Agent Skills in 2026: Portable, Popular, Unmeasured

On August 6, 2026, the Agent Plugins Technical Steering Committee published Agent Plugins 1.0, a vendor-neutral package format that lets a single directory carry both agent skills and MCP server configuration across five agent clients.¹ It arrives under eight months after Anthropic published the Agent Skills format itself as an open standard, on December 18, 2025.² Neither specification says anything about whether the skill inside the package is any good — and on current evidence, that is the variable that decides everything.

In one line: Agent skills are portable across dozens of AI agents, but portability is not efficacy. A paired benchmark found curated skills lift pass rates 16.6 points, while a scan of 31,132 marketplace skills found 26.1% carrying a vulnerability — what is inside a skill matters more than how it ships.

TL;DR

• Agent Plugins 1.0 (August 6, 2026) standardizes exactly two component types — Agent Skills and MCP servers — inside one directory with a plugin.json manifest. Five clients support it: VS Code, Cursor, GitHub Copilot, ChatGPT & Codex, and Kiro.¹³
• All five of those clients are shipped by organizations that co-authored the specification. That is normal for a three-day-old spec, but it means the client count currently measures author commitment, not third-party adoption.
• The spec deliberately puts distribution, runtime permissions, and trust outside its scope. In its own words, "finding a package is also not the same as trusting or executing it."¹
• SkillsBench, an 87-task paired benchmark, found curated skills raise average pass rates from 33.9% to 50.5% — +16.6 percentage points — with per-configuration gains between +4.1 and +25.7 pp.⁴
• Microsoft Research's SkillOpt trains the skill file itself and reports +23.5 points for GPT-5.5 in direct chat on a different six-benchmark suite. The two figures are not comparable, and this post does not stack them.⁵⁶
• A scan of 31,132 marketplace skills found 26.1% with at least one vulnerability, and skills bundling executable scripts were 2.12x likelier to be affected than instruction-only ones.⁷

What you'll learn

• What Agent Plugins 1.0 actually standardizes, and what it refuses to
• Whether agent skills measurably improve agent performance, and by how much
• What a trained skill is worth on its own benchmark suite
• Why an argument for portable packaging turned up in a paper about optimization
• How much of the public skills supply carries security problems
• Which parts of the trust problem are genuinely solved, and which are not
• What to do differently if you ship agents for a living

What Agent Plugins 1.0 actually standardizes

Agent Plugins 1.0 defines a directory layout and a manifest, and almost nothing else. A plugin is a folder containing plugin.json, an optional skills/ directory holding one or more SKILL.md packages, an optional mcp.json describing MCP servers, and optional reverse-domain namespaces such as com.example.client/ that a single vendor can use for anything outside the shared contract. The minimal manifest is two lines: a $schema pointer and a name.¹

The announcement calls the file structure "the contract." Compatible clients read the manifest, look for skills in the fixed location, read MCP configuration from the fixed location, and ignore any namespace they do not implement. That is the entire interoperability surface — what the announcement describes as "a small interoperability floor."¹

The restraint is the design. Client ecosystems are currently experimenting with agents, commands, hooks, rules, and UI extensions, and 1.0 leaves all of them out because they "do not yet have consistent semantics or security models across clients." The project also declines to promise more later: "No additional component type is committed for a future release."¹

It was built by representatives from Amazon, Cursor, Microsoft, OpenAI, and Vercel, whom the specification site describes as the "initial Technical Steering Committee."⁸ Google announced on the same day that it is joining that committee as a core maintainer; the roster on the specification site had not been updated to reflect it when retrieved for this article.

One governance detail deserves stating precisely, because coverage tends to blur it: the announcement ran on the Agentic AI Foundation's blog as a community guest post, and its own callout says Agent Plugins "is an independently governed open specification. It is not an AAIF project and has not submitted a proposal to become one."¹ It is not, at time of writing, a Linux Foundation project the way MCP is.

The five clients, and who ships them

Every client currently listed supports the Agent Skills component type. The variation is in MCP transports.³

Two things follow from that table. First, every client on it comes from an organization on the steering committee — four distinct organizations, since Microsoft ships two and Vercel ships none. No implementation from outside the authoring group appears on the list, which is unremarkable for a specification three days old but does mean the client count currently measures author commitment rather than ecosystem uptake. Second, Codex is the only one of the five that does not list legacy SSE, which given MCP's move toward a stateless core reads as forward-leaning rather than as a gap.

The page notes that clients "can adopt portable component types incrementally," so this table is a snapshot of a moving list rather than a stable capability matrix.

What the spec deliberately leaves out

Three things sit explicitly outside Agent Plugins 1.0, under a heading the announcement titles "What remains client-owned": distribution (registries, marketplaces, installation, updates), runtime experience (permissions, approval flows, sandboxing, user interface), and trust (publisher identity, provenance, signatures, organizational policy).¹

This is defensible design. HTTP does not define certificate policy; PKI does. A package format that also tried to settle a trust model would plausibly have shipped later and spread more slowly. The authors are candid about the boundary: "Finding a package is also not the same as trusting or executing it: publisher verification, provenance, approval, sandboxing, and runtime policy remain separate responsibilities."¹

So the interesting question is not whether Agent Plugins covers trust — it says it does not — but whether the layers it delegates to have picked it up. For MCP servers, partly yes. For skills, much less so. That is worked through below, after the efficacy evidence that makes it matter.

