Specifications, not vibes
The body of a Skill is a prompt, but more disciplined than a chat prompt. It runs on every invocation; ambiguity compounds; the model gets blamed for what the Skill failed to specify. Write it the way you'd write a function spec.
Three structural moves: (1) state the role ("You are a senior security engineer"), (2) list inputs and outputs with format and constraints, (3) specify the failure mode ("if no findings, say so explicitly — never invent vulnerabilities to fill the report"). The third move is the one most prompts skip.