diff --git a/apps/web/src/app/(application)/skills/page.tsx b/apps/web/src/app/(application)/skills/page.tsx
new file mode 100644
index 0000000..a81c375
--- /dev/null
+++ b/apps/web/src/app/(application)/skills/page.tsx
@@ -0,0 +1,114 @@
+"use client"
+
+import SkillCard from "@/src/components/skills/skill-card"
+import SkillCardSkeleton from "@/src/components/skills/skill-card-skeleton"
+import SkillDeleteDialog from "@/src/components/skills/skill-delete-dialog"
+import SkillDetailDialog from "@/src/components/skills/skill-detail-dialog"
+import SkillFormDialog from "@/src/components/skills/skill-form-dialog"
+import SkillsEmptyState from "@/src/components/skills/skills-empty-state"
+import { Button } from "@/src/components/ui/button"
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/src/components/ui/tabs"
+import { useGetSkills } from "@/src/hooks/skills/use-get-skills"
+import type { Skill, SkillTab } from "@/src/types/skills"
+import { IconPlus } from "@tabler/icons-react"
+import { useState } from "react"
+
+const TABS: SkillTab[] = ["all", "builtin", "custom"]
+
+const TAB_LABELS: Record<SkillTab, string> = {
+	all: "All",
+	builtin: "Built-in",
+	custom: "Custom",
+}
+
+const SkillsPage = () => {
+	const { data: skills = [], isLoading } = useGetSkills()
+	const [activeTab, setActiveTab] = useState<SkillTab>("all")
+
+	const [formOpen, setFormOpen] = useState(false)
+	const [editingSkill, setEditingSkill] = useState<Skill | null>(null)
+	const [detailSkill, setDetailSkill] = useState<Skill | null>(null)
+	const [deleteSkillId, setDeleteSkillId] = useState<string | null>(null)
+
+	const filteredSkills = activeTab === "all" ? skills : skills.filter((s) => s.type === activeTab)
+
+	const handleCreate = () => {
+		setEditingSkill(null)
+		setFormOpen(true)
+	}
+
+	const handleEdit = (skill: Skill) => {
+		setEditingSkill(skill)
+		setFormOpen(true)
+	}
+
+	return (
+		<div className="flex flex-col w-full h-full gap-6">
+			<div className="flex flex-row w-full justify-between items-center">
+				<div>
+					<h4 className="text-xl font-semibold">Skills</h4>
+					<p className="text-sm text-muted-foreground">Browse, install, and create agent skills</p>
+				</div>
+				<Button onClick={handleCreate}>
+					<IconPlus className="size-4" />
+					Create Skill
+				</Button>
+			</div>
+
+			<Tabs value={activeTab} onValueChange={(v) => setActiveTab(v as SkillTab)}>
+				<TabsList>
+					{TABS.map((tab) => (
+						<TabsTrigger key={tab} value={tab}>
+							{TAB_LABELS[tab]}
+						</TabsTrigger>
+					))}
+				</TabsList>
+
+				{TABS.map((tab) => (
+					<TabsContent key={tab} value={tab}>
+						{isLoading ? (
+							<div className="grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4">
+								{Array.from({ length: 6 }).map((_, i) => (
+									<SkillCardSkeleton key={i} />
+								))}
+							</div>
+						) : filteredSkills.length === 0 ? (
+							<SkillsEmptyState tab={tab} onCreateClick={handleCreate} />
+						) : (
+							<div className="grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4">
+								{filteredSkills.map((skill) => (
+									<SkillCard
+										key={skill.id}
+										skill={skill}
+										onViewDetail={setDetailSkill}
+										onEdit={handleEdit}
+										onDelete={setDeleteSkillId}
+									/>
+								))}
+							</div>
+						)}
+					</TabsContent>
+				))}
+			</Tabs>
+
+			<SkillFormDialog open={formOpen} onOpenChange={setFormOpen} skill={editingSkill} />
+
+			<SkillDetailDialog
+				skill={detailSkill}
+				onOpenChange={(open) => {
+					if (!open) setDetailSkill(null)
+				}}
+			/>
+
+			<SkillDeleteDialog
+				open={!!deleteSkillId}
+				onOpenChange={(open) => {
+					if (!open) setDeleteSkillId(null)
+				}}
+				skillId={deleteSkillId}
+			/>
+		</div>
+	)
+}
+
+export default SkillsPage
diff --git a/apps/web/src/app/api/agent-configs/[configId]/route.ts b/apps/web/src/app/api/agent-configs/[configId]/route.ts
new file mode 100644
index 0000000..633a8ae
--- /dev/null
+++ b/apps/web/src/app/api/agent-configs/[configId]/route.ts
@@ -0,0 +1,98 @@
+import { auth } from "@/src/lib/auth"
+import { pool } from "@/src/lib/db"
+import { headers } from "next/headers"
+import { type NextRequest, NextResponse } from "next/server"
+
+type RouteParams = { params: Promise<{ configId: string }> }
+
+// GET /api/agent-configs/:configId
+export async function GET(_request: NextRequest, { params }: RouteParams) {
+	const session = await auth.api.getSession({ headers: await headers() })
+	if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+	const { configId } = await params
+
+	try {
+		const result = await pool.query("SELECT * FROM agent_configs WHERE id = $1", [configId])
+		if (result.rows.length === 0) {
+			return NextResponse.json({ error: "Agent config not found" }, { status: 404 })
+		}
+		return NextResponse.json({ config: result.rows[0] })
+	} catch (error) {
+		return NextResponse.json({ error: `Failed to fetch agent config: ${(error as Error).message}` }, { status: 500 })
+	}
+}
+
+// PUT /api/agent-configs/:configId
+export async function PUT(request: NextRequest, { params }: RouteParams) {
+	const session = await auth.api.getSession({ headers: await headers() })
+	if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+	const { configId } = await params
+
+	try {
+		const existing = await pool.query("SELECT id FROM agent_configs WHERE id = $1", [configId])
+		if (existing.rows.length === 0) {
+			return NextResponse.json({ error: "Agent config not found" }, { status: 404 })
+		}
+
+		const body = await request.json()
+		const { name, description, model, provider, systemPrompt, toolsEnabled, skills, maxTokens, temperature } = body
+
+		const fields: string[] = []
+		const values: unknown[] = []
+		let paramIndex = 1
+
+		if (name !== undefined) {
+			fields.push(`name = $${paramIndex++}`)
+			values.push(name)
+		}
+		if (description !== undefined) {
+			fields.push(`description = $${paramIndex++}`)
+			values.push(description)
+		}
+		if (model !== undefined) {
+			fields.push(`model = $${paramIndex++}`)
+			values.push(model)
+		}
+		if (provider !== undefined) {
+			fields.push(`provider = $${paramIndex++}`)
+			values.push(provider)
+		}
+		if (systemPrompt !== undefined) {
+			fields.push(`system_prompt = $${paramIndex++}`)
+			values.push(systemPrompt)
+		}
+		if (toolsEnabled !== undefined) {
+			fields.push(`tools_enabled = $${paramIndex++}`)
+			values.push(JSON.stringify(toolsEnabled))
+		}
+		if (skills !== undefined) {
+			fields.push(`skills = $${paramIndex++}`)
+			values.push(JSON.stringify(skills))
+		}
+		if (maxTokens !== undefined) {
+			fields.push(`max_tokens = $${paramIndex++}`)
+			values.push(maxTokens)
+		}
+		if (temperature !== undefined) {
+			fields.push(`temperature = $${paramIndex++}`)
+			values.push(temperature)
+		}
+
+		if (fields.length === 0) {
+			return NextResponse.json({ error: "No fields to update" }, { status: 400 })
+		}
+
+		fields.push("updated_at = now()")
+		values.push(configId)
+
+		const result = await pool.query(
+			`UPDATE agent_configs SET ${fields.join(", ")} WHERE id = $${paramIndex} RETURNING *`,
+			values,
+		)
+		return NextResponse.json({ config: result.rows[0] })
+	} catch (error) {
+		return NextResponse.json({ error: `Failed to update agent config: ${(error as Error).message}` }, { status: 500 })
+	}
+}
diff --git a/apps/web/src/app/api/skills/[skillId]/route.ts b/apps/web/src/app/api/skills/[skillId]/route.ts
new file mode 100644
index 0000000..008a185
--- /dev/null
+++ b/apps/web/src/app/api/skills/[skillId]/route.ts
@@ -0,0 +1,106 @@
+import { auth } from "@/src/lib/auth"
+import { pool } from "@/src/lib/db"
+import { headers } from "next/headers"
+import { type NextRequest, NextResponse } from "next/server"
+
+// GET /api/skills/:skillId
+export async function GET(_request: NextRequest, { params }: { params: Promise<{ skillId: string }> }) {
+	const session = await auth.api.getSession({ headers: await headers() })
+	if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+	const { skillId } = await params
+
+	try {
+		const result = await pool.query("SELECT * FROM public.skills WHERE id = $1", [skillId])
+		if (result.rows.length === 0) {
+			return NextResponse.json({ error: "Skill not found" }, { status: 404 })
+		}
+		return NextResponse.json({ skill: result.rows[0] })
+	} catch (error) {
+		return NextResponse.json({ error: `Failed to fetch skill: ${(error as Error).message}` }, { status: 500 })
+	}
+}
+
+// PUT /api/skills/:skillId — update custom/marketplace skill
+export async function PUT(request: NextRequest, { params }: { params: Promise<{ skillId: string }> }) {
+	const session = await auth.api.getSession({ headers: await headers() })
+	if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+	const { skillId } = await params
+
+	try {
+		const existing = await pool.query("SELECT id, type FROM public.skills WHERE id = $1", [skillId])
+		if (existing.rows.length === 0) {
+			return NextResponse.json({ error: "Skill not found" }, { status: 404 })
+		}
+		if (existing.rows[0].type === "builtin") {
+			return NextResponse.json({ error: "Built-in skills cannot be modified" }, { status: 400 })
+		}
+
+		const body = await request.json()
+		const { name, description, content, packageSpecifier, config } = body
+
+		const fields: string[] = []
+		const values: unknown[] = []
+		let paramIndex = 1
+
+		if (name !== undefined) {
+			fields.push(`name = $${paramIndex++}`)
+			values.push(name)
+		}
+		if (description !== undefined) {
+			fields.push(`description = $${paramIndex++}`)
+			values.push(description)
+		}
+		if (content !== undefined) {
+			fields.push(`content = $${paramIndex++}`)
+			values.push(content)
+		}
+		if (packageSpecifier !== undefined) {
+			fields.push(`package_specifier = $${paramIndex++}`)
+			values.push(packageSpecifier)
+		}
+		if (config !== undefined) {
+			fields.push(`config = $${paramIndex++}`)
+			values.push(JSON.stringify(config))
+		}
+
+		if (fields.length === 0) {
+			return NextResponse.json({ error: "No fields to update" }, { status: 400 })
+		}
+
+		fields.push("updated_at = now()")
+		values.push(skillId)
+
+		const result = await pool.query(
+			`UPDATE public.skills SET ${fields.join(", ")} WHERE id = $${paramIndex} RETURNING *`,
+			values,
+		)
+		return NextResponse.json({ skill: result.rows[0] })
+	} catch (error) {
+		return NextResponse.json({ error: `Failed to update skill: ${(error as Error).message}` }, { status: 500 })
+	}
+}
+
+// DELETE /api/skills/:skillId
+export async function DELETE(_request: NextRequest, { params }: { params: Promise<{ skillId: string }> }) {
+	const session = await auth.api.getSession({ headers: await headers() })
+	if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+	const { skillId } = await params
+
+	try {
+		const existing = await pool.query("SELECT id, type FROM public.skills WHERE id = $1", [skillId])
+		if (existing.rows.length === 0) {
+			return NextResponse.json({ error: "Skill not found" }, { status: 404 })
+		}
+		if (existing.rows[0].type === "builtin") {
+			return NextResponse.json({ error: "Built-in skills cannot be deleted" }, { status: 400 })
+		}
+
+		await pool.query("DELETE FROM public.skills WHERE id = $1", [skillId])
+		return NextResponse.json({ success: true })
+	} catch (error) {
+		return NextResponse.json({ error: `Failed to delete skill: ${(error as Error).message}` }, { status: 500 })
+	}
+}
diff --git a/apps/web/src/app/api/skills/route.ts b/apps/web/src/app/api/skills/route.ts
new file mode 100644
index 0000000..b03dd93
--- /dev/null
+++ b/apps/web/src/app/api/skills/route.ts
@@ -0,0 +1,77 @@
+import { auth } from "@/src/lib/auth"
+import { pool } from "@/src/lib/db"
+import { headers } from "next/headers"
+import { type NextRequest, NextResponse } from "next/server"
+
+// GET /api/skills?type=builtin|marketplace|custom
+export async function GET(request: NextRequest) {
+	const session = await auth.api.getSession({ headers: await headers() })
+	if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+	const { searchParams } = new URL(request.url)
+	const type = searchParams.get("type")
+	const installedBy = searchParams.get("installedBy")
+
+	try {
+		let query = "SELECT * FROM public.skills ORDER BY created_at DESC"
+		const values: unknown[] = []
+
+		if (type) {
+			query = "SELECT * FROM public.skills WHERE type = $1 ORDER BY created_at DESC"
+			values.push(type)
+		} else if (installedBy) {
+			query = "SELECT * FROM public.skills WHERE installed_by = $1 ORDER BY created_at DESC"
+			values.push(installedBy)
+		}
+
+		const result = await pool.query(query, values)
+
