The three layers solve different problems
For example, a board-review skill can say to read the correct Project card and stop if that source is unavailable. An MCP server can expose the board query. A plugin can bundle the skill and configuration. None of these three automatically proves that the data is trustworthy.
- Skill
- Reusable instructions and optional scripts or references for when and how an agent performs a workflow.
- MCP server
- A service that exposes specific tools, resources and data to a client, with its own authentication and permissions.
- Plugin
- A manifest-backed package that distributes supported components, such as skills and MCP server configuration.
Portable does not mean identical everywhere
The specification identified version 1.0.0 as a Working Draft when the Italian guide was researched. The portable core covers packaging, but the client still decides installation flow, permissions, supported fields and user interface. A manifest is a description of a package, not a security certificate.
Before promising a cross-client workflow, test installation and a small read-only operation in each intended client. Record which component each client loaded and which permissions it granted.
Review the package and its authority
- Identify the publisher and a pinned version or commit.
- Read the manifest, skill instructions, scripts and remote endpoints.
- List requested tools, credentials, network access and write capabilities.
- Start with a read-only task and prove the intended server supplied the data.
- Check update and removal paths; review changes before upgrading.
Package and version: <NAME / COMMIT>
Installed client: <CLIENT>
Included skill: <PATH>
MCP endpoint: <URL OR LOCAL COMMAND>
Permissions granted: <LIST>
Read-only test: <COMMAND / OBSERVED SOURCE>
Rollback: <REMOVE / RESTORE STEPS>Choose the smallest useful layer
Use a skill for a repeatable procedure that existing tools can carry out. Add MCP when the agent needs a specific external capability. Package a plugin when the same reviewed components must be installed and updated across users or clients. Keep separate approval for consequential actions even when the package is trusted.