> For the complete documentation index, see [llms.txt](https://docs.sola.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sola.security/workspace/skills.md). # Skills Skills are instruction sets built around a specific domain. Apply them in [chat](/workspace/chats.md) or assign them to [agents](/workspace/agents.md).

{% hint style="info" %} Skills are [available on paid plans](https://sola.security/pricing/). {% endhint %} {% embed url="" %} ## Adding skills Install a ready-made skill from Sola, or create a custom skill built for your team's specific workflows. Once installed or created, skills are available across your entire workspace to use in chat and assign to agents. Creating, editing, and deleting skills requires admin access. To add a skill, go to Skills and click Add skill. ### Installing pre-built skills Browse ready-made skills from Sola, each designed and tested for a specific security task. Search by name or description, and open any skill to see what it does before installing.

#### Available skills


Okta Expert Reads Okta sign-ins, MFA, admin, and OAuth activity to spot impossible travel, MFA fatigue, session hijack, and weak-factor use, and enriches any user across vendors.
Entra ID Expert Reviews Microsoft Entra sign-ins, MFA posture, Conditional Access gaps, admin and PIM roles, guest access, and Identity Protection risk detections with license-tier awareness.
Google Workspace Expert Investigates Google sign-ins, admin actions, Drive sharing and downloads, Gmail forwarding, OAuth grants, and Domain-Wide Delegation to run account-compromise, 2SV, and post-departure audits.
HiBob Expert Adds HR truth to any user: employment status, tenure, termination date, role, department, and manager. Catches HR-to-IT deprovisioning gaps and the contractor blind spot.
CrowdStrike Expert Explains Falcon detections, walks alert triage and false-positive tuning, and covers sensor policy, Spotlight vulnerabilities, cross-vendor identity joins, and ATT&CK coverage.
SentinelOne Expert Explains SentinelOne threats and the full Storyline attack chain, plus mitigation state, agent health, analyst review status, and false-positive tuning per detection type.
Azure Sentinel Expert Unpacks Microsoft Sentinel incidents back to the source system that fired them and covers analytics rule types, UEBA scores, MITRE mapping, sign-in tradecraft, and what data is actually flowing in.
Datadog Expert Interprets Datadog Cloud SIEM signals, suppression, and content packs, and flags when Datadog is running as pure observability with no real security detection coverage.
Wiz Expert Analyzes Wiz cloud issues, misconfigurations, attack paths, and toxic combinations across AWS, Azure, and GCP, and separates prioritized Issues from raw Findings noise based on which modules are deployed.
MITRE ATT&CK Expert Maps detections, alerts, and attacker behavior to ATT&CK tactics and techniques, highlights coverage gaps, and handles per-vendor technique fields honestly.
EPSS-KEV Expert Prioritizes vulnerabilities using real-world exploitation signals, EPSS probability and CISA's Known Exploited Vulnerabilities catalog, instead of CVSS alone.

### Creating custom skills Custom skills give you full control over how Sola AI behaves for a specific task. * Name - A unique, human-readable name for the skill * Description - What the skill does and when to use it * Instructions - The skill's system prompt, defining its core logic and behavior {% hint style="info" %} **How to make your skills more effective** Sola uses the name and description of each skill as a directory to know when to load it into context at runtime. The more precise they are, the more consistently the right skill activates. {% endhint %} ### Instructions The **Instructions** field is the core of the skill. The more specific your instructions, the more consistently the skill applies its expertise. * **Domain focus**: What area or tool the skill specializes in, and the context it needs to reason well. * **Scope**: What the skill should and should not do. * **Response style**: How it should communicate and format its output. {% hint style="info" %} **Tips for creating skills** * **Start from a Sola skill** as a reference. Open it to see how its instructions are structured and use that as a starting point. * **Test your skill in chat** before assigning it to agents to make sure it behaves as expected. * **Keep it focused**. A skill works best when it targets one domain or task. The narrower the scope, the more consistent the results. * **Write instructions, not descriptions**. The Instructions field is a system prompt, not a summary. Tell the skill how to think and respond, not just what it covers. {% endhint %} ## Invoking a skill Skills activate in chat when you invoke them explicitly or when your message matches a skill's domain. **To invoke a skill**, type / in the chat input and select the skill you want. Once active, a skill applies its instructions to your conversation and stays active across follow-up messages as long as the conversation stays in its domain. To stop a skill, ask it to stop or switch to a different one.

## Managing skills The Skills page gives you a workspace-wide view of all your skills. From here you can see what's active, control which skills are enabled, and manage your custom skills. **To manage your skills**, go to ***Skills***. From the Skills page you can: * See all your skills at a glance. * Enable or disable any skill. * Edit, Duplicate, or Delete custom skills. * Add new skills. ## Skills and agents Skills and agents work together. A skill is a specialization; an agent is the actor that applies it. Assigning one or more skills to an agent extends what the agent knows beyond its core instructions, without you having to rewrite its instructions. See [Agents](/workspace/agents.md) for how to assign skills when creating or editing an agent. {% hint style="info" %} **Disabling skills**\ To disable a skill, remove it from any active agents first. {% endhint %} ## Agents, workflows, and skills **Agents think. Workflows orchestrate. Skills guide.** [**Agents**](/workspace/agents.md) reason dynamically and act on your behalf across connected tools and data. @mention them in chat to investigate, triage, and take action. They are best for open-ended investigations and flexible tasks. [**Workflows**](/workspace/projects/workflows.md) execute a predefined sequence of steps in a specific order. Trigger them manually or on a schedule to automate repeatable tasks. They are best for repeatable, structured automations. **Skills** shape how an agent or Sola AI behaves in a specific domain. Assign them to an agent or apply them in chat to extend its knowledge. They are best for specializing an agent's focus or expertise. *** ## FAQs ### How are skills different from agents? A skill is a set of instructions for performing a specific task. An [agent](/workspace/agents.md) is the actor that carries out work, with its own role, memory, and approved tools. You apply a skill in chat or assign it to an agent to specialize how it behaves. One agent can use multiple skills. ### How are skills different from workflows? Skills guide how Sola AI reasons through a task. Workflows execute a fixed sequence of steps in a set order. Use a skill to shape the quality and focus of a response; use a workflow to automate a repeatable, structured process. ### Who can create and manage skills? Admins can install, enable, create, edit, and delete skills. Any workspace member can use installed skills in chat. ### Do I need to invoke a skill with / every time? No. Installed and enabled skills can activate automatically when your message matches their domain. Use / when you want to invoke a specific skill explicitly. Otherwise, Sola evaluates your message against active skills and applies the right one on its own. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.sola.security/workspace/skills.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.