+		const integrationsResult = await pool.query("SELECT DISTINCT type FROM public.integrations WHERE status = 'active'")
+		const configuredTypes = new Set(integrationsResult.rows.map((r: { type: string }) => r.type))
+
+		const skillsWithIntegrationStatus = result.rows.map((skill: Record<string, unknown>) => {
+			const config = skill.config as { requires?: string[] } | null
+			const requires = config?.requires ?? []
+			const missingIntegrations = requires.filter((r: string) => !configuredTypes.has(r))
+			return { ...skill, missing_integrations: missingIntegrations }
+		})
+
+		return NextResponse.json({ skills: skillsWithIntegrationStatus })
+	} catch (error) {
+		return NextResponse.json({ error: `Failed to fetch skills: ${(error as Error).message}` }, { status: 500 })
+	}
+}
+
+// POST /api/skills — create custom skill
+export async function POST(request: NextRequest) {
+	const session = await auth.api.getSession({ headers: await headers() })
+	if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+	try {
+		const body = await request.json()
+		const { name, description, source, content, packageSpecifier, config } = body
+
+		if (!name) {
+			return NextResponse.json({ error: "Missing required field: name" }, { status: 400 })
+		}
+
+		const result = await pool.query(
+			`INSERT INTO public.skills (name, description, type, source, content, package_specifier, config, installed_by)
+       VALUES ($1, $2, 'custom', $3, $4, $5, $6, $7)
+       RETURNING *`,
+			[
+				name,
+				description ?? "",
+				source ?? "file",
+				content ?? null,
+				packageSpecifier ?? null,
+				JSON.stringify(config ?? {}),
+				session.user.id,
+			],
+		)
+
+		return NextResponse.json({ skill: result.rows[0] }, { status: 201 })
+	} catch (error) {
+		return NextResponse.json({ error: `Failed to create skill: ${(error as Error).message}` }, { status: 500 })
+	}
+}
diff --git a/apps/web/src/components/skills/skill-card-skeleton.tsx b/apps/web/src/components/skills/skill-card-skeleton.tsx
new file mode 100644
index 0000000..7029476
--- /dev/null
+++ b/apps/web/src/components/skills/skill-card-skeleton.tsx
@@ -0,0 +1,19 @@
+import { Card, CardContent, CardHeader } from "@/src/components/ui/card"
+import { Skeleton } from "@/src/components/ui/skeleton"
+
+const SkillCardSkeleton = () => (
+	<Card>
+		<CardHeader className="pb-3">
+			<Skeleton className="h-5 w-2/3" />
+			<Skeleton className="h-4 w-full mt-2" />
+		</CardHeader>
+		<CardContent>
+			<div className="flex gap-2">
+				<Skeleton className="h-5 w-16" />
+				<Skeleton className="h-5 w-14" />
+			</div>
+		</CardContent>
+	</Card>
+)
+
+export default SkillCardSkeleton
diff --git a/apps/web/src/components/skills/skill-card.tsx b/apps/web/src/components/skills/skill-card.tsx
new file mode 100644
index 0000000..487d127
--- /dev/null
+++ b/apps/web/src/components/skills/skill-card.tsx
@@ -0,0 +1,67 @@
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/src/components/ui/card"
+import {
+	DropdownMenu,
+	DropdownMenuContent,
+	DropdownMenuItem,
+	DropdownMenuTrigger,
+} from "@/src/components/ui/dropdown-menu"
+import type { Skill } from "@/src/types/skills"
+import { IconAlertTriangle, IconDotsVertical, IconPencil, IconTrash } from "@tabler/icons-react"
+import SkillSourceBadge from "./skill-source-badge"
+import SkillTypeBadge from "./skill-type-badge"
+
+interface SkillCardProps {
+	skill: Skill
+	onViewDetail: (skill: Skill) => void
+	onEdit: (skill: Skill) => void
+	onDelete: (id: string) => void
+}
+
+const SkillCard = ({ skill, onViewDetail, onEdit, onDelete }: SkillCardProps) => (
+	<Card className="hover:border-primary/50 transition-colors cursor-pointer group" onClick={() => onViewDetail(skill)}>
+		<CardHeader className="pb-3">
+			<div className="flex items-center justify-between">
+				<CardTitle className="text-base truncate capitalize">{skill.name}</CardTitle>
+				{skill.type !== "builtin" && (
+					<DropdownMenu>
+						<DropdownMenuTrigger asChild>
+							<button
+								type="button"
+								onClick={(e) => e.stopPropagation()}
+								className="rounded p-1 opacity-0 group-hover:opacity-100 hover:bg-accent transition-all"
+							>
+								<IconDotsVertical className="size-4 text-muted-foreground" />
+							</button>
+						</DropdownMenuTrigger>
+						<DropdownMenuContent align="end" onClick={(e) => e.stopPropagation()}>
+							<DropdownMenuItem onClick={() => onEdit(skill)}>
+								<IconPencil className="size-4" />
+								Edit
+							</DropdownMenuItem>
+							<DropdownMenuItem onClick={() => onDelete(skill.id)} className="text-destructive focus:text-destructive">
+								<IconTrash className="size-4" />
+								Delete
+							</DropdownMenuItem>
+						</DropdownMenuContent>
+					</DropdownMenu>
+				)}
+			</div>
+			<CardDescription className="line-clamp-2">{skill.description || "No description"}</CardDescription>
+		</CardHeader>
+		<CardContent className="flex flex-col gap-2">
+			<div className="flex items-center gap-2 flex-wrap">
+				<SkillTypeBadge type={skill.type} />
+				<SkillSourceBadge source={skill.source} />
+			</div>
+			{skill.missing_integrations && skill.missing_integrations.length > 0 && (
+				<div className="flex items-center gap-1.5 text-amber-600 dark:text-amber-400">
+					<IconAlertTriangle className="size-3.5" />
+					<span className="text-xs">Missing: {skill.missing_integrations.join(", ")}</span>
+				</div>
+			)}
+			<p className="text-xs text-muted-foreground">Created {new Date(skill.created_at).toLocaleDateString()}</p>
+		</CardContent>
+	</Card>
+)
+
+export default SkillCard
diff --git a/apps/web/src/components/skills/skill-delete-dialog.tsx b/apps/web/src/components/skills/skill-delete-dialog.tsx
new file mode 100644
index 0000000..dd75c54
--- /dev/null
+++ b/apps/web/src/components/skills/skill-delete-dialog.tsx
@@ -0,0 +1,69 @@
+"use client"
+
+import {
+	AlertDialog,
+	AlertDialogAction,
+	AlertDialogCancel,
+	AlertDialogContent,
+	AlertDialogDescription,
+	AlertDialogFooter,
+	AlertDialogHeader,
+	AlertDialogTitle,
+} from "@/src/components/ui/alert-dialog"
+import useDeleteSkill from "@/src/hooks/skills/use-delete-skill"
+import { IconLoader2, IconTrash } from "@tabler/icons-react"
+import { toast } from "sonner"
+
+interface SkillDeleteDialogProps {
+	open: boolean
+	onOpenChange: (open: boolean) => void
+	skillId: string | null
+}
+
+const SkillDeleteDialog = ({ open, onOpenChange, skillId }: SkillDeleteDialogProps) => {
+	const deleteMutation = useDeleteSkill(skillId!)
+
+	const handleDelete = async () => {
+		if (!skillId) return
+
+		try {
+			await deleteMutation.mutateAsync()
+			toast.success("Skill deleted")
+			onOpenChange(false)
+		} catch (error) {
+			toast.error("Failed to delete skill", {
+				description: (error as Error).message,
+			})
+		}
+	}
+
+	return (
+		<AlertDialog open={open} onOpenChange={onOpenChange}>
+			<AlertDialogContent>
+				<AlertDialogHeader>
+					<AlertDialogTitle>Delete Skill</AlertDialogTitle>
+					<AlertDialogDescription>
+						This will permanently delete this skill. This action cannot be undone.
+					</AlertDialogDescription>
+				</AlertDialogHeader>
+				<AlertDialogFooter>
+					<AlertDialogCancel disabled={deleteMutation.isPending}>Cancel</AlertDialogCancel>
+					<AlertDialogAction
+						onClick={handleDelete}
+						disabled={deleteMutation.isPending}
+						className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
+					>
+						{deleteMutation.isPending ? (
+							<IconLoader2 className="size-4 animate-spin" />
+						) : (
+							<IconTrash className="size-4" />
+						)}
+						{deleteMutation.isPending ? "Deleting..." : "Delete Permanently"}
+					</AlertDialogAction>
+				</AlertDialogFooter>
+			</AlertDialogContent>
+		</AlertDialog>
+	)
+}
+
+export default SkillDeleteDialog
diff --git a/apps/web/src/components/skills/skill-detail-dialog.tsx b/apps/web/src/components/skills/skill-detail-dialog.tsx
new file mode 100644
index 0000000..2fc9620
--- /dev/null
+++ b/apps/web/src/components/skills/skill-detail-dialog.tsx
@@ -0,0 +1,80 @@
+"use client"
+
+import { Badge } from "@/src/components/ui/badge"
+import { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle } from "@/src/components/ui/dialog"
+import { ScrollArea } from "@/src/components/ui/scroll-area"
+import { useGetSkill } from "@/src/hooks/skills/use-get-skill"
+import type { Skill } from "@/src/types/skills"
+import { IconLoader2, IconPackage } from "@tabler/icons-react"
+import SkillSourceBadge from "./skill-source-badge"
+import SkillTypeBadge from "./skill-type-badge"
+
+interface SkillDetailDialogProps {
+	skill: Skill | null
+	onOpenChange: (open: boolean) => void
+}
+
+const SkillDetailDialog = ({ skill, onOpenChange }: SkillDetailDialogProps) => {
+	const { data: fullSkill, isLoading } = useGetSkill(skill?.id ?? null)
+
+	const displaySkill = fullSkill ?? skill
+
+	return (
+		<Dialog open={!!skill} onOpenChange={onOpenChange}>
+			<DialogContent className="sm:max-w-2xl max-h-[80vh] flex flex-col">
+				{displaySkill && (
+					<>
+						<DialogHeader>
+							<DialogTitle>{displaySkill.name}</DialogTitle>
+							<DialogDescription>{displaySkill.description || "No description"}</DialogDescription>
+						</DialogHeader>
+						<div className="flex items-center gap-2 flex-wrap">
+							<SkillTypeBadge type={displaySkill.type} />
+							<SkillSourceBadge source={displaySkill.source} />
+							{displaySkill.package_specifier && (
+								<Badge variant="outline" className="gap-1">
+									<IconPackage className="size-3" />
+									{displaySkill.package_specifier}
+								</Badge>
+							)}
+						</div>
+						{displaySkill.config?.requires && displaySkill.config.requires.length > 0 && (
+							<div className="flex flex-col gap-2">
+								<h4 className="text-sm font-medium">Required Integrations</h4>
+								<div className="flex flex-wrap gap-2">
+									{displaySkill.config.requires.map((req: string) => (
+										<Badge
+											key={req}
+											variant={displaySkill.missing_integrations?.includes(req) ? "destructive" : "default"}
+										>
+											{req}
+										</Badge>
+									))}
+								</div>
+							</div>
+						)}
+						<ScrollArea className="flex-1 min-h-0 rounded-md border">
+							{isLoading ? (
+								<div className="flex items-center justify-center py-12">
+									<IconLoader2 className="size-6 text-muted-foreground animate-spin" />
+								</div>
+							) : (
+								<div className="p-4 text-sm font-mono whitespace-pre-wrap wrap-break-words overflow-y-scroll h-96">
+									{displaySkill.content || "No content available."}
+								</div>
+							)}
+						</ScrollArea>
+						<p className="text-xs text-muted-foreground">
+							Created {new Date(displaySkill.created_at).toLocaleDateString()}
+							{displaySkill.updated_at && displaySkill.updated_at !== displaySkill.created_at && (
+								<> &middot; Updated {new Date(displaySkill.updated_at).toLocaleDateString()}</>
+							)}
+						</p>
+					</>
+				)}
+			</DialogContent>
+		</Dialog>
+	)
+}
+
+export default SkillDetailDialog
diff --git a/apps/web/src/components/skills/skill-form-dialog.tsx b/apps/web/src/components/skills/skill-form-dialog.tsx
new file mode 100644
index 0000000..4fd1740
--- /dev/null
+++ b/apps/web/src/components/skills/skill-form-dialog.tsx
@@ -0,0 +1,131 @@
+"use client"
+
+import { Button } from "@/src/components/ui/button"
+import { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle } from "@/src/components/ui/dialog"
+import { Input } from "@/src/components/ui/input"
+import { Label } from "@/src/components/ui/label"
+import { Textarea } from "@/src/components/ui/textarea"
+import useCreateSkill from "@/src/hooks/skills/use-create-skill"
+import useUpdateSkill from "@/src/hooks/skills/use-update-skill"
+import type { Skill } from "@/src/types/skills"
+import { IconCode, IconLoader2 } from "@tabler/icons-react"
+import { useEffect, useState } from "react"
+import { toast } from "sonner"
+
+interface SkillFormDialogProps {
+	open: boolean
+	onOpenChange: (open: boolean) => void
+	skill: Skill | null
+}
+
+const SkillFormDialog = ({ open, onOpenChange, skill }: SkillFormDialogProps) => {
+	const [name, setName] = useState("")
+	const [description, setDescription] = useState("")
+	const [content, setContent] = useState("")
+	const { id } = skill ?? {}
+
+	const createMutation = useCreateSkill()
+	const updateMutation = useUpdateSkill(id!)
+
+	const isEditing = !!skill
+	const saving = createMutation.isPending || updateMutation.isPending
+
+	useEffect(() => {
+		if (open) {
+			setName(skill?.name ?? "")
