Agent Skills Moves to the Agentic AI Foundation: What Changes

Anthropic donated the Agent Skills standard to the Agentic AI Foundation on October 22, 2026. The short version: nothing in your SKILL.md files has to change today, but the format now has a vendor-neutral home, a promised roadmap, and a security gap that the roadmap names directly. The practical move is to audit what your skills tell an agent to run, because a neutral standard makes skills easier to share and so easier to inherit from strangers.

Last updated: October 22, 2026

What the primary sources say#

Anthropic's announcement says it is donating Agent Skills, the open standard that gives agents specialized knowledge and workflows, to the AAIF under the Linux Foundation. The donation covers the name and logo, the GitHub organization and the agentskills.io domain. These are the claims Anthropic makes, and all of them are vendor-reported:

• More than 70 agent platforms, including ChatGPT, Cursor, GitHub Copilot and VS Code, have integrated Agent Skills since the standard was published in December 2025.
• One million skills have been published and nearly 280 million installed.
• Engineers from Anthropic, Google, OpenAI and other companies will maintain the standard as individuals, with David Soria Parra and Mahesh Murag as Lead Maintainers.
• The proposed starting roadmap is versioned releases, a formal proposal process, and security guidance for people who write and install skills.

The AAIF press release puts it in context. Agent Skills is one of four new projects announced at AGNTCon + MCPCon North America, alongside Open Responses from OpenAI, OpenEnv from Hugging Face and OpenSandbox from Alibaba. That brings the foundation to 10 hosted projects, up from three at launch in December 2025. It joins A2A, Agent Router, agentgateway, AGENTS.md, goose and MCP.

What did not change: the format. The specification still describes a directory with a required SKILL.md, and name and description as the only required frontmatter fields. If you wrote skills last month, they are valid today.

The angle: a pattern, not a one-off#

The Stratechery move is to read this alongside the earlier donation. Anthropic gave MCP to the same foundation less than a year ago, and now gives it the other half of the agent stack. MCP gives agents live access to tools and data; skills give them packaged procedure. Together they are the two things a developer actually installs into an agent. Both now sit under a body that OpenAI, Google and Block can say they helped govern.

Who wins. Teams that write skills once and run them in several harnesses. A skill is a folder of markdown and scripts, so the cost of being portable is low, and neutral governance lowers the risk that one vendor edits the format under you. Open standards also help the harnesses that are not Claude Code: Codex, Cursor and opencode all benefit from not having to follow a competitor's spec.

Who loses. Anyone whose moat was owning the skill format. Registries and marketplaces now compete on curation, trust and install experience rather than on a proprietary packaging layer. Anthropic keeping the lead maintainer seats softens that for now, since the people who wrote the spec still steer it.

Second-order effect. Skills that run everywhere get installed everywhere, so a bad skill is now a cross-vendor supply chain problem. The roadmap line about security guidance is the part worth watching. We covered the broader version of this in agent config files as an executable supply chain.

What a builder does Monday#

There is no new command to learn, which is the point. Do two checks.

1. Validate your frontmatter against the spec. The specification page lists the rules: name is 1-64 characters, lowercase letters, numbers and hyphens only, no leading, trailing or consecutive hyphens, and it must match the parent directory name. description is required and up to 1024 characters. Optional fields are license, compatibility, metadata and the experimental allowed-tools. A minimal valid file, copied from the spec's own example:

---
name: skill-name
description: A description of what this skill does and when to use it.
---

The spec points to a reference validator. The command below is copied from the spec page, not run for this post, so check the skills-ref README in the agentskills repository before wiring it into CI:

skills-ref validate ./my-skill

2. Read what your skills tell the agent to run. A skill is text your agent obeys. Open each SKILL.md and scripts/ folder you did not write and look for a download piped into a shell, a read of an entire .env file when one variable would do, or an instruction to turn off permission prompts. The independent scan in the next section found exactly those patterns in popular repositories, so your inherited skills are a reasonable place to start. Keep secrets out of reach as well; the setup is in keeping secrets away from AI coding agents.

If you are deciding how to govern a shared skills folder across a team, Agent Skills are becoming package managers covers pinning and review. And if your repo also serves other agents, note that Claude Code now reads AGENTS.md, another AAIF project, so the same foundation now governs two of the files an agent reads before it touches your code.

What people are actually saying#

The conversation is thin because the announcement is hours old. The Hacker News submission of Anthropic's post had 3 points and no comments when I checked, so there is no verdict to report. The useful practitioner signal is adjacent:

• The security read. The Agent Forge published a scan of 9,930 public SKILL.md files from 277 GitHub repositories and posted it to Hacker News, where it had 1 point and no comments. It reports no malware found by its method, 30 flagged ordinary files (0.33%), and two habits worth changing: piping a download into a shell (14 files) and reading an agent's whole key file to get one API key (8 files). It hand-reviewed all 30 flags, and 26 were real patterns with no sign of malice.
• The counter-case. The scanner's makers disclose they offer it free and hope you use it, and they say it can be evaded by splitting a payload across files or fetching it at run time. A clear result is not proof a skill is safe, and a low flag rate on public repositories says little about private or newly published ones.
• The builders. A Show HN for Skillstore, a library of skills served through an MCP server so agents load them on demand, shows where the ecosystem is heading: skills discovered at run time, not copied in by hand. It is one maker's pitch, not evidence of adoption.

If a larger thread forms, treat it as the better source on how maintainers and users read the governance change.

Continue Reading#

• MCP vs Agent Skills: when to use which - the decision rule for the two halves of the stack
• Agent Skills are becoming package managers - governing the instructions your agents inherit
• Claude Code now reads AGENTS.md - the other AAIF file your agent reads
• Agent config files are an executable supply chain - why a skill is a security decision
• Claude Files API and Skills API are GA - the hosted side of skills on Claude

Sources#

• Anthropic: Donating Agent Skills to the Agentic AI Foundation - October 22, 2026
• AAIF: four new projects announcement (PR Newswire) - October 22, 2026
• Agent Skills specification
• The Agent Forge: What 9,930 public agent skills tell your agent to do - October 19, 2026
• Hacker News: Anthropic donation submission
• Hacker News: skill scan submission
• Hacker News: Show HN Skillstore