When you dotnet restore to pull dependencies, the skill file is already quietly lying in the package cache of your computer. The AI no longer has to guess how to use the library – the instructions are in the package and match the version exactly
At the beginning of last month, Richard Lander of the .NET team posted an article on the official blog with an unremarkable title – “Delivering Skills in NuGet packages”. But there is a very interesting idea hidden in it:Let the NuGet package send the “instruction manual” for the AI coding assistant while sending the binary.。
you dotnet restore When pulling dependencies, the skill file is already quietly lying in the package cache of your computer. The AI no longer has to guess how to use the library – the instructions are in the package and match the version exactly.
Why is this worth talking about? Because it conveniently solves one of the most embarrassing problems of AI programming tools at the moment.
A clear concept first: what is Skill?
Anthropic launched something called Agent Skills last October, which has now become a de facto standard and is supported by more than 20 platforms including GitHub Copilot, Cursor, Codex, and Gemini.
Speaking in human language:Skill is a folder with a copy of SKILL.md in it to tell the AI ”When encountering this type of task, follow this routine.”. Write a clear name and description in the first few lines of YAML in the file. The main text is Markdown instructions. If you are particular, you can also add scripts and reference materials.
Its cleverness lies in “progressive disclosure”: usually the AI only sees the introduction of dozens of tokens for each skill, and only loads the full text when the task is really matched. So you can pack a bunch of skills without overwhelming the context.
The problem then arises: when skills become assets, someone must manage their distribution. At present, there are only two mainstream methods – either put it in your own warehouse, or go to the “skills market” to install it. Both methods have the same problem:You have to know that a certain skill exists before you can install it. And whether the installed version matches the library actually used in your project depends entirely on luck.
Microsoft officially operates its own dotnet/skills skills market. In the announcement, they couldn’t help complaining: “If you don’t know where to look, you won’t be able to use the best skills.”
NuGet’s idea: the manual comes with the product
Package managers naturally do not have this problem. When you reference the Markout package, the Markout skills will be delivered to your local machine along with the package – there is no need to subscribe to the market or remember the website address, the updated package is the update of the skills.
The demo of Microsoft’s experiment is like this: there are 5 skills in a package, the largest one is less than 10KB, they appear in ~/.nuget/packages/markout/0.40.0/skills/ Below, dependency manifest file project.assets.json The path of each SKILL.md is automatically listed——This file incidentally becomes the machine-readable directory of “skills available for this project”。
And pay attention to the version number: skills are tied to the package version. Model training data is always in the past tense. No one knows about the new API released five minutes ago, but the new version of the package can be put on the shelves with the new version of the manual. The same goes for the hundreds of thousands of unpopular packages in the long tail – the model has never seen you, but you can tell who you are.
Lander has a sentence that sums it up well: the README in the package is written for humans to read, and the SKILL.md in the package is written for AI to read. The format is still the same open format, the package just has one more delivery channel.
The entire link can be summarized as follows: maintainer packaging → restore landing cache → four types of tools responsible for “discovery/scanning/warehousing/self-installation” → team warehouse or directly enter the AI context. Note that the four green paths on the upper right side of the picture are coexisting alternatives. They are still community experiments and the standards have not yet been determined.
For internal libraries of enterprises, this method is especially popular. The internal library does not exist in the training data of the public network model at all, and the documentation is lagging behind all year round. Now send the skills along with the package to the company’s private NuGet source.dotnet add package Afterwards, the AI immediately knows the correct posture of this set of internal APIs – no training or wiki required.
Tool chain: official half set, community fun
Microsoft has produced two supporting tools, with a clear division of labor:
dotnet-inspect Responsible for “discovery”. Run against the package name or project file and list all the skills included in the dependencies: package name, version, size, and introduction at a glance. The AI can decide based on this whether to directly read the skill into the context, or to place it on the disk and check it slowly.
dotnet-package-skills Responsible for “warehousing”.install Once run, scan all direct dependencies and copy the discovered skills to .agents/skills/ Directory – This directory is recognized by Copilot, Codex, and Cursor. After submitting it to git, it can be used by the entire team and the cloud agent. There is a wonderful observation in the README of this warehouse: the traditional skills market requires a marketplace.json as a directory;The directory of the skills in the package is your own .csproj – whichever dependencies you choose will be in the directory.。
The community actually goes further than the official. Mockly, this HTTP mock library, uses a “self-installation” solution: the package comes with a section of MSBuild targets. Once you build, the skills are automatically copied into the AI directory of the warehouse, and the version upgrade will automatically follow. There is an open source project called Zakira.Imprint that does a more complete job: skills and MCP server configurations are distributed together. It can help you smooth out the directory and JSON format differences among Copilot, Claude, and Cursor, and can accurately clean up by package.
But I want to pour some cold water: these are all community experiments with “tools first, standards undetermined”. NuGet officially doesn’t treat skills as first-class citizens yet.dotnet restore Nothing will be enabled for you, it’s up to you to pick up the tools how to use it.
Is it worth it? Let the data speak
Skills are not free – they enter the context of the AI and burn your tokens. So the core question is: Is it worth the price?
The SkillsBench benchmark released in February this year tested a variety of model combinations, and the conclusion is:Skills increase task pass rate by 16.2 percentage points on averagethe cost is 6–13% more input tokens. What’s interesting is that Gemini 3 Pro added skill tokens, but the performance dropped by 6% – good skills help the AI avoid detours.
