The Agent Skills Open Standard - Specification, Adoption, and the Governance Gap

In under a year, Agent Skills went from an Anthropic engineering blog post to an open standard with its own specification site, reference validator, and a client list that reads like a census of the agent ecosystem. The format is now stewarded at agentskills.io, developed in the open on GitHub, and supported by more than forty agent products - coding agents, IDEs, data platforms, infrastructure agents, even healthcare automation. If your organization runs AI agents at all, it almost certainly runs software that loads skills.

That is worth a security team's full attention, because the standard's greatest strength - a skill written once runs everywhere - is also the property that turns one malicious folder into an ecosystem-wide payload. This guide walks through what the specification actually defines, who has adopted it, where skills are heading, and the governance gap the standard deliberately leaves open. If you need the foundational concepts first, start with what are AI agent skills - a security primer.

What the standard defines

The specification is deliberately minimal, and Anthropic's engineering team is explicit that the simplicity is the point: a simple format is easier for organizations, developers, and end users to build on. A skill is a directory containing, at minimum, a SKILL.md file. That file opens with YAML frontmatter and continues with free-form markdown instructions. Everything else is optional: a scripts/ directory for executable code, references/ for documentation the agent reads on demand, assets/ for templates and data files.

my-skill/
├── SKILL.md          # Required: metadata + instructions
├── scripts/          # Optional: executable code
├── references/       # Optional: documentation
├── assets/           # Optional: templates, resources
└── ...               # Any additional files or directories

The frontmatter carries the skill's identity, and it is the layer every vetting and inventory decision keys off - which makes its constraints, and its gaps, security-relevant.

The body of SKILL.md has no format restrictions at all: whatever prose helps the agent do the task. The spec recommends keeping it under 500 lines and pushing detail into referenced files. A reference library, skills-ref, validates naming and frontmatter - it checks that a skill is well-formed, not that it is safe.

How agents load skills: progressive disclosure

Skills scale because agents load them in three stages. At startup, an agent reads only each skill's name and description - about 100 tokens per skill. When a task matches a description, the agent pulls the full SKILL.md body into context; the spec recommends keeping that under 5,000 tokens. Bundled scripts and reference files load or execute only when the task actually calls for them. Anthropic's engineering post makes the consequence explicit: because agents with filesystem access load resources on demand, the context a skill can bundle is effectively unbounded.

• Discovery - name and description load for every installed skill at startup, so the agent knows what it could do.
• Activation - when a task matches, the full SKILL.md instructions enter the agent's context.
• Execution - the agent follows the instructions, running bundled scripts and reading referenced files as needed.

Two implications follow. First, skills split into what practitioners call static and dynamic: instruction-only skills that work purely through in-context guidance, and skills that bundle executable code the agent invokes. Anthropic recommends bundling code where determinism or efficiency matters - a script sorts a list better than tokens do. Second, and less comfortably: most of a skill's content is invisible until the moment it runs. A reviewer who reads only what loads at startup has reviewed roughly 100 tokens of a package that may contain thousands of lines of prose and code. Point-in-time review of the visible layer is not coverage, a problem we detail in the vetting and approval playbook for agent skills.

Who has adopted it: the ecosystem is the surface

The client showcase at agentskills.io lists more than forty products, and the spread matters more than the count. This is no longer a coding-assistant feature; skills now load in IDEs, terminals, data warehouses, CI systems, and cloud agent platforms.

For a defender, three consequences fall out of this list. First, coverage math changed: a skills policy scoped to one agent product now covers a sliver of the surface, because the same folder loads everywhere. Second, blast radius changed: a compromised skill shared in a team channel can land in Cursor on one laptop, Claude Code on another, and a Databricks workspace in between. Third, discovery got harder: skills arrive through git clones, marketplace installs, and dotfile syncs across dozens of products with no common install registry. That is the same bottom-up dynamic we mapped in AI agents are the new shadow IT, now with a standard file format accelerating it.

Skills, MCP, and rules: three layers, one agent

Skills did not replace the other extension mechanisms; they completed a stack. Anthropic frames skills as complementary to MCP - MCP connects agents to external tools and data through a typed protocol, while skills teach the multi-step workflows that use those tools. Static rules files sit below both, setting always-on guidance.

The stack composes in the attacker's favor as well as the operator's. A skill does not need its own network tooling if the agent already holds an MCP server that can reach the target system: the skill's markdown just instructs the agent to use it. Security researchers describe this as MCP amplification - a compromised instruction layer orchestrating trusted tool connections, up to and including remote code execution. It is one more instance of the pattern in indirect prompt injection explained: the payload is prose, and the tools were already authorized.

The governance gap the standard ships with

Read the specification with a supply-chain lens and the most striking thing is what is absent. There is no signing. There is no attestation of who authored a skill or whether it changed since review. There is no lockfile pinning a skill's contents, no mandatory review gate, and no central registry with takedown authority. The one permission-shaped field, allowed-tools, is labeled experimental with support that varies by implementation - meaning the same skill can be constrained in one agent and unconstrained in another.