Do agent skills actually work?

Curated ones do, by a measured margin. SkillsBench, whose latest revision landed on June 14, 2026, is a benchmark of 87 tasks across 8 domains, each paired with a curated skill and a deterministic verifier. Running all 87 tasks under matched no-skills and curated-skills conditions across 18 model-harness configurations, the average pass rate rose from 33.9% to 50.5% — a gain of 16.6 percentage points.⁴

Two secondary findings are more actionable than the headline:

• Configuration-level gains ranged from +4.1 to +25.7 percentage points. All 18 configurations improved, with a factor of six between the smallest and largest gain. Note the level of aggregation: these are per-configuration averages over 87 tasks. The abstract reports no per-task deltas, so it does not establish that every individual task improved — only that every configuration did on average. Nothing here licenses assuming a skill helps on your particular task.
• Focused skills with at most three modules outperformed larger or exhaustive bundles. The instinct to cram every edge case into one SKILL.md is measurably counterproductive.

The paper also reports that smaller models equipped with skills can match larger models without them — a substitution effect that turns up again, independently, in the optimization literature below.

The methodological point SkillsBench is really making sits in its framing: it describes paired evaluation as "the foundation for rigorous measurement of Skill efficacy on agentic, expertise-heavy work," which is a polite way of saying its authors found no standard way to check whether any of this helped. Anthropic shipped the format on October 16, 2025; the first version of this benchmark for it appeared on February 13, 2026, roughly four months later.⁴² Measurement lagged adoption, and the gap has never really closed.

What a trained skill is worth

Microsoft Research's SkillOpt, published on the MSR blog on June 30, 2026, asks a different question: not "does a skill help?" but "what happens if you train it?"⁵

The setup treats the skill file as a trainable parameter sitting outside a frozen target model. A separate optimizer model reads scored rollouts, proposes bounded add, delete, and replace edits to a single skill document, and an edit is accepted only when it strictly improves a held-out validation score. A textual learning-rate budget caps edits per step, a rejected-edit buffer feeds failures back as negative signal, and an epoch-wise slow update consolidates longer-horizon lessons. All of it happens at training time — the authors report the method adds "zero inference-time model calls at deployment."⁶

Across 6 benchmarks, 7 target models, and 3 execution modes, SkillOpt reports best or tied-best results on all 52 evaluated model-benchmark-harness cells — 52 being the combinations actually run, not the full cross-product — against human-written skills, one-shot LLM-generated skills, and four prior methods including GEPA and TextGrad.⁵⁶ For GPT-5.5, the gains over no skill were +23.5 points in direct chat (58.8 to 82.3), +24.8 inside Codex, and +19.1 inside Claude Code.⁵

The artifact economics are the part worth internalizing. The deployed file, best_skill.md, has a median length of roughly 920 tokens across the paper's six case studies, and because the validation gate rejects most proposals, only one to four edits are accepted into the final version. One benchmark's 39.0-point gain came from a single accepted edit.⁵ Whatever a skill is, it is not a large object, and its value is not proportional to its length.

Two caveats belong next to those numbers. First, this is a vendor-run evaluation: Microsoft evaluating Microsoft's method, with the competing baselines configured by the same authors. "Best or tied-best in all 52 cells" is the kind of clean sweep that warrants independent replication before it becomes a planning assumption. Second, and more importantly:

The SkillsBench and SkillOpt numbers are not on the same axis, and this post does not stack them. SkillsBench runs 87 agentic, expertise-heavy tasks; SkillOpt runs SearchQA, SpreadsheetBench, OfficeQA, DocVQA, LiveMathematicianBench and ALFWorld. Different suites, different baselines, different harnesses. Reading them as a ladder — "curated is worth 16, trained is worth 23" — would be wrong. What the two jointly establish is narrower and still useful: two independent groups, on unrelated task sets, found double-digit percentage-point swings attributable to the contents of a markdown file. The variance lives in the skill, not the packaging.

The transfer result that bears on package formats

SkillOpt's transfer experiments contain an argument for portable skill packaging that the paper itself never makes — Microsoft presents it as evidence about what its optimizer learns, not as a case for a package format.

A spreadsheet skill trained inside Codex, then dropped into Claude Code with no further optimization, lifted the no-skill baseline from 22.1 to 81.8 — a gain of 59.7 points. That is slightly above the 80.4 achieved by training the skill directly inside Claude Code.⁵ The two harnesses expose different tool surfaces, which is why the authors read this as evidence the method learns general workflow logic rather than harness-specific recipes.

