Agent Skills Explained: How to Write a SKILL.md for Claude Code, Cursor, Codex and Copilot

Thanks, Adam. Both came before the skill existed. I hit them while writing my Next.js security update guide, and the skill just packages what I learned there. npm audit didn't flag the October advisories for me, which is why the skill compares installed versions against the advisory table instead of trusting it. The sharp one showed up when I patched a 15.x app to 15.5.28: the lockfile kept sharp on 0.34.x, so the image optimizer was still exposed until I ran npm update sharp. That's the whole case for a Gotchas section. If the agent can't guess it and you only learn it by getting it wrong, it belongs in the skill.