Agent Skills in practice: the last mile of AI coding — don't let your code die on localhost

How to pack 8 years of cloud experience into your AI dev tools, and turn AI from an "intern" into a "certified expert". This post shares how to use Agent Skills to solve the pain points of AI coding, plus practical techniques for fixing AI's habit of not calling Skills.

Lately we've been tinkering with Agent Skills, trying to package the experience Tencent CloudBase has accumulated over the years and hand it to AI. In practice, the most torturous part isn't that AI can't write code — it's that the code it writes "can only live locally", and that it "never follows the rules".

This post shares two hands-on retrospectives:

1. Make AI-generated code shippable: inject platform awareness into AI so it uses the platform's native auth instead of fragile parameter-passing, and uses security rules instead of "naked" APIs — solving the awkwardness of code "dying on localhost".
2. Fix AI's "has Skills but won't use them" habit: through a "guide + plugins" structure plus simple engineering interception, hard-raising the skill activation rate from 20% to 84%.

The status quo: Vibe Coding's "local comfort zone"​

Lately developers are enjoying the thrill of Vibe Coding. A flurry of work on localhost produces a UI as pretty as a finished product, but the magic often stops dead at the "launch" moment.

AI's code logic is decent, but it can't perceive the real backend foundation, so the "locally optimal" solutions it generates are hard to ship.

The farthest distance in the world is from localhost to real access. AI fills the gap in code volume, but it can't fill the gap in engineering foundation.

What are Skills​

Skills was originally a feature Anthropic added to Claude Code in October 2025 — a capability package containing instructions, scripts and resources, bundling domain knowledge, steps and code into a "skill pack".

Essentially, a Skill is a folder containing a SKILL.md file. That file contains metadata (at least name and description) plus instructions telling the agent how to perform a specific task. Skills can also bundle scripts, templates and reference materials.

If AI is a top student, Skills are its "job operation manual". It doesn't change AI's IQ, but by injecting procedural knowledge, it lets AI know the "correct and efficient" operating standard in your specific environment.

Agent Skills officially became an open spec in December 2025, and major AI dev tools including Claude, Cursor, VS Code, GitHub Copilot and OpenCode have announced compatibility.

How Skills work: progressive loading​

Skills manage context efficiently through progressive loading:

1. Discovery: on startup, the agent loads only each Skill's name and description, judging which Skills might be relevant to the current task;
2. Activation: when a task matches a Skill's description, the agent reads the full SKILL.md instructions on demand;
3. Execution: the agent follows the instructions to execute, dynamically loading reference files or running bundled scripts as needed.

This approach keeps the agent highly responsive while, like "carrying an encyclopedia", fetching deep expertise the moment it's needed.

CloudBase Skills: packing 8 years of cloud experience for AI​

Tencent CloudBase, a team shipping serverless services since 2018, has also released CloudBase Skills (GitHub - TencentCloudBase/skills).

Much AI-generated code "dies locally" because AI only writes logic but doesn't know how to connect to a complex production environment. CloudBase provides AI with a highly abstracted infrastructure:

• Full-stack hosting and deployment: turn a project from localhost into a real accessible online URL;
• Multi-platform native auth: connect Web, mini program and other identity sources, no hand-written login logic;
• Database foundation: document (NoSQL) and SQL databases, with native consumer-facing permission control.

It translates CloudBase's real experience — supporting 1 billion API calls daily and 3.3+ million developers — into instructions AI can understand.

Scenario one: auth — refuse to "trust front-end input"​

• Wrong way: the front end passes userId to the backend; an attacker just intercepts the request and changes the parameter to escalate horizontally;
• Right way: after loading the auth-wechat Skill, AI is forced to drop front-end parameter-passing and use the cloud foundation's native chain. Security is guaranteed by the foundation's native mutual trust, not by the front-end input's goodwill.

Scenario two: data security — from "naked API" to "row permissions"​

• Wrong way: directly exposing the database API; the database is nearly "naked" to attackers;
• Right way: the Skill guides AI to push permission checks down to the database entry, directly driving the foundation's Security Rules — defining rules like auth.uid == doc._openid for a collection. Even if business logic has bugs, the foundation still blocks privilege escalation at the physical layer.

Scenario three: AI integration — kill hardcoded keys, close the loop in three lines​

• Wrong way: hardcoding the API Key in the front end and writing a mess of logic for streaming output;
• Right way: the Skill injects production-grade AI integration norms — keys auto-hosted in cloud env vars, "zero leakage" on the front end, a few lines to call the LLM with streaming handled automatically.

