Agent Skills standard donated to the Agentic AI Foundation: what to check

post-thumb

On 22 October 2026, Anthropic announced the donation of the Agent Skills standard to the Agentic AI Foundation (AAIF), which sits under the Linux Foundation. The Linux Foundation announced it the same day, along with other projects covered below.

For teams that write and keep their own agent instructions, the Agent Skills standard now has a stated neutral host. That changes who is meant to steward the format. It says nothing about what your own skills do or whether they are safe. Below is what moved, what did not, and a short review worth doing soon.

What was announced on 22 October

Anthropic’s post says the donation covers the Agent Skills name and logo, the GitHub organization, and the agentskills.io domain. The post does not walk through each handover step. The donation itself is announced as happening now. The format is defined in the Agent Skills specification, which is short enough to read in one sitting.

The Linux Foundation also announced Open Responses, OpenEnv and OpenSandbox. Open Responses is a specification for multi-provider model interfaces, based on OpenAI’s Responses API. OpenEnv is a framework for creating reinforcement learning environments. OpenSandbox is a sandbox platform for AI applications, created at Alibaba. The release says they address different layers of the agentic stack. They are separate projects, not a single product.

Anthropic says engineers from several companies will maintain the standard as individuals, with David Soria Parra and Mahesh Murag as Lead Maintainers.

Anthropic has also proposed a roadmap. It includes versioned releases, a formal process for proposing changes, and security guidance for people who write and install skills. These are proposals, and the post gives no dates.

What neutral hosting does and does not tell you

The Linux Foundation describes AAIF governance as open and vendor-neutral. That is the intent. Independence shows up over time, in who makes decisions and how disagreements get settled. An announcement made days ago cannot show it yet. Anthropic’s Agent Skills format started inside one company, and Anthropic’s own post names the Lead Maintainers, so the proposal process is worth watching once it exists.

Safety is a separate question. Neither announcement says skills are reviewed, certified or approved, and neither mentions a certification program or security attestation for the format. Security guidance is only proposed. Anthropic’s original launch post from October 2025 already warned that skills can run code, and it told users to stick to trusted sources.

Ownership is a third question. The announcements do not say who owns the skills your team writes. That depends on your employment terms, your contracts and the licenses on any material you include. If it matters, ask your legal team. A governance change is not an answer.

What the Agent Skills standard carries, and what stays behind

A skill is a folder with one required file, SKILL.md. The file opens with a short YAML header holding a name and a description, followed by instructions in Markdown. The name must match the folder name. Optional folders hold scripts, reference documents and assets such as templates and data files.

An optional compatibility field is free text for environment needs. The allowed-tools field is marked experimental, and the spec says support varies between tools. Which script languages run depends on the tool.

A tool that supports the open Agent Skills standard can read a package. Moving a skill cleanly between tools is another matter, and nothing in the spec guarantees it. The format does not transfer or authenticate credentials. It does not set up connections or promise that a script runs the same way on two platforms. It also says nothing about output quality, which will vary with the tool and model running the skill.

A skill is just files, and files can hold secrets if someone puts them there. Never pack passwords, keys or tokens into a skill folder.

Written into the packageNot carried by the format
Your instructions in SKILL.mdLive connections to other systems
Optional scripts, references and assets, as filesCredentials and who is allowed to use them
An optional compatibility noteThe environment that runs scripts, and whether it allows them
The folder structure and header fieldsOutput quality on any given tool

Keep control of the instructions and the dependencies

The value in a good skill is the thinking written into it: the steps, the checks, the rules your team follows. If non-engineers on your team write the skills, there is no reason to stop. The case for keeping skill authorship with the people who know the work does not depend on who hosts the format. For background on agent skills, see our existing guide.

Dependencies are where skills break when they move. A skill that calls an external system needs that connection to exist on the other side. Autohive’s documentation describes connections running on workspace-authenticated actions rather than credentials stored inside the skill. It also says scripts run in a sandbox, and Autohive says its skills are based on the open Agent Skills standard.

Instruction text is the part most likely to carry over to another tool that supports the format. Connections still need to be set up and checked.

A short review to do soon

Three habits are enough, and none needs a long checklist.

  1. Name a business owner for each skill. Pick someone who knows the work and can say when the steps are out of date. Note who wrote the skill and which terms apply to it.
  2. Keep the instruction text and dependency list somewhere your business controls, with version history. Keep the dependency list separate from the instructions. It should name the systems a skill calls and who sets up access.
  3. Trial before you rely on it. If portability matters, try one low-risk skill on another host with test data and limited access. Check the output against figures you already know.

A hypothetical example, not a real customer case: an operations team has a monthly supplier report skill. The written steps are candidates for reuse on another supporting tool. The step that pulls figures from the finance system will not move on its own. That connection has to be rebuilt, and the report should be checked against known figures on the new tool before anyone depends on it.

Common questions

Do we need to join the AAIF to use Agent Skills?

Anthropic says you can use or contribute to the standard without joining the AAIF. Using the format and joining the foundation are separate decisions. If your business wants a formal role in the project, check the AAIF’s own membership terms, which the announcements summarized here do not cover.

Do we need to rewrite our existing skills?

Nothing in the announcements calls for a rewrite. The proposed roadmap has no dates. Review later changes when they are published, and base any rewrite now on your own needs or known problems. The donation alone gives no reason to rebuild a working skill.

The takeaway

A neutral host is the stated aim of this move, and over time it may lower the risk of building on the format. It does not settle who owns your instructions or make your connections work. Spend an hour listing your skills, their owners and their dependencies. That list is useful whatever the roadmap does.

Sources checked 26 October 2026: Anthropic announcement, Linux Foundation AAIF press release, Agent Skills specification at agentskills.io, Anthropic’s October 2025 Skills launch post and Autohive documentation.

You may also like