Skip to content

Skills checklist

Beginner · Last reviewed 14 November 2026

In one sentence

This skills checklist lists what a beginner-to-intermediate AI engineer should be able to do (not just know) by the end of this playbook, grouped by module, so you can tick off what you've proven and see what's left.

Why it matters in 2027

"I watched a course" isn't evidence. "I built this, tested it this way, and here's what broke" is. A checklist of concrete, demonstrable skills keeps your learning honest and gives you material for your CV, portfolio and interviews.

Explain it like I'm new

A driving licence test has a list: start on a hill, reverse park, emergency stop. You don't pass by explaining them. You pass by doing each one in front of an examiner. Treat each line below the same way, and only tick it when you've done it and can show it.

How it works

Copy this into your own notes or a GitHub issue and tick as you go. Each line links to where it's taught.

Foundations

  • Explain tokens, context windows, temperature and why LLMs hallucinate (00)
  • Call an LLM from Python with retries, timeouts and token logging (calling an API)
  • Build a small RAG pipeline and explain each step (RAG)

Coding agents

  • Use one coding agent daily, following plan, tests, implement, review (workflow)
  • Write an AGENTS.md and a skill for a real project (P1)
  • Connect an MCP server with a least-privilege token (MCP)
  • Keep a log of agent mistakes and the rules you added because of them

Building agents

  • Design narrow tools with permission checks in code (tool calling)
  • Build a LangGraph agent with a checkpointer and a human approval step (P3)
  • Argue when not to use an agent (when not to)

Safety and security

  • Explain every OWASP LLM Top 10 (2026) risk with an example and a defense (04)
  • Explain the OWASP agentic risks and "least agency" (agentic threats)
  • Demonstrate an indirect prompt injection and stop it with design controls (P2)
  • Build input, output and action guardrails and measure their false positives (P4)
  • Mask Indian PII formats with checksums (PII)

Evaluation

  • Build a 30-case golden dataset with tags, including adversarial cases (datasets)
  • Write an LLM-as-judge rubric and check it against your own labels (judge)
  • Run an automated red-team scan and turn findings into tests (red-teaming)

Memory, production and design

  • Design memory writes that resist poisoning and respect deletion (06)
  • Trace an agent end to end with OpenTelemetry, without logging personal data (tracing)
  • Estimate cost per task and cut it by half without losing quality (cost)
  • Load test an AI endpoint and explain the results (P5)
  • Write a design doc and a threat model for an AI feature (08)
  • Explain what DPDP and the EU AI Act mean for a design (compliance)

Example

Turning a ticked line into CV evidence:

Built a guardrailed support agent (Python, LiteLLM, FastAPI). Input, output and action guardrails mapped to OWASP LLM Top 10 2026; Luhn/Verhoeff-checked PII masking for Indian formats; per-user rate limits and token budgets. Eval suite of 12 tagged cases with an LLM-as-judge, gating CI at 100% on security cases.

Specific, checkable, and every claim links to code.

Common mistakes

  • Ticking items you've only read about.
  • Skipping the "measure it" parts (evals, false-positive rates, cost). They're what employers notice.
  • Doing everything in tutorials' happy paths. Break things on purpose.

Check yourself

  1. What's the test for ticking a line on this list?
  2. Which three items would best show security skill?
  3. What makes a CV line like the example convincing?
Answers
  1. You've done it yourself and can show the result (code, a write-up, numbers).
  2. Any three of the safety and security items, especially the injection demo with design controls, guardrails with measured false positives, and a threat model.
  3. It names specific techniques and numbers, maps to a recognized standard, and every claim can be checked in the code.

Go deeper