How companies share AI skills in Claude, ChatGPT, Copilot and Gemini: what 8 accounts and the docs show

We reviewed how teams share AI skills at work: the vendors' documentation for Claude, ChatGPT, Microsoft Copilot and Google Gemini and open Claude Code bug reports, read on 9 November 2026 and re-checked on 10 November 2026, plus eight accounts of teams doing it (seven public, one told to us directly). This is a review of those sources, not a survey: it shows what the sources report, not how often each problem happens across companies. Unilytics sells a skill system for consultants, so we have a commercial interest in this category; see the disclosure at the end.

Key findings

• Each of the four documents a way to share something reusable inside an organization, and they aren't the same thing. Claude has organization skills, ChatGPT has workspace skills and plugins, Microsoft has an agent catalog, and Google shares Gems today and announced on 30 September 2026 that skills will eventually replace them in the Gemini app and Workspace. Plans, surfaces and behaviour differ by product.
• Two of the eight accounts mention stale or outdated content. In one, a skill went out of date after a product change; in the other, practitioners warn that mistakes in shared skills spread into new code and that skills are sometimes outdated. Anthropic's own guide advises keeping time-sensitive information out of skills.
• Three public bug reports describe skill update and sync problems. Claude Code issues #96064, #104021 and #106293 (September and October 2026, open when we read them) describe three symptoms after a user updated their own skill: sessions getting the old version, a sync that stopped completing, and a delay of about 20 minutes. They are user reports about personal skills, not organization skills, and not confirmed defects.
• Five accounts mention review or scanning, and four of them involve people. Trail of Bits reads every line of hooks and scripts; Microsoft requires five reviews, including security and privacy, before its catalog; WPP's curated agents are approved by senior experts; one B2B software company added a security check done by hand. Sentry uses a skill that security-scans other skills. The material we read for the other three accounts doesn't mention either.
• Several products accept files named SKILL.md; sharing settings and behaviour stay product-specific. A shared file name doesn't make a skill behave the same everywhere. Sharing settings, sync and history are documented per product. Anthropic's docs say to upload custom skills separately for each surface, though Claude Code now syncs one way from a claude.ai account. Google's skills don't sync between the Gemini app, Workspace apps and Gemini Enterprise. OpenAI's guide for ChatGPT Enterprise moves published custom GPTs into plugins: a GPT's instructions and reference files become a skill, and custom actions have to be rebuilt. Virtualization Review reported in September 2026 that custom GPTs retire on 11 December 2026, later for some Enterprise customers.

What this review doesn't show

No adoption rate, no failure rate, and no ranking of the assistants. The accounts were found through company and personal blogs, a press release, code repositories and Hacker News, so they over-represent teams that write about their setup. Blogs and press releases are self-reported.

How many companies share skills?

We found no survey that counts companies with an internal skill library. The one public number we could re-check is self-reported, and it counts agents inside one company, not companies: Microsoft runs "more than 100,000 agents" in its own tenant (Microsoft Inside Track, November 2025).

Three ways teams share skills

Eight accounts, and what went wrong

Each is labelled with what kind of evidence it is.

1. A B2B software company (described to us directly by the company; anonymised and not independently verified). Its marketing team wrote writing skills with the brand voice and product facts typed inside. Engineering added an internal review step, including a security check done by hand, before skills reached staff. Getting the first skills out took people from several teams, and a skill went out of date after a product change.
2. Anthropic's Claude Code team (company blog, June 2026) has hundreds of skills in active use: first in a repo folder, then in an internal plugin marketplace once a skill has traction. Skills that "try to do too much" confuse the agent, and owners update them as new gotchas appear.
3. Freeday, a 23-person company (a team member's blog, 2026), keeps department plugins in one repo, preinstalled by admins. They don't reach Claude's chat app, so skills are also pasted into the admin screen and kept in two places.
4. Sentry (public repository) ships 31 skills through a plugin marketplace, including one that security-scans other skills. Its README says it copies ("vendors") outside skills into the repository rather than depending on them at runtime.
5. Trail of Bits (public repository) curates 29 vetted plugins and approves 10 marketplaces, 7 of them from outside the company. "Published skills have been found with backdoors and malicious hooks", so reviewers read every line of hooks and scripts in every pull request.
6. Microsoft IT (company blog, May 2026) requires security, privacy, accessibility, responsible-AI and maker-stack reviews before an agent enters the company catalog. It describes working to prevent sprawl and duplicated work, says agents "tend to drop out of compliance" when its policies change, and deletes agents owned by individuals when they leave.
7. WPP (press release, January 2026) says its agencies built "thousands of bespoke AI agents", then launched a hub that starts with four curated agents approved by senior experts, and offers to build custom agents with clients from their own data and brand guidelines.
8. Practitioners on Hacker News (forum thread, September 2026; anecdotal) sync skills between Claude Code, Codex and OpenCode with repositories, symlinks and scripts; one commenter's tool pins content hashes. One warns that mistakes in skills "can easily spread to all of the new code you write using a coding agent"; another, that skills "are sometimes wrong or outdated".

Seven issues the sources raise

What each assistant documents (re-checked 10 November 2026)

"Not found" means we found no source on that date, not proof that a feature is missing. Copilot is several products; each cell names the one its source covers.

What the accounts suggest for a team starting now

These follow from the sources above; they aren't tested recommendations.

• Keep facts in one maintained source. Product names, messaging and voice in one place, with an owner, versions and access control, read by each skill as a step, instead of typed into every skill. A live source adds its own risks (who can read it, availability, and text that could carry instructions, known as prompt injection), so give it the least access it needs and treat it like any other dependency.
• Plan the review before the rollout. Four accounts describe people reviewing and one an automated scanner. Decide who or what checks a skill before it reaches everyone, and read hooks and scripts as you would code.
• Keep the source of truth in version control. Pull requests, owners and checks, then deploy to each assistant, and test that you can roll a deployment back. Anthropic's enterprise guide recommends Git for the same reasons.
• Count what's used. Where usage data exists (enterprise plans), read it before building more.

Methodology

• Scope: skills, custom GPTs, Gems and agents that an organization shares with its own staff, plus two public repositories in which companies curate skills (Sentry's says it holds skills its team uses). Not public skill marketplaces in general.
• Vendor documentation and bug reports: read on 9 November 2026 and re-checked against each link on 10 November 2026; claims that had changed were corrected. Six OpenAI pages and one Gartner press release refused automated reading that day, so we dropped every claim that rested only on them (two vendor customer stories, two usage statistics and a forecast among them); two table cells say "Not checked" instead. Every claim links its source in the list below. Claude appears most often in the issues table partly because the only public bug reports we found were for Claude Code. Help-centre pages carry no publication date, so the date is the date we read them. Bug reports describe what users reported, not confirmed defects.
• Accounts: seven public (company and personal blogs, a press release, code repositories, one Hacker News thread) and one B2B software company that described its rollout to us directly. We anonymised it and left out details that could identify it. Each account is labelled with its evidence type.
• Corrections: if a vendor changes a feature or we got one wrong, we update this page and note the change and its date at the top.
• Disclosure: Unilytics builds a skill system for consultants, a product in this space. We kept this review to what the sources show and left our product out of it.