Ten projects, and not one of them is a trust boundary

At a glance

AAIF launched in December 2025 as a directed fund under the Linux Foundation, co-founded by Anthropic, Block and OpenAI, with three projects. The four added on 22 October 2026, announced at AGNTCon + MCPCon North America in San Jose, bring it to ten in its first year.

What actually moved

For Agent Skills specifically, Anthropic donated the name and logo, the GitHub organisation and the agentskills.io domain. Engineers from Anthropic, Google, OpenAI and other companies will maintain it as individuals; David Soria Parra and Mahesh Murag are named Lead Maintainers. Anthropic has proposed a roadmap of versioned releases, a formal proposal process, and security guidance for people who write and install skills. Using or contributing to the standard does not require AAIF membership.

That is a real transfer of control, not a press release. The domain and the GitHub org are the two things that would let one company unilaterally redefine the format or fork the community out of it, and giving them up is the part that costs something. The same move worked for MCP, which Anthropic donated at AAIF's founding and which has since shipped spec revisions driven by maintainers rather than by one vendor's product calendar.

The numbers Anthropic published alongside the donation are the context for everything below. Agent Skills launched in October 2025 and was published as a standard that December. Since then: more than 70 agent platforms have integrated it, among them ChatGPT, Cursor, GitHub Copilot and VS Code; about one million skills have been published; and nearly 280 million have been installed.

A format is not a trust boundary

A specification can say three kinds of thing. It can describe a wire format or a file layout — this is what a skill folder looks like, this is what a tool call looks like. It can mandate a protocol behaviour — you must send this header, you must reject this request. And it can impose a requirement on an implementer that has security consequences, which is the category MCP eventually reached when its spec started forbidding named anti-patterns.

What a specification cannot do is make the admission decision. Admission is the question of whether this particular artefact, from this particular publisher, at this particular revision is allowed to load into a context that holds your credentials. That decision is made by a host at install time, it depends on facts the format does not carry, and nothing in a standard can take it over — because the standard's whole job is to make the artefact work identically everywhere, which is the opposite of discriminating between sources.

So portability and admission pull against each other in a specific way. The more successful the format, the more hosts load artefacts written for it, and the wider the reach of any single malicious artefact becomes. Standardisation is leverage, and leverage is directionless. A skill that works in one client because both sides implement the spec correctly works in seventy because they all do.

The install base arrived before the guidance

Two published audits give a sense of what is already in circulation, and they are worth reading with their methods attached rather than as headline percentages.

The scale study. Agent Skills in the Wild (arXiv 2601.10338) collected 42,447 skills from two marketplaces in December 2025 and analysed 31,132 after deduplication, along with 3,574 bundled executable scripts. Its tool, SkillScan, combines static analysis with LLM classification, calibrated against 500 hand-annotated skills. The finding: 26.1% — 8,126 skills — carried at least one of fourteen dangerous patterns, split into 12.8% low severity (poor practice), 8.1% medium (ambiguous intent) and 5.2% high severity suggesting malicious intent. A follow-up reports that skills bundling executable scripts are 2.12 times more likely to contain a vulnerability than instruction-only skills (odds ratio 2.12, p<0.001).

The campaign. In late January 2026, Koi Security audited 2,857 skills on the ClawHub registry and found 341 malicious ones, of which 335 belonged to a single campaign — ClawHavoc — that delivered the Atomic Stealer macOS infostealer. The delivery mechanism is the detail that matters here: the malicious instruction sat in a fake prerequisites section of SKILL.md, instructing the agent to run an installer. Not obfuscated code in a bundled script. Prose, in the file whose entire purpose is to be read and acted on.

Put those two together and the shape of the problem is clear. The dangerous surface is not one file. A skill's instructions are executed by a model that was built to follow instructions, and a skill's scripts are executed by a shell. Both are live. Which means "review the skill" is not a well-defined action unless you also say which revision you reviewed — and a skill folder has no version field. We worked through what a usable review actually looks like in vetting a third-party skill.

