Anthropic has donated Agent Skills to the Agentic AI Foundation, the Linux Foundation project it co-founded with Block and OpenAI in December 2025. The transfer covers the name, logo, GitHub organization and the agentskills.io domain, with David Soria Parra and Mahesh Murag as lead maintainers. Anthropic reports 1 million skills published, nearly 280 million installs and more than 70 integrating platforms, including ChatGPT, Cursor, GitHub Copilot and VS Code. Security guidance for skill authors and installers sits on the roadmap rather than in the spec, which matters: an arXiv audit of 42,447 community skills found at least one vulnerability in 26.1% of them. Treat installing a third-party skill the way you’d treat installing an unreviewed npm package.
The donation Anthropic announced today is narrow in substance and large in signal. What moves is the name, the logo, the GitHub organization and the agentskills.io domain. What stays is an ecosystem that already grew to roughly 280 million installs under Anthropic’s stewardship, plus a security story that the announcement itself files under future work.
Agent Skills is a simple format: a folder with a SKILL.md file that gives an agent specialized knowledge and a workflow to follow. It shipped as a Claude-only feature on 16 October 2025, 371 days ago. Two months later Anthropic opened it as a cross-platform standard at agentskills.io. Adoption followed fast: Codex, OpenCode, Cursor, GitHub Copilot, VS Code and ChatGPT among more than 70 platforms.
The second donation follows the same route as MCP
The Agentic AI Foundation was founded on 9 December 2025 under the Linux Foundation by Anthropic, Block and OpenAI. Each arrived with a donation: MCP from Anthropic, Goose from Block, AGENTS.md from OpenAI. The foundation’s pitch was technical steering committees and no unilateral vendor control.
Agent Skills is Anthropic’s second handover, and the sequence is now recognizable. Ship a Claude feature, publish it as an open standard once other vendors want it, then move governance to a neutral home once adoption makes vendor ownership awkward. Simon Willison, writing today, reads the move as keeping the standard “open, community-driven, and vendor-neutral,” and raises no objection to it.
One caveat on the word “donation.” Anthropic engineers remain among the listed maintainers, alongside staff from Google and OpenAI. The legal and organizational home changed; who writes the spec day to day looks much the same. No source makes that criticism, so take it as reading between the maintainer names rather than a finding.
A quarter of community skills carry a vulnerability
The roadmap Anthropic published lists versioned releases, a formal proposal process, and security guidance for skill writers and installers. That third item is the one to watch, because the research is already in and it is unflattering.
An arXiv study, Agent Skills for Large Language Models, audited 42,447 community-contributed skills and found at least one vulnerability in 26.1% of them, about 11,080 skills. The categories are what you’d expect from a format whose entire job is injecting instructions into an agent’s context: prompt injection, data exfiltration in 13.3% of cases, and privilege escalation in 11.8%.
The sharpest finding is about packaging. Skills that bundle executable scripts are 2.12x more likely to be vulnerable than instruction-only skills, at p<0.001. The same work confirmed 157 malicious skills carrying 632 vulnerabilities between them, roughly four each. One operator accounted for 54.1% of confirmed malicious cases, working through templated brand impersonation at volume.
A skill is executable trust. It lands in the agent’s context with the authority of an instruction, and if it ships scripts, it lands with the authority of code. A marketplace install is a supply-chain decision, taken while the standard’s own security guidance is still listed as future work.
That gap is the honest complication in an otherwise clean governance story. Vendor neutrality fixes who controls the trademark. It does nothing about 280 million installs of content nobody reviewed, and a foundation spreading authority across technical steering committees is not obviously faster at shipping security requirements than a single company would have been.
What skill authors should do before the guidance lands
The growth numbers predate the donation, so nothing about how you publish a skill changed today. Versioned releases and a proposal process will change it, once they exist.
Until then the defensive posture is unglamorous and well understood from package ecosystems:
- Read the
SKILL.mdbefore installing, including anything it tells the agent to fetch at runtime, as we covered when a fake skill passed every scanner by swapping the docs page it pointed at. - Review any skill that bundles scripts as code, with the scrutiny you’d give a dependency.
- Pin to a known-good version where the platform lets you, and expect brand impersonation on anything that looks official.
- Scope the agent’s credentials to what the task needs, since exfiltration was the second most common flaw in the audit.
The open question is pace. Anthropic lists the guidance as coming; whether the AAIF has anything published on skill security isn’t confirmed, and the install count keeps climbing in the meantime.
Sources: Donating Agent Skills to the Agentic AI Foundation • Agent Skills for Large Language Models (arXiv 2602.12430v4) • OpenAI, Anthropic, and Block join new Linux Foundation effort
Coverage: Simon Willison on the donation • Anthropic makes agent Skills an open standard
Related on this blog: Agent Harnesses: A Standard for a Word Nobody Agrees On • The Payload Was Never in the Package • AISI Names Eight Technical Priorities for Frontier Labs, and Asks Nicely