This is not an oversight; it is a design choice that kept the format simple enough to win adoption, and the ecosystem is candid about the consequences. Anthropic's engineering guidance warns plainly that malicious skills may introduce vulnerabilities in the environment where they run or direct the agent to exfiltrate data, and tells users to audit bundled files, dependencies, and any instructions that point the agent at external network connections. The ecosystem has already demonstrated the failure mode at scale: the ClawHavoc campaign seeded hundreds of credential harvesters through a skill marketplace, covered in the OpenClaw security crisis, and academic work has shown hidden payloads passing marketplace review in malicious agent skills.

So the honest reading of the standard is: it defines what a skill is, and it hands the trust problem to you. Every control that matters - inventory, vetting, least privilege, runtime enforcement, audit - lives outside the format, in the runtime and in the organization. The controls themselves are covered across this cluster: the OWASP Agentic Skills Top 10 for the risk taxonomy, least privilege for agent skills for scoping, and scan-time tooling like NVIDIA SkillSpector for static vetting. Our own contribution on the research side is the Skill Risk Index, where Anomity publishes scan results for the most popular public skills.

Where skills are heading: hosted agents and durable sessions

The standard's next chapter is not on the laptop. Anthropic's Managed Agents architecture describes long-horizon agent work running as hosted sessions, with the design decoupled into three replaceable parts: the session (an append-only, durably stored log of every event), the harness or brain (the stateless loop calling the model and routing tool calls), and the sandbox or hands (the execution environment, which can be a container, a phone, or anything that answers an execute call). Credentials never enter the sandbox: repositories are cloned with bundled auth during setup, and OAuth tokens live in a vault reached through a proxy, so prompt-injected code cannot steal what was never there.

Two lessons transfer directly to skills governance. First, the append-only session log is what auditability looks like when agents act autonomously: every event recorded, durable, and queryable after the fact - the property you need when a skill did something unexpected three days ago, and the same requirement we set out in the AI agent audit trail guide. Second, skills are becoming a fleet-plus-cloud problem: the same SKILL.md that loads in a developer's terminal today will load in hosted sandboxes tomorrow, and a governance program scoped to endpoints alone will develop the same blind spot endpoints were, one layer up.

What security teams should do with the standard

1. Inventory first. Enumerate every installed skill across every skills-compatible product on every endpoint - not just one agent's skills directory. Start from how to build an AI agent inventory.
2. Treat frontmatter as untrusted input. Names, descriptions, and metadata are unverified strings that steer agent behavior and vetting decisions alike. Lookalike names and activation-bait descriptions are cheap attacks.
3. Vet both layers, then keep watching. Static review must read the prose as seriously as the code, and a green verdict expires on the next update. Pair scan-time vetting with continuous change detection per the vetting playbook.
4. Do not lean on allowed-tools. It is experimental and enforcement varies by agent. Runtime least privilege has to come from the agent's own permission hooks and your policy layer, per least privilege for agent skills.
5. Demand an audit trail. Whether the skill ran on a laptop or in a hosted session, you need a durable record of what was installed, what changed, and what each tool call did.

Where Anomity fits

Anomity's principle is the one this whole analysis lands on: you can't govern what you can't see. The standard guarantees skills will be everywhere; it guarantees nothing about your visibility into them. Anomity's lightweight, unprivileged Endpoint Sensor runs on Windows, macOS, and Linux and discovers eight AI artifact types - AI agents, MCP servers, extensions, plugins, skills, secrets, hooks, and CLIs - across every skills-compatible product on the endpoint, not one vendor's directory. For each skill it records source, owner, version, and reach.

The sensor sends metadata only over HTTPS - never skill source, never prompts - and redacts secrets on the endpoint. On agents that expose a hook, such as Claude Code's PreToolUse, Anomity evaluates each tool call a skill triggers and returns allow, deny, or log before it runs, which is exactly the enforcement point the experimental allowed-tools field cannot yet guarantee. Update drift surfaces as a change event, violations route to your SIEM, Slack, email, and Jira, and every skill added, removed, or modified lands in a queryable 90-day audit trail. Anomity is SOC 2 Type II and complements your EDR/XDR, DLP, network controls, and GRC rather than replacing them.

You can't govern what you can't see.The Anomity principle

The bottom line

Agent Skills won. A format Anthropic released as an open standard is now the shared capability layer of the agent ecosystem, from Cursor and Copilot to Snowflake and Pulumi, and it is heading into hosted agent platforms next. The specification is elegant and deliberately minimal - and that minimalism means every trust decision is yours: nothing in the format verifies authorship, pins contents, or enforces permissions consistently across runtimes. Standardization made skills portable for everyone, attackers included. Inventory what is installed, vet both the code and the prose, enforce at the agent's hooks, and keep a durable audit trail. To see every skill across your fleet, book a 30-minute demo.