+			setDescription(skill?.description ?? "")
+			setContent(skill?.content ?? "")
+		}
+	}, [open, skill])
+
+	const handleSave = async () => {
+		if (!name.trim()) {
+			toast.error("Name is required")
+			return
+		}
+
+		try {
+			if (isEditing) {
+				await updateMutation.mutateAsync({
+					name: name.trim(),
+					description: description.trim(),
+					content,
+				})
+				toast.success("Skill updated")
+			} else {
+				await createMutation.mutateAsync({
+					name: name.trim(),
+					description: description.trim(),
+					source: "file" as const,
+					content,
+				})
+				toast.success("Skill created")
+			}
+			onOpenChange(false)
+		} catch (error) {
+			toast.error(`Failed to ${isEditing ? "update" : "create"} skill`, {
+				description: (error as Error).message,
+			})
+		}
+	}
+
+	return (
+		<Dialog open={open} onOpenChange={onOpenChange}>
+			<DialogContent className="sm:max-w-2xl">
+				<DialogHeader>
+					<DialogTitle>{isEditing ? "Edit Skill" : "Create Skill"}</DialogTitle>
+					<DialogDescription>
+						{isEditing
+							? "Update the skill definition below."
+							: "Define a new custom skill. The content field accepts SKILL.md markdown."}
+					</DialogDescription>
+				</DialogHeader>
+
+				<div className="flex flex-col gap-4 py-2">
+					<div className="flex flex-col gap-2">
+						<Label htmlFor="skill-name">Name</Label>
+						<Input
+							id="skill-name"
+							value={name}
+							onChange={(e) => setName(e.target.value)}
+							placeholder="My Custom Skill"
+						/>
+					</div>
+					<div className="flex flex-col gap-2">
+						<Label htmlFor="skill-description">Description</Label>
+						<Textarea
+							id="skill-description"
+							value={description}
+							onChange={(e) => setDescription(e.target.value)}
+							placeholder="What this skill does..."
+							rows={2}
+						/>
+					</div>
+					<div className="flex flex-col gap-2">
+						<Label htmlFor="skill-content">Content (SKILL.md)</Label>
+						<Textarea
+							id="skill-content"
+							value={content}
+							onChange={(e) => setContent(e.target.value)}
+							placeholder={"# My Skill\n\nInstructions for the agent..."}
+							className="font-mono text-sm min-h-[200px] max-h-96 overflow-y-scroll"
+							rows={10}
+						/>
+					</div>
+				</div>
+
+				<div className="flex justify-end gap-2 pt-2">
+					<Button variant="outline" onClick={() => onOpenChange(false)}>
+						Cancel
+					</Button>
+					<Button onClick={handleSave} disabled={!name.trim() || saving}>
+						{saving ? <IconLoader2 className="size-4 animate-spin" /> : <IconCode className="size-4" />}
+						{saving ? "Saving..." : isEditing ? "Update Skill" : "Create Skill"}
+					</Button>
+				</div>
+			</DialogContent>
+		</Dialog>
+	)
+}
+
+export default SkillFormDialog
diff --git a/apps/web/src/components/skills/skill-source-badge.tsx b/apps/web/src/components/skills/skill-source-badge.tsx
new file mode 100644
index 0000000..afe6422
--- /dev/null
+++ b/apps/web/src/components/skills/skill-source-badge.tsx
@@ -0,0 +1,12 @@
+import { Badge } from "@/src/components/ui/badge"
+import type { Skill } from "@/src/types/skills"
+import { IconFileText, IconPackage } from "@tabler/icons-react"
+
+const SkillSourceBadge = ({ source }: { source: Skill["source"] }) => (
+	<Badge variant="secondary" className="gap-1">
+		{source === "npm" ? <IconPackage className="size-3" /> : <IconFileText className="size-3" />}
+		{source === "npm" ? "Package" : "File"}
+	</Badge>
+)
+
+export default SkillSourceBadge
diff --git a/apps/web/src/components/skills/skill-type-badge.tsx b/apps/web/src/components/skills/skill-type-badge.tsx
new file mode 100644
index 0000000..1c597dd
--- /dev/null
+++ b/apps/web/src/components/skills/skill-type-badge.tsx
@@ -0,0 +1,28 @@
+import { Badge } from "@/src/components/ui/badge"
+import type { Skill } from "@/src/types/skills"
+
+const typeBadgeConfig: Record<Skill["type"], { label: string; className: string }> = {
+	builtin: {
+		label: "Built-in",
+		className: "border-blue-500/30 bg-blue-50 text-blue-700 dark:bg-blue-950/20 dark:text-blue-300",
+	},
+	marketplace: {
+		label: "Marketplace",
+		className: "border-purple-500/30 bg-purple-50 text-purple-700 dark:bg-purple-950/20 dark:text-purple-300",
+	},
+	custom: {
+		label: "Custom",
+		className: "border-green-500/30 bg-green-50 text-green-700 dark:bg-green-950/20 dark:text-green-300",
+	},
+}
+
+const SkillTypeBadge = ({ type }: { type: Skill["type"] }) => {
+	const config = typeBadgeConfig[type]
+	return (
+		<Badge variant="outline" className={config.className}>
+			{config.label}
+		</Badge>
+	)
+}
+
+export default SkillTypeBadge
diff --git a/apps/web/src/components/skills/skills-empty-state.tsx b/apps/web/src/components/skills/skills-empty-state.tsx
new file mode 100644
index 0000000..81bd41d
--- /dev/null
+++ b/apps/web/src/components/skills/skills-empty-state.tsx
@@ -0,0 +1,35 @@
+import { Button } from "@/src/components/ui/button"
+import { Empty, EmptyDescription, EmptyHeader, EmptyMedia, EmptyTitle } from "@/src/components/ui/empty"
+import type { SkillTab } from "@/src/types/skills"
+import { IconBolt, IconPlus } from "@tabler/icons-react"
+
+const emptyMessages: Record<SkillTab, string> = {
+	all: "No skills found. Create a custom skill to get started.",
+	builtin: "No built-in skills available.",
+	custom: "No custom skills yet. Create one to extend your agent.",
+}
+
+interface SkillsEmptyStateProps {
+	tab: SkillTab
+	onCreateClick: () => void
+}
+
+const SkillsEmptyState = ({ tab, onCreateClick }: SkillsEmptyStateProps) => (
+	<Empty className="py-16">
+		<EmptyHeader>
+			<EmptyMedia variant="icon">
+				<IconBolt className="size-5" />
+			</EmptyMedia>
+			<EmptyTitle>No skills</EmptyTitle>
+			<EmptyDescription>{emptyMessages[tab]}</EmptyDescription>
+		</EmptyHeader>
+		{tab !== "builtin" && (
+			<Button variant="outline" onClick={onCreateClick}>
+				<IconPlus className="size-4" />
+				Create Skill
+			</Button>
+		)}
+	</Empty>
+)
+
+export default SkillsEmptyState
diff --git a/apps/web/src/hooks/skills/use-create-skill.ts b/apps/web/src/hooks/skills/use-create-skill.ts
new file mode 100644
index 0000000..c349d7c
--- /dev/null
+++ b/apps/web/src/hooks/skills/use-create-skill.ts
@@ -0,0 +1,18 @@
+import type { CreateSkillPayload } from "@/src/services/skills.services"
+import skillsService from "@/src/services/skills.services"
+import { QUERY_KEYS } from "@/src/utils/query-keys"
+import { useMutation, useQueryClient } from "@tanstack/react-query"
+
+const useCreateSkill = () => {
+	const queryClient = useQueryClient()
+	const { SKILL } = QUERY_KEYS
+
+	return useMutation({
+		mutationFn: (payload: CreateSkillPayload) => skillsService.createSkill(payload),
+		onSuccess: () => {
+			queryClient.invalidateQueries({ queryKey: [SKILL] })
+		},
+	})
+}
+
+export default useCreateSkill
diff --git a/apps/web/src/hooks/skills/use-delete-skill.ts b/apps/web/src/hooks/skills/use-delete-skill.ts
new file mode 100644
index 0000000..57f9f48
--- /dev/null
+++ b/apps/web/src/hooks/skills/use-delete-skill.ts
@@ -0,0 +1,16 @@
+import skillsService from "@/src/services/skills.services"
+import { QUERY_KEYS } from "@/src/utils/query-keys"
+import { useMutation, useQueryClient } from "@tanstack/react-query"
+
+const useDeleteSkill = (id: string) => {
+	const queryClient = useQueryClient()
+	const { SKILL } = QUERY_KEYS
+	return useMutation({
+		mutationFn: () => skillsService.deleteSkill(id),
+		onSuccess: () => {
+			queryClient.invalidateQueries({ queryKey: [SKILL, id] })
+		},
+	})
+}
+
+export default useDeleteSkill
diff --git a/apps/web/src/hooks/skills/use-get-skill.ts b/apps/web/src/hooks/skills/use-get-skill.ts
new file mode 100644
index 0000000..8d9a3f1
--- /dev/null
+++ b/apps/web/src/hooks/skills/use-get-skill.ts
@@ -0,0 +1,12 @@
+import skillsService from "@/src/services/skills.services"
+import { QUERY_KEYS } from "@/src/utils/query-keys"
+import { useQuery } from "@tanstack/react-query"
+
+export const useGetSkill = (id: string | null) => {
+	const { SKILL } = QUERY_KEYS
+	return useQuery({
+		queryKey: [SKILL, id],
+		queryFn: () => skillsService.getSkill(id!),
+		enabled: !!id,
+	})
+}
diff --git a/apps/web/src/hooks/skills/use-get-skills.ts b/apps/web/src/hooks/skills/use-get-skills.ts
new file mode 100644
index 0000000..a3fd8a1
--- /dev/null
+++ b/apps/web/src/hooks/skills/use-get-skills.ts
@@ -0,0 +1,11 @@
+import skillsService from "@/src/services/skills.services"
+import { QUERY_KEYS } from "@/src/utils/query-keys"
+import { useQuery } from "@tanstack/react-query"
+
+export const useGetSkills = () => {
+	const { SKILL } = QUERY_KEYS
+	return useQuery({
+		queryKey: [SKILL],
+		queryFn: () => skillsService.getSkills(),
+	})
+}
diff --git a/apps/web/src/hooks/skills/use-update-skill.ts b/apps/web/src/hooks/skills/use-update-skill.ts
new file mode 100644
index 0000000..2e31cd2
--- /dev/null
+++ b/apps/web/src/hooks/skills/use-update-skill.ts
@@ -0,0 +1,17 @@
+import type { UpdateSkillPayload } from "@/src/services/skills.services"
+import skillsService from "@/src/services/skills.services"
+import { QUERY_KEYS } from "@/src/utils/query-keys"
+import { useMutation, useQueryClient } from "@tanstack/react-query"
+
+const useUpdateSkill = (id: string) => {
+	const queryClient = useQueryClient()
+	const { SKILL } = QUERY_KEYS
+	return useMutation({
+		mutationFn: (payload: UpdateSkillPayload) => skillsService.updateSkill(id, payload),
+		onSuccess: () => {
+			queryClient.invalidateQueries({ queryKey: [SKILL, id] })
+		},
+	})
+}
+
+export default useUpdateSkill
diff --git a/apps/web/src/services/skills.services.ts b/apps/web/src/services/skills.services.ts
new file mode 100644
index 0000000..f12a19c
--- /dev/null
+++ b/apps/web/src/services/skills.services.ts
@@ -0,0 +1,54 @@
+import type { Skill } from "@/src/types/skills"
+import { ApiService } from "."
+
+export interface CreateSkillPayload {
+	name: string
+	description: string
+	source: "file"
+	content: string
+}
+
+export interface UpdateSkillPayload {
+	name: string
+	description: string
+	content: string
+}
+
+export class SkillsService {
+	private apiService: ApiService
+
+	constructor() {
+		this.apiService = new ApiService()
+	}
+
+	/** Fetch all skills. */
+	async getSkills(): Promise<Skill[]> {
+		const { data } = await this.apiService.get<{ skills: Skill[] }>("/api/skills")
+		return data?.skills ?? []
+	}
+
+	/** Fetch a single skill by ID with full content. */
+	async getSkill(id: string): Promise<Skill> {
+		const { data } = await this.apiService.get<{ skill: Skill }>(`/api/skills/${id}`)
+		return data!.skill
+	}
+
+	/** Create a new custom skill. */
+	async createSkill(payload: CreateSkillPayload): Promise<void> {
+		await this.apiService.post("/api/skills", payload)
+	}
+
+	/** Update an existing skill. */
+	async updateSkill(id: string, payload: UpdateSkillPayload): Promise<void> {
+		await this.apiService.put(`/api/skills/${id}`, payload)
+	}
+
+	/** Delete a skill by ID. */
+	async deleteSkill(id: string): Promise<void> {
+		await this.apiService.delete(`/api/skills/${id}`)
+	}
+}
+
+const skillsService = new SkillsService()
+
+export default skillsService
diff --git a/apps/web/src/types/skills.ts b/apps/web/src/types/skills.ts
new file mode 100644
index 0000000..c17f407
--- /dev/null
+++ b/apps/web/src/types/skills.ts
@@ -0,0 +1,21 @@
+export interface SkillConfig {
+	requires?: string[]
+	envVars?: string[]
+}
+
+export interface Skill {
+	id: string
+	name: string
+	description: string
+	type: "builtin" | "marketplace" | "custom"
+	source: "file" | "npm"
+	content: string | null
+	package_specifier: string | null
+	config: SkillConfig
+	installed_by: string | null
+	missing_integrations?: string[]
+	created_at: string
+	updated_at: string
+}
+
+export type SkillTab = "all" | "builtin" | "custom"
diff --git a/apps/web/src/utils/query-keys.ts b/apps/web/src/utils/query-keys.ts
index 500c9c9..bbc0b62 100644
--- a/apps/web/src/utils/query-keys.ts
+++ b/apps/web/src/utils/query-keys.ts
@@ -7,4 +7,5 @@ export const QUERY_KEYS = {
 	ARTIFACT_CONTENT: "artifact-content",
 	FILES_TREE: "files-tree",
 	FILES_LIST: "files-list",
+	SKILL: "skill",
 }
diff --git a/apps/web/src/utils/sidebar-items.tsx b/apps/web/src/utils/sidebar-items.tsx
index b87faea..7dc6d9c 100644
--- a/apps/web/src/utils/sidebar-items.tsx
+++ b/apps/web/src/utils/sidebar-items.tsx
@@ -1,5 +1,5 @@
 // ICONS
-import { IconArrowLeft, IconFiles, IconMessageCircle, IconPlug, IconSettings } from "@tabler/icons-react"
+import { IconArrowLeft, IconBolt, IconFiles, IconMessageCircle, IconPlug, IconSettings } from "@tabler/icons-react"
 
