Plugin vs Skill

​

The one-sentence difference

A plugin is code your oracle ships with. A skill is a capsule your oracle fetches and runs in a sandbox.

Both let an agent do things it otherwise couldn’t. But the mechanism, lifecycle, and author are usually different.

​

Side by side

​

Both in the same turn

The cleanest way to see the distinction is to watch them work together: skills and sandbox are plugins — compiled into the oracle, exposing tools the LLM calls. invoice-generator is a skill — a folder in the registry the oracle never imported, fetched and executed at request time.

​

When to write which

​

Can a plugin call a skill?

Yes. The skills and sandbox plugins expose normal tools (search_skills, sandbox_run, …). Your custom plugin can call them directly if you have a deterministic flow. Usually the agent orchestrates instead.

​

Can a skill use plugin features?

Not directly. Skills run in a sandbox; they don’t see plugins or Nest DI. They get user secrets as x-os-* env vars, an optional skills_invocation UCAN, network (per sandbox policy), and a read-only mount of their own folder. If a skill needs plugin data, the agent passes it in as an argument to sandbox_run.

​

Read next

Source: packages/oracle-runtime/src/plugins/skills/ and packages/oracle-runtime/src/plugins/sandbox/.