Agent Skills moves to the Agentic AI Foundation

On October 22, Anthropic announced it is donating Agent Skills to the Agentic AI Foundation (AAIF), the Linux Foundation project it co-founded with Block and OpenAI, and the same body that already holds the Model Context Protocol. This is not a new model or a new capability. It changes who governs a format that many agent builders already rely on.

What shipped

Anthropic is handing over the Agent Skills name and logo, the GitHub organization, and the agentskills.io domain. According to the announcement, the standard will be maintained by engineers from Anthropic, Google, OpenAI and other companies acting as individuals, with David Soria Parra and Mahesh Murag as Lead Maintainers. You do not need to join the AAIF to use the standard or contribute to it.

The proposed first roadmap covers three things: versioned releases, a formal proposal process, and security guidance for people who write and install skills. Feedback on spec changes goes through the project's Discord and GitHub.

The adoption numbers in the post are large. More than 70 agent platforms, including ChatGPT, Cursor, GitHub Copilot and VS Code, have integrated Agent Skills since the standard was published in December 2025. Anthropic reports about 1 million skills published and nearly 280 million installs.

Why the format spread

A skill is a folder. At its center is a SKILL.md file: YAML frontmatter with a required name and description, each subject to constraints set out in the specification, followed by Markdown instructions that teach an agent a specific task or domain. The folder can also carry whatever scripts and reference material that task needs. The spec defines a few optional fields too, including an experimental allowed-tools field, but the required surface is small.

Anthropic's account of the origin is a familiar one. Claude Code handled general knowledge work well but lacked the procedural knowledge real business tasks need: how this team cuts a release, how this report is formatted, which script renders this artifact. Model weights don't hold that knowledge. It lives in runbooks and in people's heads. Skills give it a file layout an agent can find, load on demand and execute.

The format is simple enough that other runtimes could adopt it without asking anyone. Within weeks of the October 2025 launch, developers had written loaders for Codex, Cursor and OpenCode. That's the usual way a de facto standard forms. A plain format beats a richer one that needs an SDK.

Why governance matters here

Once a format is everywhere, the remaining risk is about control, not technology. If one vendor owns a spec, every other implementer carries a quiet worry that the spec will drift toward that vendor's runtime. Moving the trademark, the repository and the domain to a neutral foundation can reduce that risk, but it does not remove vendor influence. The maintainers still work at the companies that ship the major runtimes, and how neutral the project stays will depend on how the proposal process is run in practice. It is the same move MCP made, and putting both in one home makes sense. MCP covers how an agent reaches tools and data. Skills cover how an agent knows what to do with them.

For teams building on skills, the potential benefit is that writing a skill becomes a safer long-term investment. Neutral governance and versioned releases could make it more likely that a skill written today for one agent keeps working in another next year. That outcome still depends on each runtime implementing the spec faithfully, which no foundation can guarantee.

My take

The donation itself is the smaller part of this announcement. The part I care about is the roadmap, specifically the security guidance. A skill does not need to ship scripts to be risky. Its instructions alone can steer an agent toward unsafe tool use, such as reading secrets, sending data to an external endpoint or running shell commands with whatever access the agent already has. Bundled scripts add executable code on top of that. The install figure does not tell us how many skills carried scripts, how many of those scripts ran, or whether the agents involved held credentials, but the exposure surface is clearly large. The spec as published does not define provenance or signing, and its only permission-scoping mechanism is the experimental allowed-tools field, whose enforcement is left to each runtime. A neutral body is a reasonable place to set shared norms, though foundation guidance only binds implementers to the extent they choose to adopt it.

Versioning comes a close second. A spec with this many implementers and no version numbers is a compatibility problem waiting to happen.

My advice is to keep writing skills the way you do now: small, procedural, one task per folder. Watch the proposal process, and treat all third-party skill content as untrusted, whether it ships scripts or only instructions. Read the SKILL.md as carefully as any bundled code, and limit the tools and credentials an agent holds while it runs a skill you did not write. The specification is at agentskills.io.