On October 22, Anthropic donated Agent Skills, the open standard that gives AI agents specialized knowledge and workflows, to the Agentic AI Foundation. That sentence is short, and it moves something larger than a feature: the standard's name and logo, its GitHub organization, and the agentskills.io domain now sit with a neutral foundation rather than with the company that created them. For developers, two things follow. Skills become a genuinely portable capability unit across agent platforms, and every skill you install becomes a set of instructions and scripts that your agent will execute, which makes source and content review part of adoption rather than an afterthought.
The details below come from the official donation announcement, published October 22, 2026. The specification itself lives at agentskills.io; verify both against their current pages when you build.
What a skill actually is
The announcement's definition is deliberately plain, and it is worth keeping that plainness:
A skill is a folder containing a SKILL.md file that teaches an agent a specific task or domain, along with any scripts or reference material it needs.
That is the whole shape, and the SKILL.md format is deliberately plain: a folder, a markdown file that describes the task or domain, and whatever supporting material the job requires. It is a convention for packaging procedural knowledge, not an SDK that you install as a library. The distinction matters when you audit one: you are reading instructions that an agent will follow and, where present, executable material that an agent may run.
The origin story in the announcement explains why the format looks like that. Anthropic developed skills while working on Claude Code, which handled general knowledge work well but often lacked the procedural knowledge that real business tasks need. The format is the answer to that gap: write the procedure down once, in a form an agent can load.
Why this is a governance change, not a product release
The announcement frames the move in three commitments: keeping Agent Skills open, community-driven, and vendor-neutral. The mechanics behind those words are specific.
The standard goes to the Agentic AI Foundation (AAIF) under the Linux Foundation, which Anthropic co-founded with Block and OpenAI, and to which the company previously donated the Model Context Protocol. The AAIF will provide a neutral home for the standard, ensuring the community has a say in where Agent Skills goes next. The donation includes the Agent Skills name and logo, the GitHub organization, and the agentskills.io domain. The announcement also notes that you can continue to use the standard or contribute to it without joining the AAIF.
Maintenance changes shape as well. Engineers from Anthropic, Google, OpenAI, and other companies will maintain the standard as individuals, with David Soria Parra and Mahesh Murag as Lead Maintainers. That is the structural difference between a vendor-owned format and a foundation standard: the people maintaining it are acting as individuals in a shared project, not as representatives signing off on a company roadmap. The announcement's own framing, agent interoperability through simplicity, is the design thesis: one folder convention any agent can load, with no bespoke interface per vendor.
The adoption evidence, as published
The announcement gives its own numbers, and they are worth stating with their source attached. More than 70 agent platforms, including ChatGPT, Cursor, GitHub Copilot, and VS Code, have integrated Agent Skills since the standard was published in December 2025. Within weeks of the October 2025 Claude Code launch, developers published skills on GitHub and wrote loaders for Codex, Cursor, and OpenCode. So far, 1 million skills have been published and nearly 280 million installed, according to the announcement.
Read those figures as adoption evidence, not as a quality signal. A million published skills and a large install count say the format is easy to produce and easy to distribute; they say nothing about whether any individual skill is correct, safe, or appropriate for your environment. For a team evaluating one package, popularity is not review: the numbers describe the size of the ecosystem, not the quality of the thing you are about to run. If anything, the distribution numbers raise the value of the review step described below.
If your setup spans several of these agents, the wiring for running them against one endpoint is covered in the shared-key setup guide, and the provider-side configuration for Codex specifically is in the custom provider guide.
What comes next, per the roadmap proposal
The announcement describes a proposed starting roadmap with three items: versioned releases, a formal proposal process, and security guidance for people who write and install skills. It also commits to the same operating style as MCP: community input and transparent decision-making, with a Discord for feedback on proposed specification changes, the specification at agentskills.io, and discussion on GitHub.
Two of those items deserve emphasis. Versioned releases give the standard a compatibility story, which matters the moment your skills depend on format details. And the explicit pairing of security guidance with authors and installers is a signal about how the project sees the format: not as inert documentation, but as something that needs a safety model on both sides of publication.
What builders should do with this
Three moves cover the practical surface.
Use. Confirm that the agent tooling you rely on actually supports skills before planning around them, and check how your tool loads them. The set of integrations is broad, but support levels differ by product and version, and the announcement's list is a statement about integration, not a guarantee about your installed build.
Write. The most reliable trigger for writing a skill is repetition: if you have explained the same procedure to an agent more than a couple of times, that procedure is a candidate for a SKILL.md with the scripts and references it needs. Before trusting the result in production, run it through the same validation discipline you apply to prompt and model changes, which the testing guide covers. If the skill runs inside CI, the pipeline patterns are in the CI guide.
Audit. A skill is instructions plus, often, executable material. Treat it like any third-party dependency: check where it came from, read what the scripts do, and confirm what permissions and data access it needs before an agent runs it. The logging discipline that makes this auditable after the fact, including recording which capabilities actually ran, is in the observability guide.
The supply-chain point, stated plainly
The format's strength and its risk are the same property: a skill is a manual that an agent will execute. That is why skills are useful; it is also why installing one from an unknown source is not a neutral act. The official roadmap listing security guidance for authors and installers confirms that the project treats this as a real concern rather than a hypothetical one.
Until that guidance lands, three checks carry most of the weight. First, provenance: who published the skill, and is there a repository with history you can inspect. Second, content: do the scripts do what the description says, and do they reach the network, the filesystem, or credentials beyond what the task needs. Third, blast radius: what can this skill touch if it behaves badly, and does the agent's permission model limit that reach. Skills whose scripts invoke tools widen the surface further; the production discipline for tool loops is in the tool calling guide.
None of this argues against adopting skills. It argues for adopting them the way you adopt code.
The checklist
- Confirm your agent tooling supports skills, and note how it loads them.
- Pick one procedure your team has explained repeatedly and write it as a SKILL.md.
- Run the skill locally and in CI once before relying on it.
- Check the source, the scripts, and the permissions a skill requests.
- Pin the version you have reviewed, and re-review on updates.
- Record which skills are installed and where they came from.
- Follow the proposal process and the security guidance as they publish.
- Remove skills nobody uses; an unused skill is surface area with no benefit.
A standard moving to a neutral foundation is usually a quiet event. This one is worth noticing because it changes what skills are for: a portable unit of procedural knowledge that any participating agent can load. Portability raises the ceiling; the audit step keeps the floor from falling out. Read the specification at agentskills.io, follow the discussion on GitHub, and verify every detail against the official pages current at build time.