 type SidebarItem = {
 	id: string
@@ -31,6 +31,12 @@ export const getSidebarItems = (): SidebarItem[] => [
 		href: "/integrations",
 		icon: <IconPlug className="h-5 w-5 shrink-0 text-neutral-700 dark:text-neutral-200" />,
 	},
+	{
+		id: "skills",
+		label: "Skills",
+		href: "/skills",
+		icon: <IconBolt className="h-5 w-5 shrink-0 text-neutral-700 dark:text-neutral-200" />,
+	},
 	{
 		id: "settings",
 		label: "Settings",
diff --git a/infra/openshell/Dockerfile b/infra/openshell/Dockerfile
index 8de6e9e..1b00c46 100644
--- a/infra/openshell/Dockerfile
+++ b/infra/openshell/Dockerfile
@@ -36,10 +36,7 @@ COPY packages/memory/package.json packages/memory/
 RUN pnpm install --frozen-lockfile
 
 # Copy source and build
-COPY packages/logger/ packages/logger/
-COPY packages/agents/ packages/agents/
-COPY packages/memory/ packages/memory/
-COPY packages/sandbox-server/ packages/sandbox-server/
+COPY packages/ packages/
 
 RUN pnpm --filter @openzosma/logger run build
 RUN pnpm --filter @openzosma/agents run build
diff --git a/packages/a2a/src/cards.ts b/packages/a2a/src/cards.ts
index fb31514..2c89c82 100644
--- a/packages/a2a/src/cards.ts
+++ b/packages/a2a/src/cards.ts
@@ -1,16 +1,12 @@
 import { type AgentConfig, type Pool, agentConfigQueries, settingQueries } from "@openzosma/db"
-import type { AgentCard, AgentSkill } from "a2a-js"
-import { SKILL_METADATA } from "./skills.js"
+import type { AgentCard } from "a2a-js"
+import { resolveSkillsMetadata } from "./skills.js"
 
