Anthropic donates Agent Skills to the Linux Foundation's Agentic AI Foundation
Anthropic has handed Agent Skills to the AAIF under the Linux Foundation, giving the standard a vendor-neutral home alongside MCP.
On 22 October 2026, Anthropic announced that it is donating Agent Skills to the Agentic AI Foundation (AAIF), the Linux Foundation body that already stewards the Model Context Protocol (MCP). The donation covers the Agent Skills name and logo, the GitHub organisation, and the agentskills.io domain. The standard will be maintained by engineers from Anthropic, Google, OpenAI, and other companies, working in a personal capacity rather than as company representatives.
What is Agent Skills?
Agent Skills is an open standard that gives AI agents structured, reusable knowledge and workflows for specific tasks. A skill lives in a folder containing a SKILL.md file with a name, a description, and plain-language instructions, plus any optional scripts or assets. Agents work in three stages: they read only names and descriptions at startup, pull in the full SKILL.md when a task matches, and then execute any bundled code.
Anthropic developed the format while building Claude Code, after finding that general model knowledge was often not sufficient for procedural, business-specific tasks. The standard was opened for cross-platform use in December 2025, and adoption came quickly. By October 2026, more than 70 platforms had integrated it, including ChatGPT, Cursor, GitHub Copilot, and VS Code. One million skills have been published, and nearly 280 million have been installed.
As Boris Cherny of Anthropic put it: “Agent Skills started as an experiment in Claude Code. Many across the industry have come to adopt it, so we at Anthropic found it more fitting to donate it to the AAIF, next to MCP.”
Why the AAIF, and why now?
The AAIF was co-founded in December 2025 by Anthropic, Block, and OpenAI under the Linux Foundation, with Google, Microsoft, Amazon Web Services, Bloomberg, and Cloudflare among the top-tier members at launch. Anthropic had already donated MCP to the foundation, so placing Agent Skills there too is a logical pairing. MCP defines how agents connect to external tools and data; Agent Skills defines how agents accomplish specific tasks. Together they form two complementary pillars of the same ecosystem.
The announcement was made at the AGNTCon + MCPCon North America conference in San Jose, alongside three other new projects joining the foundation: OpenAI’s Open Responses, Hugging Face’s OpenEnv, and Alibaba’s OpenSandbox. The AAIF now hosts 10 projects and counts 305 member organisations.
The practical reason for the move is straightforward. A standard that runs on 70-plus platforms and has been installed nearly 280 million times is no longer an Anthropic experiment; it is shared infrastructure. Keeping it under a single vendor’s name and GitHub organisation creates unnecessary friction for contributors and potential adopters who reasonably worry about direction-setting by one company. Moving it to the AAIF removes that concern.
What changes, and what does not
Nothing in existing SKILL.md files needs to change. The file format stays the same. The donation changes governance, not the specification itself.
What is new is a proposed roadmap that covers three things worth paying attention to:
Versioned releases. At the moment, a skill declares little more than a name and a description, and when the specification evolves there is no reliable way to know which agent supports which fields. Numbered versions, similar to how APIs are versioned, would let skill authors state which revision they are targeting. That matters as the format grows more capable.
A formal proposal process. Changes to the specification will go through a documented, community-visible process rather than being made internally at Anthropic. David Soria Parra and Mahesh Murag are named Lead Maintainers, with final say on changes. Soria Parra is one of the two original authors of MCP, which gives some continuity between the two standards.
Security guidance. This is the part worth watching most closely. A Snyk study published in February 2026 analysed 3,984 skills and found 76 containing malicious code, and the Cloud Security Alliance has published a research note on SKILL.md and agent context poisoning. The risk is structural: a skill runs with the same permissions as the agent, meaning it can read files and use whatever credentials the agent holds. Because instructions are plain natural language rather than executable code, a malicious instruction hidden in a SKILL.md is harder to spot than a virus in a compiled programme. A standard adopted across 70-plus platforms means a bad skill is now a cross-vendor supply chain problem. Formal security guidance is overdue.
What this means for you
If you write or maintain skills: nothing needs to change on 22 October 2026. The specification is still published on agentskills.io and the code is still on GitHub under an Apache-2.0 licence (CC-BY-4.0 for documentation). You do not need to join the AAIF to use or contribute to the standard. The roadmap does signal that versioning is coming, so it is worth keeping an eye on the formal proposal process if you are building on top of the format.
If you are building a platform or product that integrates Agent Skills: vendor-neutral governance makes it easier to justify a long-term bet on the standard. The AAIF Governing Board handles strategic decisions and budget, while individual projects retain full autonomy over technical direction and day-to-day operations, so the standard is not going to be quietly redirected by any single company.
If you are thinking about security: take the Snyk findings seriously. The roadmap acknowledges the gap, but guidance is not yet published. Until it is, treat installed skills with the same scrutiny you would apply to a third-party dependency. Review SKILL.md files before installation, and pay attention to what permissions your agent is running with.
The broader signal here is that agentic AI is moving from experimentation into something closer to enterprise infrastructure. Standards bodies, formal governance, and security research are the things that show up when a technology stops being a prototype and starts being something organisations depend on. Agent Skills joining MCP at the AAIF is a marker of that shift.