Bundled context the Skill needs every time
The paths: field loads files into the Skill's context on every invocation. Use it for: reference checklists (OWASP, accessibility, brand guidelines), output templates, code snippets the Skill needs to know about, schemas it should validate against. Anything stable that the Skill should always have at hand.
Don't load entire codebases via paths: — the host has Read for that. paths: is for resources that belong to the Skill, not the surrounding project.