Tools
·
5 MIN
Extending agentic harnesses: skills, artifacts, commands and connectors
The model gets the headlines. The harness around it is where your leverage and your attack surface both live.
LOCATION
Worldwide
SERIES
AI Tooling & Dev Harnesses
AUTHOR
Aashwin Shrivastava
PUBLISHED
The model gets the headlines, but the harness around it is where the leverage compounds. Skills, slash commands, hooks, connectors, subagents: this extension surface is what turns a generic agent into something that knows your processes, runs your checks, and reaches your systems. It is worth understanding part by part, because each part is also a way in.
This is the map of that surface, what each piece is for, and where the sharp edges are.
01.
Five ways to extend, one principle
Underneath the names, every extension point does the same thing: it moves know-how out of the prompt and into version-controlled files the agent loads when it needs them.
Skills are folders of instructions, scripts, and resources. A short description sits in context; the full skill loads only when the agent judges it relevant. This is progressive disclosure: cheap to keep around, detailed when invoked.
Slash commands are named shortcuts that expand into a fixed prompt. The plain way to encode a repeated request once and reuse it.
Hooks are shell commands fired at lifecycle events: session start, before a tool call, after it, on stop. A pre-tool hook can inspect and block a call before it runs.
MCP connectors give the agent authenticated access to systems it cannot otherwise reach: a database, an issue tracker, an internal API. Each server carries its own credentials.
Subagents are separate agent instances spawned for a focused subtask, with their own context and instructions.
A plugin bundles any of these into one installable unit. The principle under all of it: encode your know-how as files in your repo, not as habits in one person's head. We laid out the system-integration version of this choice in API, MCP or CLI.
02.
Skills and MCP are not rivals
The most common question right now is "Skills or MCP", and the honest answer is that they solve different problems.
MCP is access: it connects the agent to a system it cannot reach on its own, with credentials and state. Skills are know-how: repeatable expertise the agent applies to systems it already has. The analogy doing the rounds is fair: MCP is the aisles of the hardware store, Skills are the experienced employee who knows which aisle to walk to.
The token economics decide the shape of a good setup. A Skill costs a few dozen tokens until it is invoked. A handful of MCP servers can cost tens of thousands of tokens of context before the first task, because each server announces all of its tools up front. So the working pattern most practitioners converge on is many thin Skills and few, well-chosen connectors, not an install-everything pile. The demo below walks the five extension types and the cost and risk each one carries.
03.
Why the open standard matters for sovereignty
The most useful recent change is that the extension layer stopped being one vendor's feature.
Agent Skills were released as an open standard in December 2025, and the format was picked up across several agent vendors within weeks. In practice that means a skill you write for one harness is not trapped there. For a German firm weighing the "locked to a single US vendor" risk, this is a partial answer at the layer you control: the know-how you encode is portable, even when the model underneath is rented.
Pair that with connectors pointed at EU-hosted or on-premise systems and the data-residency story holds at the same time as the capability story. The know-how is yours and portable; the data stays where it must. That is a more durable position than betting the workflow on one provider's roadmap, the same reasoning behind choosing a coding agent on the harness, not the model.
04.
Every extension point is an attack surface
The same power that makes the harness useful makes it dangerous, and the risks are recent and documented, not hypothetical.
Hooks run arbitrary shell, which is exactly an execution surface. Check Point disclosed CVE-2025-59536 in February 2026: a malicious settings file in a cloned repository could run hooks before the trust dialog even appeared. A companion issue, CVE-2026-21852, covered API-key exfiltration through an environment override. MCP brings a supply-chain problem of its own: each server holds credentials, and scans have found hundreds of MCP servers exposed to the internet with no authentication. And the skill marketplaces now list thousands of community skills, easy to install and hard to audit, with reports of outright malicious ones in circulation.
None of this is a reason to avoid extending the harness. It is the reason to extend it deliberately.
05.
Govern the catalog, do not collect plugins
The discipline that separates a production setup from a science experiment is a reviewed, allow-listed catalog: a known set of skills, hooks, and connectors that someone has read, with a trust gate before anything new joins it.
That is unglamorous and it is the whole game. Which hooks may run shell. Which MCP servers hold which credentials. Which skills are approved, and who approved them. For a Mittelstand team, this is where institutional knowledge becomes durable tooling that survives staff turnover, and where the work stops being one engineer's clever config and becomes something the company owns. When we built our own internal scouting tool as a small agentic app, the value was not the cleverness, it was that the process was now a reviewed file in a repo rather than a memory. We wrote that up in building a small agentic micro-app.
The model you can swap next quarter. The catalog of extensions is the asset you keep. So the question worth asking before installing the next plugin is simple: who reviewed it, and what can it touch?
