Skills

Skills give an agent instructions for a procedure or knowledge about your systems. A skill can explain how your application authenticates requests, how to investigate a particular weakness, or which conventions to follow when preparing a fix. Pass skills as strings in the agent’s skills array. You can write the instructions directly in your code or load them from another source, such as a Markdown file.

Add skills to an agent

To add a skill to an existing agent, preserve its configured skills with object composition:

import Antigen, { tCell } from "@antigen/sdk";

const antigen = new Antigen(process.env.ANTIGEN_API_KEY);
const original = await antigen.agents.get(tCell);

const authentication = `
Our application uses JWTs signed with RS256.
The public keys are available at /.well-known/jwks.json.
Access tokens expire after one hour.
Clients refresh them through POST /auth/refresh.

When testing authentication:
- Check whether expired tokens are rejected.
- Check whether modified claims invalidate the signature.
- Check whether the refresh endpoint validates the original token.
- Check whether a token for one account can access another account's data.
`;

const agent = antigen.agent({
  ...original,
  skills: [...original.skills, authentication],
});

Focus each skill on a specific topic. “Check authentication for vulnerabilities” adds little context; the token format, endpoints, and expected behavior give the agent something concrete to investigate.

Load instructions from a file

You can keep skills in Markdown files alongside your code. Read each file and pass its contents to the SDK:

import { readFile } from "node:fs/promises";

const authentication = await readFile(
  "./skills/our-jwt-scheme.md",
  "utf8",
);

const agent = antigen.agent({
  ...original,
  skills: [...original.skills, authentication],
});

The SDK treats each string as instructions. It does not interpret file paths or read files for you. In this example, the Markdown file must be available where your code calls readFile().

Replace configured skills

Supply a new array to replace the skills exposed in the agent’s configuration:

const agent = antigen.agent({
  ...original,
  skills: [authentication],
});

This replaces the configurable skills while retaining the underlying pre-built agent’s behavior. See Agents for how configuration inherits from a base agent.

Use skills for different kinds of work

Skills can guide offensive testing, triage, or remediation. For example:

Work	Useful skill content
Testing	Authentication flows, API conventions, and expected access boundaries
Triage	Service ownership, deployment structure, and how to locate affected code
Remediation	Repository conventions, test commands, and requirements for proposed changes

Use skills to explain how work should be done. Use guardrails to specify constraints, such as avoiding particular endpoints or stopping when a critical vulnerability is found.

Save and update skills

Registering an agent saves its skill strings with the rest of its configuration:

await antigen.agents.register("our-security-agent", agent);

When your team retrieves the agent, its skills array contains those instructions. It does not depend on files from the environment that registered it. To change the saved skills, pass the updated strings to antigen.agents.update(). The skills array you send becomes the agent’s saved array.

Append a skill

Retrieve the agent and spread its existing skills into the new array before adding your instructions. This keeps the saved skills and adds authentication:

const saved = await antigen.agents.get("our-security-agent");

await antigen.agents.update("our-security-agent", {
  skills: [...saved.skills, authentication],
});

Replace the skills

Pass only the instructions you want to keep. This replaces all previously saved configurable skills with authentication:

await antigen.agents.update("our-security-agent", {
  skills: [authentication],
});

update() does not merge arrays. Include the existing entries to append to them, or leave them out to replace them. If you keep instructions in a file, read the file again and submit its updated contents. Editing a local file alone does not change a registered agent.

Getting started

Asset Map

Runs

Vulnerability Lifecycle

Team Workflows

SDK

CLI

Integrations

Add skills to an agent

Load instructions from a file

Replace configured skills

Use skills for different kinds of work

Save and update skills

Append a skill

Replace the skills

​Add skills to an agent

​Load instructions from a file

​Replace configured skills

​Use skills for different kinds of work

​Save and update skills

​Append a skill

​Replace the skills

Add skills to an agent

Load instructions from a file

Replace configured skills

Use skills for different kinds of work

Save and update skills

Append a skill

Replace the skills