Agent Skills
Modular capabilities that extend agent behavior — on-demand via slash commands or permanently via agent settings
Agent Skills
Skills are reusable capability modules that you attach to agents to shape how they respond, research, and execute tasks.
Navigation
- Parent: Agents
- Related: Creating Agents | Chatting with Agents | Understanding Agents
What Are Skills?
Skills package instructions, context, and optional scripts into a reusable unit that agents load on demand. Each skill teaches an agent a specific behavior — concise answers, deep research reports, structured Splunk searches, incident triage workflows, and more. Skills do not replace tools or integrations; they complement them by guiding how the agent uses its tools.
You can think of skills as behavior profiles. When you attach the Search Splunk skill, the agent follows a strict workflow: fetch the SPL cheat sheet, look up command references, construct the query, execute it, and present results. Without that skill, the agent still has access to the same Splunk tools but relies on its general knowledge to decide how to use them.
How to Use Skills
You attach skills in two ways:
Per-Message: Slash Commands in Chat
Type / in the chat input to open the skills menu. Filter by name and select a skill. A pill badge appears above the input showing the attached skill. The skill applies to that single message only — subsequent messages revert to the agent's default behavior unless you attach a skill again.
- Type
/in the chat input to open the skills menu. - Filter by name and select a skill.
- Send your message. The skill applies to that message only.
Permanently: Agent Edit Page
Open an agent's settings and navigate to the Skills tab. Toggle skills on to attach them permanently. Every conversation with that agent loads the selected skills automatically.
- Go to Agents → select an agent → Edit.
- Open the Skills tab.
- Toggle skills on or off. Changes apply to all future conversations.
Available Skills
You browse all available skills from the Skills page in the dashboard sidebar.
| Skill | What It Does | Best For |
|---|---|---|
| Search Splunk | Follows a structured workflow: fetches the SPL cheat sheet, looks up command references, constructs optimized queries, and executes searches | Any SPL query or Splunk data exploration |
| Deep Research | Runs a multi-phase research pipeline with source credibility scoring, citation tracking, and report generation | Complex analysis requiring 10+ sources and verified claims |
| Web Research | Searches the web with multiple queries, synthesizes findings, and cites sources with URLs | Questions that need current, live information |
| Research | Adopts a fact-finding approach, distinguishes verified facts from assumptions, and flags uncertainty | Evidence-based analysis and grounded answers |
| CIM Modeling | Guides CIM normalization: maps fields, configures event types, tags, aliases, and extractions for Splunk data models | Normalizing data to the Splunk Common Information Model |
| Incident Response | Uses a diagnosis-first workflow: summarizes symptoms, ranks root causes, and proposes mitigation paths | Triaging incidents, debugging production issues, root cause analysis |
| Structured Output | Returns responses in clear sections with headings, bullet points, checklists, and action items | Organized, scannable output for decisions and planning |
| Concise | Produces short, direct answers with minimal verbosity — leads with the answer, adds details only when asked | Quick lookups where brevity matters |
Skills Page
The Skills page is accessible from the dashboard sidebar. It displays all available skills in a searchable, filterable grid. Each skill card shows:
- Name and icon — identifies the skill
- Description — explains when and why to use it
- Tags — categorize skills (e.g.,
splunk,research,style) - Capability indicators — icons show if the skill includes scripts, reference documents, or asset files
- Slash command — the
/slugyou type in chat to activate it (e.g.,/search-splunk)
You can filter skills by tag or search by name and description. Click Details on any skill card to view its full documentation.
How Skills Work with Tools and Integrations
Skills and integrations serve different roles:
| Concept | Role |
|---|---|
| Integrations | Connect the agent to external systems (Splunk, GitHub, VirusTotal) and provide tools |
| Tools | Individual actions the agent can perform (run a search, fetch documentation) |
| Skills | Behavioral instructions that guide how the agent uses its tools |
A skill like Search Splunk does not add new tools. It instructs the agent to call get_splunk_cheat_sheet before writing SPL, use run_splunk_search for complex queries, and present results in a specific format. The Splunk MCP integration must still be connected for those tools to be available.
Tips
- Start with slash commands — try a skill per-message before permanently attaching it to an agent.
- Combine skills with the right integrations — the Search Splunk skill works best when the Splunk MCP integration is connected.
- Use Concise for quick checks — attach
/concisewhen you want a one-line answer instead of a detailed explanation. - Use Deep Research for reports — when you need a comprehensive analysis with citations, attach
/deep-researchand give the agent a clear research question.