NVIDIA used its own evaluation framework to run a batch of verified skills. The scores in the five dimensions increased by an average of 31 points, and the accuracy was pulled from 46 to 87. But whether you can save tokens depends on each skill: there is a memory optimization skill that cuts tokens by 77%, and another installation guidance skill increases tokens by 120%.Unexpected, don’t know。
There is a more worrying variable: activation rate. The skills are installed there, and the AI may not necessarily use them. Tessl measured it on 2286 tasks and found that the activation rate was 98% when clearly informed that “skills must be used”, but only 41% when left to the AI to do its own thing. Another set of 650 tests identified the culprit – the description at the beginning of SKILL.md: written as a command “Be sure to call this skill when encountering XX”, the activation rate can reach 100%; written as a passive passive, it dropped to 37%. Same skill, three times the difference.
Microsoft’s internal experimental conclusions are very pragmatic: there is little room for improvement in the performance of cutting-edge models (they can reverse the usage of the package themselves, but they just burn money), and the value of skills is mainly in efficiency; weak models have poor compliance, and skills may not be followed after they are written. So they made two rules:Only use cutting-edge models for main testing(Only testing cheap models is an anti-pattern), andPareto principle——If a skill increases the efficiency of small models by 50% but makes expensive models like Opus cost 10% more tokens, that is a negative optimization, because Opus tokens are much more expensive and will offend the users who least deserve to be offended.
Safety issues that cannot be ignored
This has a shadow, and it’s not a small one.
The Markdown in the package used to be a “lazy asset” – if you didn’t read it, nothing would happen to it. It’s different now:AI will read it and act on it. A malicious package does not need to ask you to run any code, it only needs to ask your AI to read a markdown file. The academic community has given this type of attack a name, and demonstrated techniques include hiding instructions to steal API keys and burying malicious instructions in image assets to bypass text review.
The NuGet ecosystem’s own supply chain record is not clean: in 2024, there were 60 incidents of malicious packages carrying remote control Trojans, and in February this year, a secret-stealing package targeting ASP.NET developers was exposed. The skills in the package are equivalent to opening up a shorter execution path for this type of attack, especially the “automatic copy during build” gameplay, which overlaps the two attack surfaces of writing files during the build and injecting AI instructions.
The good news is that the community is already patching things up. The dotnet/runtime repository has a formal proposal, and the design principles can be used as a baseline:Skills are packaged and versioned, and discovery can be automatic, but activation must be explicit.;Show package ID, version, source, content hash before enabling; Allow organizations to whitelist by publisher and signature. NuGet itself has also increased its trust infrastructure in the past two years: OIDC trusted publishing, package signing, and API key validity periods have been reduced from one year to 30 days. These were originally for binary use, and the concept of extending them to the skills in the package is a natural progression.
Before the official solution is implemented, there are only a few practical self-protection actions: check after restore project.assets.json Whether there is SKILL.md in it, first figure out what lies in your dependencies; review third-party skills as third-party scripts before using them; submit the reviewed skills to the warehouse for unified management in team scenarios.
Looking at other ecology: they are all squeezing in the same direction
Shoeing skills into package managers is not unique to .NET. The npm ecosystem has launched a number of solutions in the first half of this year: some are packaged with skills and have independent installers, some are automatically installed using prepare hooks, and Vercel’s official skill CLI has recently even introduced skills skills-lock.json——Lock files, the signature concept of package managers, have officially entered the skill distribution. Microsoft’s Agent Framework in Python supports writing skills as classes,pip install Then register in one line.
From a horizontal perspective, NuGet has structural advantages that no one else has: all packages must go through the local global cache, and even the “installation” step of skills can be omitted; the private source system is mature, and internal distribution within the enterprise can be used out of the box; trust facilities such as signatures, namespace reservations, and vulnerability audits are all ready-made, and skills can be directly used.
Of course, it also has boundaries: only libraries that are “already dependent” can issue skills like this. Purely methodological skills (such as “how to write a good commit message”) do not have corresponding packages, so you still have to rely on the market model.
So, can NuGet be used as a skills manager?
My judgment is:It is already a de facto skills distribution channel, but not yet a platform。
It is said that it is a channel, because the mechanism is in place, the tools are in place, and real packages are already being released. The design of “skill version equals package version” also solves the most difficult problem of discovery and version matching in the skill ecosystem. It is said that it is not a platform, because the NuGet official website has not yet listed the technology as metadata, the formal CLI and management standards are still in the discussion draft stage, and NuGet’s MCP server has not yet been connected to the technology.
Next, it is worth keeping an eye on three signals: whether the dotnet/runtime governance proposal will be formalized, when NuGet MCP will support skill discovery, and whether nuget.org will display “This package comes with AI skills” on the package details page like it displays README.
One day when these three things come together, “the package is the instruction manual” will no longer be an experiment in the blog, but the de facto standard of the platform.
For us ordinary developers, what we can do now is very specific: assign a skill to the internal library maintained by our team – the public network model knows nothing about them, and the private NuGet source naturally solves the problem of distribution, which is the highest investment-output ratio in the entire gameplay.
Reference materials: .NET Blog “Delivering Skills in NuGet packages”, dotnet/runtime Discussion #134032, SkillsBench (arXiv:2602.12670), NVIDIA Developer Blog, Tessl Research, Zakira.Imprint, etc. For details, see the sources mentioned in the article.
Related links
original data
Microsoft official tools and projects
Skills standards and assessment
community practice