The counter-argument, which is a good one

MCP is the reason to be optimistic, and it should be stated properly rather than waved at. MCP went to AAIF in December 2025 with a comparable problem: a fast-growing ecosystem of third-party servers, no trust model, and a set of attacks that the spec did not address. Its later revisions did address them — the spec came to forbid confused-deputy delegation, token passthrough, session hijacking and several other patterns by name, which is exactly the third category of specification statement above, and it happened under foundation stewardship rather than despite it. The site's notes on MCP security anti-patterns and the OAuth 2.1 profile are a record of a standard acquiring teeth.

So the honest claim is not that a foundation cannot deliver security requirements. It is that MCP needed roughly a year of revisions to get there, that the requirements landed on server implementers rather than on the registry that distributes them, and that the gap between "we have a neutral home" and "the spec says no to something" is measured in quarters. Agent Skills has a proposed roadmap and a Discord thread for feedback. That is the right start and it is not a control.

There is also a structural difference that makes skills harder than MCP. An MCP server is a service you point at, with a URL, an identity and an operator you can revoke. A skill is a folder you copy. There is no endpoint to deauthorise, no token to revoke, no operator on the other end — just files already sitting in a repository, loaded by whichever agent next matches the task description.

Where the boundary has to live in the meantime

Three places can carry the decision, and they fail differently. Publisher identity refuses an unknown author and cannot tell you whether a known author's latest push is safe. Artefact contents — the scan — refuses the patterns it has signatures for, and expires the moment the folder changes, which it may do without a version bump. Runtime capability refuses the action rather than the artefact: if a loaded skill cannot reach the network or spawn a shell, what it says becomes much less interesting. Only the third is robust to an artefact changing under you, and it is the one no spec in the list of ten provides, because capability is a property of the host.

Which points at the practical conclusion. Standardisation has given you portability at every layer; it has given you nothing at the admission layer, and the install base is already large enough that a retrofitted convention will take years to cover it. Until a spec says otherwise, the agent runtime you operate is the only trust boundary in the stack, and it should be configured as though every loaded artefact were third-party content — because increasingly it is.

What to actually do

• Pin skills to a commit, not a name. A folder with no version field cannot be re-reviewed by comparison. Vendor the ones you depend on into your own repository and take updates as reviewable diffs, the same way you treat pinning and verification for anything else.
• Treat the instructions as executable. Review SKILL.md prose with the same attention as a bundled script. The largest campaign to date delivered its payload through a prerequisites section, because the model is the interpreter.
• Give loaded skills a capability budget, not a trust level. Network egress, shell access and credential reach are the three that convert an instruction into an incident. Egress control is the one with the best ratio of effort to coverage.
• Keep an inventory of what is installed where. Nearly 280 million installs is an ecosystem-level number; yours is a number you can know. If you cannot currently produce it, that is the first gap.
• Read the roadmap as a forward-looking statement. Versioned releases and security guidance are proposed, not shipped. Plan for the version of the format that exists now.

The donation itself is good news and deserves to be read as such. Four more layers of the agent stack now have a neutral owner, which is strictly better than four more layers owned by whoever shipped them first, and the people maintaining them are doing it as individuals rather than as delegates. The gap is narrower than "this is unsafe" and more durable than a news cycle: a portable format multiplies whatever you load through it, and the decision about what to load is still, entirely, yours.

Further reading

On this wiki:

• Vetting a third-party skill — what a usable install-time review looks like.
• Agent skills — what the format is and why the description line decides everything.
• Skills vs subagents vs MCP vs hooks — choosing between the mechanisms these specs cover.
• MCP security anti-patterns — the precedent for a spec that eventually said no.
• Agent supply-chain security — the class of problem all of this sits inside.
• User-authored skills — the same hazard inside your own product.
• Agent interoperability — why the standardisation push exists at all.

Sources:

• Anthropic — Donating Agent Skills to the Agentic AI Foundation (22 October 2026)
• Linux Foundation — Agentic AI Foundation announces four new projects (22 October 2026)
• Model Context Protocol blog — MCP joins the Agentic AI Foundation (9 December 2025)
• arXiv 2601.10338 — Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale
• The Hacker News — Researchers find 341 malicious ClawHub skills (Koi Security audit)
• Agentic AI Foundation — Projects