 export async function buildAgentCardForConfig(pool: Pool, config: AgentConfig): Promise<AgentCard> {
 	const publicUrl = await settingQueries.getSettingValue<string>(pool, "public_url")
 	const base = publicUrl ?? process.env.PUBLIC_URL ?? "http://localhost:4000"
 
-	const skills: AgentSkill[] = config.skills.map((id) => ({
-		id,
-		name: SKILL_METADATA[id]?.name ?? id,
-		description: SKILL_METADATA[id]?.description ?? null,
-	}))
+	const skills = await resolveSkillsMetadata(pool, config.skills)
 
 	return {
 		name: config.name,
diff --git a/packages/a2a/src/index.ts b/packages/a2a/src/index.ts
index 8c21cfd..398bd50 100644
--- a/packages/a2a/src/index.ts
+++ b/packages/a2a/src/index.ts
@@ -1,4 +1,4 @@
 export type { A2ASessionProvider } from "./types.js"
-export { SKILL_METADATA } from "./skills.js"
+export { SKILL_METADATA, resolveSkillsMetadata } from "./skills.js"
 export { buildAgentCardForConfig, buildAllAgentCards, buildDefaultAgentCard } from "./cards.js"
 export { OpenZosmaAgentExecutor, getOrCreateHandler, type AgentHandler } from "./executor.js"
diff --git a/packages/a2a/src/skills.ts b/packages/a2a/src/skills.ts
index c60d2a0..ac3a734 100644
--- a/packages/a2a/src/skills.ts
+++ b/packages/a2a/src/skills.ts
@@ -1,5 +1,10 @@
+import { type Pool, skillQueries } from "@openzosma/db"
 import type { AgentSkill } from "a2a-js"
 