The core value: AI provides the upper bound of logic, while CloudBase Skills hold the lower bound of engineering.

In practice: installing CloudBase Skills​

npx skills add tencentcloudbase/skills

That installs our multiple Skills into your dev tool.

The full skill matrix​

We categorize Skills by their function in real development, ensuring AI calls the right SDK and tools in different environments. Core idea: Environment as Boundary.

Guide routing, three-platform isolation: Web, mini program and Node.js have same-named methods with different logic; we split them into independent plugins, physically preventing AI from writing Web SDK syntax inside a mini program (semantic pollution). cloudbase-guidelines is the default entry for every task — like a semantic router, it first determines the project environment, then points AI to activate the corresponding sub-Skill.

MCP vs Skills​

CloudBase MCP: the "engineering hands" that were ready long ago. Through MCP, the AI assistant gains structured permission to operate the Tencent Cloud foundation — querying cloud state, creating resources, pulling logs directly.

CloudBase Skills: the "job manual" that came later. If MCP gives AI the "permission" to work, Skills give AI the "discipline" to work.

"MCP provides standardized secure connections, while Skills provide production-grade engineering intuition."

Together, they evolve AI from a "strong but reckless intern" into a "disciplined, authorized" senior cloud development expert.

Finale: Skills pitfalls and retrospectives​

1. Why does AI "play dead"?​

Even with Skills configured, AI still ignores them. Two underlying model dynamics are at play:

• Attention bias: the deeper you chat, the higher the weight of business requirements, and external Skills as background get "diluted";
• Inference laziness: if the model thinks its pre-trained data can generate "seemingly correct" code, it skips external tool calls.

In our regression tests, without intervention, AI's proactive call rate was only around 20%.

2. Three hard-core solutions to "tame" AI​

Solution A: the crude but stable "first-line injection" — prepend this to your prompt:

You MUST read the cloudbase-guidelines skill FIRST when working with CloudBase projects.

The principle is the primacy effect: the model naturally pays the most attention to the beginning of the input sequence.

Solution B: project-level "house rules" (System Rules) — create CLAUDE.md or AGENT.md in the project root with project-level constraint rules.

Solution C: automated "forced interception" (Forced Eval Hook) — use the editor's Hook mechanism to intercept the question the moment you press Enter, forcing AI to first generate an evaluation report before outputting any code: "What Skills are available? For this requirement, do I need to call them? Why?"

According to technical expert Scott Spence's tests, this "interception + evaluation" approach can force the activation rate from 20% up to 84%.

3. Architecture retrospective: why must it be "guide + independent plugins"?​

AI's biggest flaw is "not distinguishing platforms". We didn't build a "combo pack" Skill; we used a distributed architecture of "1 guide (Guidelines) + 21 independent Skills":

• Solve semantic pollution and environment misjudgment: Web, mini program and Node.js SDK method names are extremely similar; splitting by platform physically, plus the cloudbase-guidelines entry determining the environment first (e.g. detecting app.json means mini program), shields interference and shrinks the search space by 90%;
• Developers can "order precisely": independent plugins support local reinforcement — you can directly order "call auth-web to check phone-number login", forcibly pulling AI's thinking back onto the right narrow path.

In closing: the leap from "code generation" to "production delivery"​

The productivity of AI programming doesn't depend on how exquisite the model's logic is, but on how much "engineering constraint" you hold over its generated code.

1. The essence: turning "tacit experience" into "procedural knowledge". CloudBase Skills inject engineering "muscle memory" into AI, letting it truly understand the "correct and safe" delivery standard;
2. The paradigm shift: the next stop of agent evolution isn't just stronger reasoning, but completing the perception of infrastructure;
3. Determinism is the only yardstick of AI development: we shouldn't expect AI to automatically become "perfect" — we should use engineering means to make it "stable".

AI provides the upper bound of logic, Skills hold the lower bound of engineering, and CloudBase is the physical foundation carrying it all.

We're at the node of leaping from "Vibe Coding" to "production delivery". Install CloudBase Skills and set some rules for your AI.

npx skills add tencentcloudbase/skills

Related links:

• https://github.com/TencentCloudBase/Skills
• https://github.com/TencentCloudBase/CloudBase-MCP