each).get_section— it pulls one specific part.query— it asks a question and gets back only the relevant slice.
The agent never sees the whole skill. It sees answers. The raw, structured expertise stays on the endpoint. Behavior becomes the product, not the text. That’s how a skill can be both useful to a hundred agents and secret like an API key.
Why “queryable in parts” matters too
There’s a bonus. Dumping an entire skill into an agent’s context is bad practice anyway — it’s expensive, it dilutes attention, and the model loses the thread in a wall of text. Structuring a skill into retrievable sections means the agent pulls only what’s relevant to the task in front of it. Better answers, lower cost, and the full picture never has to be exposed at once. Secrecy and quality point the same direction.
The honest limit
We won’t oversell this. Hosting execution means the raw recipe never leaves — that part is real. But a determined caller can still probe the endpoint with many queries and reconstruct some of the underlying logic, the same way any API can be partially reverse-engineered. You can’t make expertise mathematically un-extractable. What you can do is make the recipe never handed over, and raise the cost of extraction with rate limits, monitoring, and terms.
“Secret like an API key” is the right mental model: not unbreakable, but never simply given away. For expertise that took years to build, that’s the difference between an asset and a giveaway.