+/**
+ * Static fallback metadata for the built-in skills. Used when the
+ * database is unavailable (e.g. during initial setup or in tests).
+ */
 export const SKILL_METADATA: Record<string, Omit<AgentSkill, "id">> = {
 	coding: {
 		name: "Coding Assistant",
@@ -13,4 +18,48 @@ export const SKILL_METADATA: Record<string, Omit<AgentSkill, "id">> = {
 		name: "Report Generation",
 		description: "Generate PDF reports, PPTX presentations, and data visualizations.",
 	},
+	"agent-slack": {
+		name: "Slack Integration",
+		description: "Interact with Slack channels, threads, and users.",
+	},
+}
+
+/**
+ * Resolve skill metadata for a list of skill IDs. Queries the database
+ * for full skill records and falls back to the static SKILL_METADATA
+ * map when the DB is unavailable or a skill isn't found.
+ */
+export const resolveSkillsMetadata = async (pool: Pool, skillIds: string[]): Promise<AgentSkill[]> => {
+	if (skillIds.length === 0) return []
+
+	try {
+		const dbSkills = await skillQueries.getSkillsByIds(pool, skillIds)
+		const dbMap = new Map(dbSkills.map((s) => [s.id, s]))
+
+		return skillIds.map((id) => {
+			const dbSkill = dbMap.get(id)
+			if (dbSkill) {
+				return {
+					id,
+					name: dbSkill.name,
+					description: dbSkill.description || null,
+				}
+			}
+			const fallback = SKILL_METADATA[id]
+			return {
+				id,
+				name: fallback?.name ?? id,
+				description: fallback?.description ?? null,
+			}
+		})
+	} catch {
+		return skillIds.map((id) => {
+			const fallback = SKILL_METADATA[id]
+			return {
+				id,
+				name: fallback?.name ?? id,
+				description: fallback?.description ?? null,
+			}
+		})
+	}
 }
diff --git a/packages/db/migrations/20260401000000-create-skills.js b/packages/db/migrations/20260401000000-create-skills.js
new file mode 100644
index 0000000..10a08dd
--- /dev/null
+++ b/packages/db/migrations/20260401000000-create-skills.js
@@ -0,0 +1,47 @@
+'use strict';
+
+var dbm;
+var type;
+var seed;
+var fs = require('fs');
+var path = require('path');
+var Promise;
+
+exports.setup = function(options, seedLink) {
+  dbm = options.dbmigrate;
+  type = dbm.dataType;
+  seed = seedLink;
+  Promise = options.Promise;
+};
+
+exports.up = function(db) {
+  var filePath = path.join(__dirname, 'sqls', '20260401000000-create-skills-up.sql');
+  return new Promise( function( resolve, reject ) {
+    fs.readFile(filePath, {encoding: 'utf-8'}, function(err,data){
+      if (err) return reject(err);
+      console.log('received data: ' + data);
+      resolve(data);
+    });
+  })
+  .then(function(data) {
+    return db.runSql(data);
+  });
+};
+
+exports.down = function(db) {
+  var filePath = path.join(__dirname, 'sqls', '20260401000000-create-skills-down.sql');
+  return new Promise( function( resolve, reject ) {
+    fs.readFile(filePath, {encoding: 'utf-8'}, function(err,data){
+      if (err) return reject(err);
+      console.log('received data: ' + data);
+      resolve(data);
+    });
+  })
+  .then(function(data) {
+    return db.runSql(data);
+  });
+};
+
+exports._meta = {
+  "version": 1
+};
diff --git a/packages/db/migrations/20260401000001-seed-builtin-skills.js b/packages/db/migrations/20260401000001-seed-builtin-skills.js
new file mode 100644
index 0000000..7fe5523
--- /dev/null
+++ b/packages/db/migrations/20260401000001-seed-builtin-skills.js
@@ -0,0 +1,47 @@
+'use strict';
+
+var dbm;
+var type;
+var seed;
+var fs = require('fs');
+var path = require('path');
+var Promise;
+
+exports.setup = function(options, seedLink) {
+  dbm = options.dbmigrate;
+  type = dbm.dataType;
+  seed = seedLink;
+  Promise = options.Promise;
+};
+
+exports.up = function(db) {
+  var filePath = path.join(__dirname, 'sqls', '20260401000001-seed-builtin-skills-up.sql');
+  return new Promise( function( resolve, reject ) {
+    fs.readFile(filePath, {encoding: 'utf-8'}, function(err,data){
+      if (err) return reject(err);
+      console.log('received data: ' + data);
+      resolve(data);
+    });
+  })
+  .then(function(data) {
+    return db.runSql(data);
+  });
+};
+
+exports.down = function(db) {
+  var filePath = path.join(__dirname, 'sqls', '20260401000001-seed-builtin-skills-down.sql');
+  return new Promise( function( resolve, reject ) {
+    fs.readFile(filePath, {encoding: 'utf-8'}, function(err,data){
+      if (err) return reject(err);
+      console.log('received data: ' + data);
+      resolve(data);
+    });
+  })
+  .then(function(data) {
+    return db.runSql(data);
+  });
+};
+
+exports._meta = {
+  "version": 1
+};
diff --git a/packages/db/migrations/sqls/20260401000000-create-skills-down.sql b/packages/db/migrations/sqls/20260401000000-create-skills-down.sql
new file mode 100644
index 0000000..c1b106b
--- /dev/null
+++ b/packages/db/migrations/sqls/20260401000000-create-skills-down.sql
@@ -0,0 +1 @@
+DROP TABLE IF EXISTS public.skills;
diff --git a/packages/db/migrations/sqls/20260401000000-create-skills-up.sql b/packages/db/migrations/sqls/20260401000000-create-skills-up.sql
new file mode 100644
index 0000000..2145abc
--- /dev/null
+++ b/packages/db/migrations/sqls/20260401000000-create-skills-up.sql
@@ -0,0 +1,15 @@
+CREATE TABLE public.skills (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name TEXT NOT NULL,
+  description TEXT NOT NULL DEFAULT '',
+  type TEXT NOT NULL DEFAULT 'custom',
+  source TEXT NOT NULL DEFAULT 'file',
+  content TEXT,
+  package_specifier TEXT,
+  config JSONB NOT NULL DEFAULT '{}',
+  installed_by TEXT,
+  created_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP NOT NULL,
+  updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP NOT NULL
+);
+CREATE INDEX idx_skills_type ON public.skills(type);
+CREATE INDEX idx_skills_installed_by ON public.skills(installed_by);
diff --git a/packages/db/migrations/sqls/20260401000001-seed-builtin-skills-down.sql b/packages/db/migrations/sqls/20260401000001-seed-builtin-skills-down.sql
new file mode 100644
index 0000000..4fce177
--- /dev/null
+++ b/packages/db/migrations/sqls/20260401000001-seed-builtin-skills-down.sql
@@ -0,0 +1 @@
+DELETE FROM public.skills WHERE type = 'builtin' AND name IN ('coding', 'database', 'reports', 'agent-slack');
diff --git a/packages/db/migrations/sqls/20260401000001-seed-builtin-skills-up.sql b/packages/db/migrations/sqls/20260401000001-seed-builtin-skills-up.sql
new file mode 100644
index 0000000..64ad217
--- /dev/null
+++ b/packages/db/migrations/sqls/20260401000001-seed-builtin-skills-up.sql
@@ -0,0 +1,251 @@
+INSERT INTO public.skills (name, description, type, source, content) VALUES
+('coding', 'Read, write, and edit code. Execute commands. Debug issues.', 'builtin', 'file',
+$$# Coding Assistant
+
+You are a coding assistant with access to the full workspace. You can:
+- Read, write, and edit files
+- Execute bash commands in the sandbox
+- Debug and fix issues
+- Install packages and run builds
+
+Use the bash tool to execute commands. Use file tools to read and write code.
+$$),
+('database', 'Query PostgreSQL, MySQL, MongoDB, ClickHouse, BigQuery, and SQLite databases.', 'builtin', 'file',
+$$# Database Querying
+
+You have access to database query tools in this sandbox. Connection details are available as environment variables (DB_TYPE, DB_HOST, DB_PORT, DB_NAME, DB_USER, DB_PASS or DB_CONNECTION_STRING).
+
+Use `db-query` CLI:
+```bash
+db-query --connection primary_db --query "SELECT * FROM table LIMIT 10"
+db-schema --connection primary_db
+```
+
+Only read-only queries are permitted (SELECT, WITH...SELECT, EXPLAIN).
+$$),
+('reports', 'Generate PDF reports, PPTX presentations, and data visualizations.', 'builtin', 'file',
+$$# Report Generation
+
+Generate reports using the tools available in the sandbox:
+- PDF reports via React-PDF or Puppeteer
+- PPTX presentations via pptxgenjs
+- Data visualizations via chart.js
+
+Write the report code, execute it, and deliver the output file.
+$$),
+('agent-slack', 'Automate Slack: send messages, read channels, manage users.', 'builtin', 'file',
+$skill_content$# Slack automation with `agent-slack`
+
+`agent-slack` is a CLI binary on `$PATH`. Invoke via the bash tool (e.g. `agent-slack user list`).
+
+## Authentication
+
+Pre-configured. The `SLACK_TOKEN` environment variable is set automatically.
+No manual auth setup is needed. You can verify with:
+
+```bash
+agent-slack auth test
+```
+
+## Command formatting rules
+
+1. Use bare channel names (`general` not `#general`).
+2. Use `| jq` for filtering JSON output. Do not use python3.
+3. Run each agent-slack command as a separate bash call (no `&&` chains).
+4. Only use flags documented here. Do NOT invent flags -- run `agent-slack <command> --help` if unsure.
+
+## CRITICAL: Always use channel IDs for `message send`
+
+**Channel name resolution hangs indefinitely inside the sandbox.** You MUST resolve channel names to IDs first, then use the ID.
+
+### Correct workflow to send a message:
+
+1. Find the channel ID:
+```bash
+agent-slack channel list
+```
+2. Send using the channel ID (e.g. `C096HQPQFA4`):
+```bash
+agent-slack message send "C096HQPQFA4" "Your message text"
+```
+
+### WRONG -- these will hang forever:
+```bash
+agent-slack message send "openzosma" "text"
+agent-slack message send "#openzosma" "text"
+```
+
+### RIGHT -- use channel ID directly:
+```bash
+agent-slack message send "C096HQPQFA4" "text"
+```
+
+This applies to ALL `message send` commands. Always resolve the channel ID from `channel list` first.
+
+## Quick reference
+
+### Top-level commands
+
+| Command   | Description |
+|-----------|-------------|
+| `message` | Read/write Slack messages |
+| `channel` | List, create, invite to channels |
+| `user`    | Workspace user directory |
+| `search`  | Search messages and files |
+| `canvas`  | Fetch Slack canvases as Markdown |
+| `auth`    | Manage authentication |
+
+---
+
+## Messages
+
+### Fetch a single message (with thread summary)
+
+```bash
+agent-slack message get "https://workspace.slack.com/archives/C123/p1700000000000000"
+agent-slack message get "C0123ABC" --ts "1770165109.628379"
+```
+
+Options: `--ts <ts>`, `--thread-ts <ts>`, `--max-body-chars <n>`, `--include-reactions`
+
+### List recent channel messages or a full thread
+
+```bash
+agent-slack message list "C0123ABC" --limit 20
+agent-slack message list "C0123ABC" --thread-ts "1770165109.000000"
+agent-slack message list "https://workspace.slack.com/archives/C123/p1700000000000000"
+```
+
+Options: `--thread-ts <ts>`, `--ts <ts>`, `--limit <n>` (default 25), `--oldest <ts>`, `--latest <ts>`, `--with-reaction <emoji>` (repeatable, requires `--oldest`), `--without-reaction <emoji>` (repeatable, requires `--oldest`), `--max-body-chars <n>`, `--include-reactions`
+
+### Send a message (ALWAYS use channel ID, never bare name)
+
+```bash
+agent-slack message send "C0123ABC" "Hello from your AI assistant"
+agent-slack message send "C0123ABC" "Here is the report" --attach ./report.pdf
+agent-slack message send "C0123ABC" "Reply in thread" --thread-ts "1770165109.000000"
+agent-slack message send "C0123ABC" --attach ./chart.png --attach ./data.csv
+```
+
+Options: `--thread-ts <ts>`, `--attach <path>` (repeatable)
+
+### Edit / delete a message
+
+```bash
+agent-slack message edit "https://workspace.slack.com/archives/C123/p1700000000000000" "Updated text"
+agent-slack message edit "C0123ABC" "Updated text" --ts "1770165109.628379"
+agent-slack message delete "https://workspace.slack.com/archives/C123/p1700000000000000"
+agent-slack message delete "C0123ABC" --ts "1770165109.628379"
+```
+
+### React to a message
+
+```bash
+agent-slack message react add "https://workspace.slack.com/archives/C123/p1700000000000000" "eyes"
+agent-slack message react remove "https://workspace.slack.com/archives/C123/p1700000000000000" "eyes"
+```
+
+---
+
+## Channels
+
+### List channels
+
+```bash
+agent-slack channel list
+agent-slack channel list --user "@alice" --limit 50
+agent-slack channel list --all --limit 100
+```
+
+Options: `--user <user>` (U... or @handle), `--all` (list all conversations, incompatible with `--user`), `--limit <n>` (default 100), `--cursor <cursor>`
+
+### Create a channel
+
+```bash
+agent-slack channel new --name "incident-war-room"
+agent-slack channel new --name "incident-leads" --private
+```
+
+### Invite users to a channel
+
+```bash
+agent-slack channel invite --channel "incident-war-room" --users "U01AAAA,@alice,bob@example.com"
+```
+
+### Mark as read
+
+```bash
+agent-slack channel mark "https://workspace.slack.com/archives/C123/p1700000000000000"
+agent-slack channel mark "C0123ABC" --ts "1770165109.628379"
+```
+
+---
+
+## Users
+
+### List workspace users
+
+```bash
+agent-slack user list
+agent-slack user list --limit 100
+agent-slack user list --include-bots
+```
+
+Options: `--limit <n>` (default 200), `--cursor <cursor>`, `--include-bots`
+
+NOTE: `user list` lists ALL workspace users. There is no `--channel` flag. To find members of a specific channel, use `agent-slack channel list --user "@username"` to check if a user is in a channel, or look at the `num_members` field from `channel list --all`.
+
+### Get a single user
+
+```bash
+agent-slack user get "@alice"
+agent-slack user get "U01AAAA"
+```
+
+### Open a DM / group DM
+
+```bash
+agent-slack user dm-open @alice
+agent-slack user dm-open @alice @bob
+agent-slack user dm-open U01AAAA U02BBBB
+```
+
+---
+
+## Search
+
+### Search messages
+
+```bash
+agent-slack search messages "query" --channel "C0123ABC"
+agent-slack search messages "deploy failed" --user "@alice" --after 2026-01-01
+```
+
+### Search files
+
+```bash
+agent-slack search files "report" --content-type snippet --limit 10
+```
+
+### Search all (messages + files)
+
+```bash
+agent-slack search all "smoke tests failed" --channel "C0123ABC" --after 2026-01-01 --before 2026-02-01
+```
+
+Shared search options: `--channel <channel>` (repeatable), `--user <user>`, `--after <YYYY-MM-DD>`, `--before <YYYY-MM-DD>`, `--content-type <any|text|image|snippet|file>`, `--limit <n>` (default 20), `--max-content-chars <n>`
+
+---
+
+## Canvas
+
+```bash
+agent-slack canvas get "https://workspace.slack.com/docs/T123/F456"
+```
+
+---
+
+## Attachments
+
+`message get`, `message list`, and `search` auto-download attachments and include file metadata in JSON output (typically under `files[]`), including `name` and `path` for the local download.
+$skill_content$);
diff --git a/packages/db/src/index.ts b/packages/db/src/index.ts
index 033cb24..cdceb43 100644
--- a/packages/db/src/index.ts
+++ b/packages/db/src/index.ts
@@ -16,6 +16,7 @@ export type {
 	Setting,
 	UserSandbox,
 	SandboxStatus,
+	Skill,
 } from "./types.js"
 
