Agent Skills Standard Moves to Neutral Governance: What to Check

Anthropic announced on October 22, 2026 that it is donating Agent Skills — the open standard that packages how an AI agent should do a specific job — to the Agentic AI Foundation under the Linux Foundation. It is the second standard Anthropic has handed to that foundation, after the Model Context Protocol. Three other donations landed the same day. The announcement itself requires no changes to existing conforming skills. The immediate change is stewardship, not the format — and for businesses, the question is how much long-term dependence on one vendor that removes.

Key takeaways

• The standard now has a neutral owner. Anthropic is transferring the Agent Skills name and logo, the GitHub organization and the agentskills.io domain to the foundation, per Donating Agent Skills to the Agentic AI Foundation.
• Adoption is already broad, by the donor's own count. More than 70 agent platforms have integrated the standard since December 2025, with 1 million skills published and nearly 280 million installed — figures reported by Anthropic and not independently verified, per the same announcement.
• A skill is a folder, not a platform. A required SKILL.md file, plus optional scripts, references and assets, designed to load on demand, per Agent Skills just became infrastructure. A portable skill file is not the same thing as a portable workflow.

What actually changed on October 22

The immediate change is governance, not the file format. Anthropic co-founded the foundation with Block and OpenAI, and had already donated the Model Context Protocol (MCP) to it. The two standards solve different problems: Agent Skills packages procedural instructions; MCP provides a standardized way to connect agents with external tools and data. Engineers from Anthropic, Google, OpenAI and other companies will now maintain Agent Skills as individuals, with David Soria Parra and Mahesh Murag as lead maintainers. Anyone can use or contribute to the standard without joining the foundation, per Donating Agent Skills to the Agentic AI Foundation.

Agent Skills did not arrive alone. The foundation announced four new projects in total, taking it from three hosted projects at launch in December 2025 to ten. Alongside Agent Skills came Open Responses from OpenAI, OpenEnv from Hugging Face and OpenSandbox from Alibaba, per Agentic AI Foundation Announces Four New Projects: Agent Skills, Open Responses, OpenEnv, and OpenSandbox. Read together, the four cover distinct layers: how an agent gains a capability, how an application talks to models across providers, how agents are trained and evaluated, and where agents run safely, per the same announcement.

The four projects address separate parts of the agent stack. Common specifications may reduce integration work, but they do not demonstrate seamless interchangeability — businesses still need to verify implementation compatibility.

A skill is a folder, not a platform

The format is deliberately plain. Anthropic built skills while working on Claude Code, which handled general knowledge work well but lacked the procedural knowledge real business tasks require. Within weeks of the October 2025 launch, developers had published thousands of skills and written loaders for other tools; Anthropic published the format as an open standard in December 2025, per Anthropic donates Agent Skills to the Agentic AI Foundation.

In practice, your procedure becomes a file an agent reads on demand: steps, house format, checks that must never be skipped, an example of good output. The specification requires two frontmatter fields — name and description — per Agent Skills. The description tells compatible agents what the skill does and when to use it, so a vague description means a good procedure that never triggers, per Agent Skills just became infrastructure.

That is a different asset from a prompt buried in one tool's settings. The procedure can live in a repository your team controls, versioned and reviewed — although its execution may still depend on platform-specific tools and permissions. Portability has three separate dimensions: format (another tool can recognize the skill), execution (that tool has the scripts, access and runtime the skill needs), and behavior (it produces acceptable results on the same test cases). A valid SKILL.md proves only the first.

The security debt that travels with portability

Neutral governance reduces dependence on one vendor's stewardship. It does not remove the supply-chain risks of installing third-party skills. A shared format makes skills easier to publish, share and install — including skills written by strangers. A skill is text an agent may follow, and it can bundle scripts the agent will run. Independent analysis makes the point directly: a bad skill is now a cross-platform supply-chain problem, not a problem contained inside one tool, per Agent Skills Moves to the Agentic AI Foundation: What Changes.

Anthropic's own proposed roadmap acknowledges this: it covers versioned releases, a formal proposal process, and security guidance for people who write and install skills, per Donating Agent Skills to the Agentic AI Foundation. Until formal guidance is available, review third-party skills as untrusted instructions and, where included, executable code — and enforce permissions outside the skill itself, because a skill's instructions are not an enforcement mechanism. A plain-language explainer reaches the same conclusion: shared standards reduce lock-in, but governance still has to be watched over time, per AAIF Explained: Anthropic, OpenAI Donate AI Agent Standards.

Two cautions belong on the record. First, the adoption figures here are the donor's and have not been independently verified. Second, support depth varies: a valid skill may still behave differently in each tool that loads it, and some fields remain experimental. Portable does not yet mean identical.

What this means for your business

1. Inventory first, then build one skill. Do not rebuild everything this week — the announcement requires no changes. List the procedures your agents already follow, where each one is stored, and who owns it. Then pick the workflow your team explains to an agent again and again — a report in your format, a review checklist, a document extraction with fixed fields — and write it once as a SKILL.md with steps, an example input and output, and the edge cases people forget.

2. Keep skills in your own repository, under version control. If your procedures live only inside one vendor's configuration, switching tools means rewriting them. As folders you own, a platform change may require less rewriting — but it still needs compatibility testing. Review a skill change like a runbook change: named owner, diff, reason. Decide in advance which layers must stay movable — usually procedures and data — and which you are comfortable renting from a single provider, and write that down before a renewal, not during one.

3. Audit third-party skills, and enforce the boundary outside them. Read the SKILL.md and open the scripts folder before an agent runs a skill you did not write. Look for downloads piped straight into execution, credential reads broader than the task needs, or instructions to skip approvals. Pin the version you reviewed. Then enforce the real controls in the runtime: restrict which credentials an agent can reach, limit network access, control which executable tools it may call, and require human approval for sensitive operations.

4. Test portability as a measurable pilot, not a claim. Test each priority skill in two supported platforms using identical inputs. Score task completion, output correctness, policy violations, manual corrections, and every platform-specific modification you had to make. That record is one concrete measure of your portability cost — and it is cheaper to learn on one workflow than on fifty.

Documenting, versioning and testing those procedures is the immediate work. Neutral stewardship strengthens the case for keeping them outside any single vendor's configuration — in a format designed to outlive any single tool.

Want an independent review of which of your procedures should become portable agent skills, and where the security controls need to sit? Get a free AI audit — we'll map your highest-leverage automation opportunities in one session.