Agent Skills moves into neutral governance

Anthropic is donating Agent Skills to the Agentic AI Foundation, a Linux Foundation project it co-founded with Block and OpenAI. The donation covers the specification, name and logo, GitHub organisation and agentskills.io domain. Developers can continue using and contributing to the standard without becoming foundation members.

A neutral home matters because a skill is intended to move across competing agent products. If the specification remained controlled by one model provider, adopters could reasonably worry that changes would favour that provider’s runtime. Foundation governance does not eliminate commercial influence, but it can create public processes and shared stewardship.

A deliberately simple package carries procedural knowledge

An Agent Skill is a folder centred on a SKILL.md file, with optional scripts and reference material. The package teaches an agent how to perform a task or work in a domain. Anthropic developed the approach through Claude Code after finding that general model capability often lacked the procedural knowledge needed for real business work.

The format is accessible and easy to inspect, which helped it spread. Anthropic says developers published thousands of skills within weeks of the October 2025 launch. Simplicity also means security cannot depend on the format itself. A readable instruction file may still direct an agent to execute unsafe scripts, disclose data or trust malicious content.

Adoption now spans more than 70 agent platforms

Anthropic reports that ChatGPT, Cursor, GitHub Copilot and Visual Studio Code are among more than 70 platforms supporting Agent Skills. It says one million skills have been published and nearly 280 million installed since the standard became public in December 2025.

Those figures show substantial ecosystem momentum, though publication and installation do not measure quality or active use. Registries and enterprise catalogues need provenance, signing, dependency review and clear compatibility metadata. Organisations should distinguish an internally approved skill from an arbitrary folder downloaded from a public repository.

Cross-company maintainers will shape the next version

Engineers from Anthropic, Google, OpenAI and other companies will maintain the standard as individuals. Anthropic names David Soria Parra and Mahesh Murag as lead maintainers. The proposed roadmap begins with versioned releases, a formal proposal process and security guidance for authors and installers.

Versioning is essential because changes to instruction interpretation, tool declarations or supporting files can affect behaviour even when a skill’s visible purpose remains the same. Runtimes should record the exact skill digest, loader version and permissions used for each consequential execution so an incident can be reproduced.

Interoperability should include safety evidence

Portable procedural packages can reduce duplicated integration work and help users carry domain workflows between agents. The strongest outcome would be a standard that supports not only loading instructions but also declaring required tools, data boundaries, tests and expected outputs in a consistent way.

The foundation should resist turning convenience into an implicit trust signal. Security review, sandboxing and least-privilege access remain runtime responsibilities. Anthropic’s donation is an important step for interoperability; its long-term value will depend on transparent governance and whether the ecosystem makes safe skills easier to identify than merely popular ones.

Production checks

For implementation, teams should record the exact model, software, connector and policy versions behind every result. Representative evaluation must include normal work, boundary cases, deliberate misuse and component failure, with outcomes separated by user role, data sensitivity and consequence. A strong average should never hide a serious failure in a critical path. Changes should pass the same regression set before promotion, and operators need a documented fallback that preserves evidence rather than silently broadening access or lowering quality.

Procurement should account for the human work required to review exceptions, maintain controls and investigate incidents. Published performance or economic claims are useful starting points, but production confidence comes from evidence collected in the organisation’s own environment. A named owner, measurable acceptance threshold, cost model and tested shutdown path turn a promising release into a service that can be governed over time. Where decisions affect safety, rights, money or regulated records, accountable professional review remains essential.

Security review should map every identity, credential, network destination, stored artefact and administrative access path involved in the workflow. Logs need enough context to reconstruct who initiated an action, which evidence was consulted, what the system proposed and what ultimately executed. Sensitive prompts and traces should not be retained merely because they are useful for debugging. Retention, redaction and access must follow the underlying data classification, with a practical process for correcting or removing material when policy or law requires it.

Operational monitoring should measure quality and service behaviour together. Latency, throughput and availability matter, but so do unsupported claims, missed constraints, unsafe tool calls and the rate at which people overturn recommendations. Teams should rehearse dependency outages and partial failures before unattended operation. If a model, connector or external service becomes unavailable, the workflow should fail predictably, preserve its state and tell the user what remains unfinished. Clear degradation is safer than an agent improvising around a missing control.

Finally, organisations should publish the scope and limitations of the deployed capability to the people affected by it. Users need to know when automation is involved, how to challenge an outcome and where a human can intervene. That transparency improves feedback and prevents a pilot result from being interpreted as blanket approval for broader autonomy. Expansion should follow demonstrated evidence, not novelty or pressure to match a competitor announcement.