 // Queries
@@ -26,3 +27,4 @@ export * as connectionQueries from "./queries/connections.js"
 export * as integrationQueries from "./queries/integrations.js"
 export * as settingQueries from "./queries/settings.js"
 export * as userSandboxQueries from "./queries/user-sandboxes.js"
+export * as skillQueries from "./queries/skills.js"
diff --git a/packages/db/src/queries/skills.ts b/packages/db/src/queries/skills.ts
new file mode 100644
index 0000000..0ea7fcb
--- /dev/null
+++ b/packages/db/src/queries/skills.ts
@@ -0,0 +1,148 @@
+import type pg from "pg"
+import type { Skill } from "../types.js"
+
+/**
+ * List skills with optional filters. Supports filtering by type, installedBy, or both.
+ */
+export const listSkills = async (pool: pg.Pool, opts?: { type?: string; installedBy?: string }): Promise<Skill[]> => {
+	const conditions: string[] = []
+	const values: unknown[] = []
+	let paramIndex = 1
+
+	if (opts?.type !== undefined) {
+		conditions.push(`type = $${paramIndex++}`)
+		values.push(opts.type)
+	}
+	if (opts?.installedBy !== undefined) {
+		conditions.push(`installed_by = $${paramIndex++}`)
+		values.push(opts.installedBy)
+	}
+
+	const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : ""
+	const result = await pool.query(`SELECT * FROM skills ${where} ORDER BY created_at DESC`, values)
+	return result.rows.map(mapSkill)
+}
+
+/**
+ * Fetch a single skill by ID. Returns null if not found.
+ */
+export const getSkill = async (pool: pg.Pool, id: string): Promise<Skill | null> => {
+	const result = await pool.query("SELECT * FROM skills WHERE id = $1", [id])
+	return result.rows[0] ? mapSkill(result.rows[0]) : null
+}
+
+/**
+ * Create a new skill record.
+ */
+export const createSkill = async (
+	pool: pg.Pool,
+	data: {
+		name: string
+		description?: string
+		type?: string
+		source?: string
+		content?: string | null
+		packageSpecifier?: string | null
+		config?: Record<string, unknown>
+		installedBy?: string | null
+	},
+): Promise<Skill> => {
+	const result = await pool.query(
+		`INSERT INTO skills (name, description, type, source, content, package_specifier, config, installed_by)
+		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+		 RETURNING *`,
+		[
+			data.name,
+			data.description ?? "",
+			data.type ?? "custom",
+			data.source ?? "file",
+			data.content ?? null,
+			data.packageSpecifier ?? null,
+			JSON.stringify(data.config ?? {}),
+			data.installedBy ?? null,
+		],
+	)
+	return mapSkill(result.rows[0])
+}
+
+/**
+ * Update a skill's mutable fields. Returns null if the skill does not exist.
+ */
+export const updateSkill = async (
+	pool: pg.Pool,
+	id: string,
+	updates: Partial<{
+		name: string
+		description: string
+		content: string | null
+		packageSpecifier: string | null
+		config: Record<string, unknown>
+	}>,
+): Promise<Skill | null> => {
+	const fields: string[] = []
+	const values: unknown[] = []
+	let paramIndex = 1
+
+	if (updates.name !== undefined) {
+		fields.push(`name = $${paramIndex++}`)
+		values.push(updates.name)
+	}
+	if (updates.description !== undefined) {
+		fields.push(`description = $${paramIndex++}`)
+		values.push(updates.description)
+	}
+	if (updates.content !== undefined) {
+		fields.push(`content = $${paramIndex++}`)
+		values.push(updates.content)
+	}
+	if (updates.packageSpecifier !== undefined) {
+		fields.push(`package_specifier = $${paramIndex++}`)
+		values.push(updates.packageSpecifier)
+	}
+	if (updates.config !== undefined) {
+		fields.push(`config = $${paramIndex++}`)
+		values.push(JSON.stringify(updates.config))
+	}
+
+	if (fields.length === 0) return getSkill(pool, id)
+
+	fields.push("updated_at = now()")
+	values.push(id)
+
+	const result = await pool.query(
+		`UPDATE skills SET ${fields.join(", ")} WHERE id = $${paramIndex} RETURNING *`,
+		values,
+	)
+	return result.rows[0] ? mapSkill(result.rows[0]) : null
+}
+
+/**
+ * Delete a skill by ID.
+ */
+export const deleteSkill = async (pool: pg.Pool, id: string): Promise<void> => {
+	await pool.query("DELETE FROM skills WHERE id = $1", [id])
+}
+
+/**
+ * Fetch multiple skills by their IDs. Used at session creation to load
+ * the agent's enabled skills in a single query.
+ */
+export const getSkillsByIds = async (pool: pg.Pool, ids: string[]): Promise<Skill[]> => {
+	if (ids.length === 0) return []
+	const result = await pool.query("SELECT * FROM skills WHERE id = ANY($1::uuid[])", [ids])
+	return result.rows.map(mapSkill)
+}
+
+const mapSkill = (row: Record<string, unknown>): Skill => ({
+	id: row.id as string,
+	name: row.name as string,
+	description: row.description as string,
+	type: row.type as "builtin" | "marketplace" | "custom",
+	source: row.source as "file" | "npm",
+	content: row.content as string | null,
+	packageSpecifier: row.package_specifier as string | null,
+	config: row.config as { requires?: string[]; envVars?: string[] },
+	installedBy: row.installed_by as string | null,
+	createdAt: row.created_at as Date,
+	updatedAt: row.updated_at as Date,
+})
diff --git a/packages/db/src/types.ts b/packages/db/src/types.ts
index 8bb1d60..657ecc9 100644
--- a/packages/db/src/types.ts
+++ b/packages/db/src/types.ts
@@ -107,3 +107,19 @@ export interface UserSandbox {
 	suspendedAt: Date | null
 	metadata: Record<string, unknown>
 }
+
+// -- Skills --
+
+export interface Skill {
+	id: string
+	name: string
+	description: string
+	type: "builtin" | "marketplace" | "custom"
+	source: "file" | "npm"
+	content: string | null
+	packageSpecifier: string | null
+	config: { requires?: string[]; envVars?: string[] }
+	installedBy: string | null
+	createdAt: Date
+	updatedAt: Date
+}
diff --git a/packages/orchestrator/src/sandbox-http-client.ts b/packages/orchestrator/src/sandbox-http-client.ts
index bf8e912..924a5e6 100644
--- a/packages/orchestrator/src/sandbox-http-client.ts
+++ b/packages/orchestrator/src/sandbox-http-client.ts
@@ -8,6 +8,8 @@ import type {
 	SandboxHealthResponse,
 	SandboxSessionInfo,
 	SandboxSessionListResponse,
+	SkillFileEntry,
+	SkillFilesListResponse,
 	UserFileEntry,
 	UserFilesListResponse,
 } from "./types.js"
@@ -220,6 +222,74 @@ export class SandboxHttpClient {
 		}
 	}
 
+	// -----------------------------------------------------------------------
+	// Skills
+	// -----------------------------------------------------------------------
+
+	/**
+	 * Write a skill SKILL.md file into the sandbox.
+	 */
+	async writeSkillFile(skillName: string, content: string): Promise<void> {
+		const res = await this.fetch(`/skills/${encodeURIComponent(skillName)}`, {
+			method: "PUT",
+			body: JSON.stringify({ content }),
+		})
+		if (!res.ok) {
+			let detail: string
+			try {
+				const body = (await res.json()) as { error?: string }
+				detail = body.error ?? `HTTP ${res.status}`
+			} catch {
+				detail = await res.text().catch(() => `HTTP ${res.status}`)
+			}
+			throw new Error(`Sandbox writeSkillFile failed (${res.status}): ${detail}`)
+		}
+	}
+
+	/**
+	 * Delete a skill file from the sandbox.
+	 */
+	async deleteSkillFile(skillName: string): Promise<void> {
+		const res = await this.fetch(`/skills/${encodeURIComponent(skillName)}`, { method: "DELETE" })
+		if (!res.ok && res.status !== 404) {
+			throw new Error(`Sandbox deleteSkillFile failed (${res.status})`)
+		}
+	}
+
+	/**
+	 * List all skill files in the sandbox.
+	 */
+	async listSkillFiles(): Promise<SkillFileEntry[]> {
+		const res = await this.fetch("/skills")
+		if (!res.ok) {
+			throw new Error(`Sandbox listSkillFiles failed (${res.status})`)
+		}
+		const body = (await res.json()) as SkillFilesListResponse
+		return body.files
+	}
+
+	/**
+	 * Install an npm package skill in the sandbox.
+	 * Runs `npm install <packageSpecifier>` inside the sandbox workspace.
+	 */
+	async installSkillPackage(packageSpecifier: string): Promise<void> {
+		const res = await this.fetch("/skills/install", {
+			method: "POST",
+			body: JSON.stringify({ packageSpecifier }),
+			timeout: 120_000,
+		})
+		if (!res.ok) {
+			let detail: string
+			try {
+				const body = (await res.json()) as { error?: string }
+				detail = body.error ?? `HTTP ${res.status}`
+			} catch {
+				detail = await res.text().catch(() => `HTTP ${res.status}`)
+			}
+			throw new Error(`Sandbox installSkillPackage failed (${res.status}): ${detail}`)
+		}
+	}
+
 	// -----------------------------------------------------------------------
 	// User files
 	// -----------------------------------------------------------------------
diff --git a/packages/orchestrator/src/session-manager.ts b/packages/orchestrator/src/session-manager.ts
index 75b2c74..69a7b16 100644
--- a/packages/orchestrator/src/session-manager.ts
+++ b/packages/orchestrator/src/session-manager.ts
@@ -1,8 +1,7 @@
 import { randomUUID } from "node:crypto"
 import type { AgentStreamEvent } from "@openzosma/agents"
-import type { Pool } from "@openzosma/db"
-import { agentConfigQueries, userSandboxQueries } from "@openzosma/db"
-import type { UserSandbox } from "@openzosma/db"
+import type { AgentConfig, Pool, Skill, UserSandbox } from "@openzosma/db"
+import { agentConfigQueries, skillQueries, userSandboxQueries } from "@openzosma/db"
 import { createLogger } from "@openzosma/logger"
 import type { SandboxHttpClient } from "./sandbox-http-client.js"
 import type { SandboxManager } from "./sandbox-manager.js"
@@ -10,6 +9,18 @@ import type { KBFileEntry, OrchestratorSession, UserFileEntry } from "./types.js
 
 const log = createLogger({ component: "orchestrator" })
 
+/**
+ * Build a system prompt prefix listing the agent's available skills
+ * and their file paths in the sandbox.
+ */
+const buildSkillsPrefix = (skills: Skill[]): string | null => {
+	const fileSkills = skills.filter((s): s is Skill & { content: string } => s.source === "file" && s.content !== null)
+	if (fileSkills.length === 0) return null
+
+	const lines = fileSkills.map((s) => `- ${s.name}: /workspace/.skills/${s.name}.md`)
+	return `You have the following skills available. Read the skill file before using a capability:\n${lines.join("\n")}`
+}
+
 /**
  * Orchestrator session manager.
  *
@@ -71,6 +82,7 @@ export class OrchestratorSessionManager {
 			systemPromptPrefix?: string
 			toolsEnabled?: string[]
 		} = {}
+		let agentConfigRecord: AgentConfig | null = null
 
 		if (opts?.resolvedConfig) {
 			agentConfig = {
@@ -78,13 +90,13 @@ export class OrchestratorSessionManager {
 				systemPrompt: opts.resolvedConfig.systemPrompt ?? undefined,
 			}
 		} else if (opts?.agentConfigId && this.pool) {
-			const config = await agentConfigQueries.getAgentConfig(this.pool, opts.agentConfigId)
-			if (config) {
+			agentConfigRecord = await agentConfigQueries.getAgentConfig(this.pool, opts.agentConfigId)
+			if (agentConfigRecord) {
 				agentConfig = {
-					provider: config.provider,
-					model: config.model,
-					systemPrompt: config.systemPrompt ?? undefined,
-					toolsEnabled: config.toolsEnabled,
+					provider: agentConfigRecord.provider,
+					model: agentConfigRecord.model,
+					systemPrompt: agentConfigRecord.systemPrompt ?? undefined,
+					toolsEnabled: agentConfigRecord.toolsEnabled,
 				}
 			}
 		}
@@ -92,6 +104,77 @@ export class OrchestratorSessionManager {
 		// Create the session inside the sandbox via HTTP
 		const client = this.sandboxManager.getHttpClient(userId)
 
