The former. With some very minor exceptions, we don't use automated scanners at all in our practice. We use Burp to set up testing experiments, and we use ruby for automation. We've found that "scanners" make good testers much less sharp; if the tool spits out the names of specific vulnerabilities, it's suspect.

But even practices that do use automated scanners won't be relying on Skipfish or sqlmap.

This obviously doesn't hold for network pentesters. For tests in which application flaws aren't the whole story, and you're just looking for the fastest way in you can find, sure; sqlmap is valuable there, much more so than Skipfish. We don't do those kinds of tests often.