+		// Load and inject skills into sandbox.
+		// OPENZOSMA_INJECT_ALL_SKILLS=true bypasses agent config skill assignment and loads every skill
+		// from the DB — useful during local development before agent config UI is wired up.
+		let skills: Skill[] = []
+		if (agentConfigRecord?.skills && agentConfigRecord.skills.length > 0) {
+			skills = await skillQueries.getSkillsByIds(this.pool, agentConfigRecord.skills)
+		} else if (process.env.OPENZOSMA_INJECT_ALL_SKILLS === "true") {
+			skills = await skillQueries.listSkills(this.pool)
+		}
+		if (skills.length > 0) {
+			for (const skill of skills) {
+				if (skill.source !== "file" || !skill.content) continue
+				try {
+					await client.writeSkillFile(skill.name, skill.content)
+				} catch (err) {
+					log.warn("Failed to write skill file to sandbox", {
+						skillName: skill.name,
+						error: err instanceof Error ? err.message : String(err),
+					})
+				}
+			}
+
+			for (const skill of skills) {
+				if (skill.source !== "npm" || !skill.packageSpecifier) continue
+				try {
+					await client.installSkillPackage(skill.packageSpecifier)
+				} catch (err) {
+					log.warn("Failed to install npm skill package in sandbox", {
+						skillName: skill.name,
+						packageSpecifier: skill.packageSpecifier,
+						error: err instanceof Error ? err.message : String(err),
+					})
+				}
+			}
+
+			// Inject integration metadata for skills that declare requirements
+			const requiredTypes = new Set<string>()
+			for (const skill of skills) {
+				const requires = skill.config?.requires
+				if (requires) {
+					for (const req of requires) requiredTypes.add(req)
+				}
+			}
+
+			if (requiredTypes.size > 0) {
+				try {
+					const typesArray = Array.from(requiredTypes)
+					const integrations = await this.pool.query(
+						"SELECT type, name FROM public.integrations WHERE type = ANY($1::text[]) AND status = 'active'",
+						[typesArray],
+					)
+					if (integrations.rows.length > 0) {
+						const integrationsMeta = integrations.rows.map((r: { type: string; name: string }) => ({
+							type: r.type,
+							name: r.name,
+						}))
+						await client.writeSkillFile("_integrations", JSON.stringify(integrationsMeta, null, 2))
+					}
+				} catch (err) {
+					log.warn("Failed to inject integration metadata for skills", {
+						error: err instanceof Error ? err.message : String(err),
+					})
+				}
+			}
+
+			const skillsPrefix = buildSkillsPrefix(skills)
+			if (skillsPrefix) {
+				agentConfig.systemPromptPrefix = [skillsPrefix, agentConfig.systemPromptPrefix].filter(Boolean).join("\n\n")
+			}
+		}
+
 		log.info("Orchestrator: forwarding createSession to sandbox", {
 			sessionId,
 			hasSystemPromptPrefix: !!agentConfig.systemPromptPrefix,
diff --git a/packages/orchestrator/src/types.ts b/packages/orchestrator/src/types.ts
index 2fc741c..b3926cf 100644
--- a/packages/orchestrator/src/types.ts
+++ b/packages/orchestrator/src/types.ts
@@ -159,3 +159,20 @@ export interface UserFileEntry {
 export interface UserFilesListResponse {
 	entries: UserFileEntry[]
 }
+
+// ---------------------------------------------------------------------------
+// Skill file types (mirror sandbox-server types)
+// ---------------------------------------------------------------------------
+
+/** A single file in the sandbox skills directory. */
+export interface SkillFileEntry {
+	/** Skill name (without .md extension). */
+	name: string
+	/** Filename within .skills/ */
+	path: string
+}
+
+/** Response for GET /skills */
+export interface SkillFilesListResponse {
+	files: SkillFileEntry[]
+}
diff --git a/packages/sandbox-server/src/server.ts b/packages/sandbox-server/src/server.ts
index b1f7960..52fb5d7 100644
--- a/packages/sandbox-server/src/server.ts
+++ b/packages/sandbox-server/src/server.ts
@@ -1,3 +1,4 @@
+import { execSync } from "node:child_process"
 import {
 	type Stats,
 	existsSync,
@@ -27,6 +28,7 @@ const log = createLogger({ component: "sandbox-server" })
  */
 const WORKSPACE_DIR = process.env.OPENZOSMA_WORKSPACE ?? "/workspace"
 const KB_DIR = join(WORKSPACE_DIR, ".knowledge-base")
+const SKILLS_DIR = join(WORKSPACE_DIR, ".skills")
 const USER_FILES_DIR = join(WORKSPACE_DIR, "user-files")
 const OUTPUT_DIR = "output"
 
@@ -137,6 +139,16 @@ const resolveKBPath = (relativePath: string): string | null => {
 	return resolved
 }
 
+/**
+ * Resolve a skill filename within the skills directory.
+ * Returns null if the resolved path escapes the skills root (path traversal).
+ */
+const resolveSkillsPath = (filename: string): string | null => {
+	const resolved = resolve(SKILLS_DIR, normalize(filename))
+	if (!resolved.startsWith(SKILLS_DIR)) return null
+	return resolved
+}
+
 /**
  * Recursively collect all files in a directory.
  * Returns entries with relative paths and file contents.
@@ -493,6 +505,133 @@ export function createSandboxApp(): Hono {
 		return c.json({ ok: true, path: filePath })
 	})
 
+	// -----------------------------------------------------------------------
+	// Skills CRUD
+	// -----------------------------------------------------------------------
+
+	/**
+	 * GET /skills -- list all skill files.
+	 *
+	 * Returns all .md files under /workspace/.skills/.
+	 */
+	app.get("/skills", (c) => {
+		if (!existsSync(SKILLS_DIR)) {
+			return c.json({ files: [] })
+		}
+
+		let dirents: string[]
+		try {
+			dirents = readdirSync(SKILLS_DIR)
+		} catch {
+			return c.json({ files: [] })
+		}
+
+		const files = dirents
+			.filter((name) => name.endsWith(".md"))
+			.map((name) => ({
+				name: name.replace(/\.md$/, ""),
+				path: name,
+			}))
+
+		return c.json({ files })
+	})
+
+	/**
+	 * POST /skills/install -- install an npm package skill in the sandbox.
+	 *
+	 * Runs `npm install <packageSpecifier>` in the workspace directory.
+	 * Body: { packageSpecifier: string }
+	 */
+	app.post("/skills/install", async (c) => {
+		let body: { packageSpecifier: string }
+		try {
+			body = await c.req.json<{ packageSpecifier: string }>()
+		} catch {
+			return c.json({ error: "Invalid request body" }, 400)
+		}
+
+		if (!body.packageSpecifier || typeof body.packageSpecifier !== "string") {
+			return c.json({ error: "packageSpecifier is required" }, 400)
+		}
+
+		const specifier = body.packageSpecifier.trim()
+		if (!/^[@a-z0-9][\w./@-]*$/i.test(specifier)) {
+			return c.json({ error: "Invalid package specifier" }, 400)
+		}
+
+		try {
+			execSync(`npm install ${specifier}`, {
+				cwd: WORKSPACE_DIR,
+				stdio: "pipe",
+				timeout: 120_000,
+			})
+			return c.json({ ok: true, package: specifier })
+		} catch (err) {
+			const message = err instanceof Error ? err.message : "Unknown install error"
+			log.error("npm install failed", { package: specifier, error: message })
+			return c.json({ error: `Installation failed: ${message}` }, 500)
+		}
+	})
+
+	/**
+	 * PUT /skills/:skillName -- create or update a skill file.
+	 *
+	 * Writes content to /workspace/.skills/<skillName>.md.
+	 * Body: { content: string }
+	 */
+	app.put("/skills/:skillName", async (c) => {
+		const skillName = c.req.param("skillName")
+		if (!skillName) {
+			return c.json({ error: "Skill name is required" }, 400)
+		}
+
+		const filename = `${skillName}.md`
+		const resolved = resolveSkillsPath(filename)
+		if (!resolved) {
+			return c.json({ error: "Invalid skill name (traversal detected)" }, 400)
+		}
+
+		let body: { content: string }
+		try {
+			body = await c.req.json<{ content: string }>()
+		} catch {
+			return c.json({ error: "Invalid request body" }, 400)
+		}
+
+		if (typeof body.content !== "string") {
+			return c.json({ error: "content must be a string" }, 400)
+		}
+
+		mkdirSync(SKILLS_DIR, { recursive: true })
+		writeFileSync(resolved, body.content, "utf-8")
+		return c.json({ ok: true, name: skillName, path: filename })
+	})
+
+	/**
+	 * DELETE /skills/:skillName -- delete a skill file.
+	 *
+	 * Removes /workspace/.skills/<skillName>.md.
+	 */
+	app.delete("/skills/:skillName", (c) => {
+		const skillName = c.req.param("skillName")
+		if (!skillName) {
+			return c.json({ error: "Skill name is required" }, 400)
+		}
+
+		const filename = `${skillName}.md`
+		const resolved = resolveSkillsPath(filename)
+		if (!resolved) {
+			return c.json({ error: "Invalid skill name (traversal detected)" }, 400)
+		}
+
+		if (!existsSync(resolved)) {
+			return c.json({ error: "Skill file not found" }, 404)
+		}
+
+		rmSync(resolved, { force: true })
+		return c.json({ ok: true, name: skillName })
+	})
+
 	// -----------------------------------------------------------------------
 	// File upload (for chat attachments)
 	// -----------------------------------------------------------------------