If that generalizes, portability is not a convenience feature: a skill would be a genuinely transferable asset whose value survives a change of runtime, which is the premise Agent Plugins 1.0 is built on, arrived at from the opposite direction. As OpenAI's Nick Cooper put it in the Agent Plugins announcement, "Useful capabilities should be able to travel across agents."¹

The hedge matters here. This is one reported skill on one benchmark pair, described as "the clearest example" of transfer rather than as an average, and it beats its own native-training control by 1.4 points on a benchmark where scores swing by more than 40. Treat it as a promising single observation, not a rule.

Agent skills security: about a quarter of the sampled supply

A January 2026 study collected 42,447 skills from two major marketplaces and systematically analyzed 31,132 of them with a detection pipeline combining static analysis and LLM-based semantic classification. It found 26.1% contained at least one vulnerability, spanning 14 distinct patterns across four categories: prompt injection, data exfiltration, privilege escalation, and supply chain risk.⁷

The most operationally useful number is not a percentage but an odds ratio: skills that bundle executable scripts were 2.12x likelier to contain a vulnerability than instruction-only skills (OR = 2.12, p < 0.001).⁷ That maps cleanly onto a distinction the format itself makes — a SKILL.md with a scripts/ directory is a different risk object from one without, and it is visible from the file tree before you install anything. The authors' own conclusion is that the ecosystem needs "capability-based permission systems and mandatory security vetting."⁷

Three qualifications keep this honest. The detection method reports 86.7% precision and 82.5% recall, so 26.1% is a detector-dependent estimate, not a census. The sample covers two marketplaces as of January 2026, not the products on any showcase today. And it is prevalence across a published corpus, not across installs — the OSS Insight analysis cited below notes the long tail of published skills is "vast and largely unused," so exposure-weighted risk is plausibly lower.⁹

None of this surprised the people who shipped the format. Anthropic's own launch post carries the warning in plain language: "this feature gives Claude access to execute code. While powerful, it means being mindful about which skills you use — stick to trusted sources to keep your data safe."² Anthropic authored the format and operates the showcase, so it is not a neutral party here; it is also the party that said the quiet thing first.

Which parts of trust are actually solved

Here is where a lazy version of this argument goes wrong. It is tempting to say the stack has no trust layer at all. It does — just not where skills live, and not doing the job people assume.

The MCP Registry performs real publisher verification. Server names use a reverse-DNS format such as io.github.username/server, and the registry's namespace authentication "ensures that only the legitimate owner of a GitHub account or domain can publish servers under that namespace, providing trust and accountability in the ecosystem."¹⁰ That is the publisher identity half of the "publisher identity, provenance, signatures" concern Agent Plugins hands off, and somebody picked it up. Provenance attestation and signing are not part of it.

But read the next section of the same page. The registry "delegates security scanning" to the underlying package registries and to downstream aggregators, and describes itself as focusing "on namespace authentication and metadata hosting, while relying on the broader ecosystem for security scanning of actual server code."¹⁰ It is also still in preview, and it indexes MCP servers — not skills. There is no equivalent registry-level identity layer for SKILL.md packages.

So the accurate version of the gap is narrower and more useful than "nobody is doing trust":

• Who published it is partly solved, for MCP servers, by registry namespace verification.
• Whether the code is safe is delegated at every layer — the registry to package registries and aggregators, Agent Plugins to clients, Anthropic's guidance to the user's judgment about "trusted sources."
• Whether the skill actually helps your task is not a trust question at all, and no signature can answer it. That is what SkillsBench exists to measure, and it has to be re-run per model, per harness, per task.

The third will not yield to a specification. Publisher identity is a solvable coordination problem; efficacy is not a coordination problem at all.

The supply is large, concentrated, and widely redundant

A February 2026 analysis of 40,285 publicly listed skills from a major marketplace found publication happens "in short bursts that track shifts in community attention," that content is "highly concentrated in software engineering workflows," and that the ecosystem shows "strong ecosystem homogeneity, with widespread intent-level redundancy" alongside a "pronounced supply-demand imbalance across categories." It also flags "non-trivial safety risks, including skills that enable state-changing or system-level actions" — a second safety signal, from a different corpus than the January scan.¹¹

The GitHub-side picture, as measured by OSS Insight on March 24, 2026, showed the skills-collection category taking on 250,000 stars in ten weeks, with 57,000+ AGENTS.md files, 21,000+ CLAUDE.md files, and 31,000+ skill definitions under .claude/skills/ across public repositories.⁹ Those figures are roughly four and a half months old and describe the first-quarter surge, not a current count. OSS Insight is the analytics arm of a commercial database vendor and the piece is a first-person opinion essay built on its own telemetry — a well-instrumented argument rather than a neutral data release.

Its argument still cuts against the tidy reading of Agent Plugins. OSS Insight identified a format war — "Claude Code reads CLAUDE.md and .claude/skills/. Codex reads AGENTS.md. Cursor does its own thing" — and Agent Plugins does not settle it. That war is about instruction-file conventions; Agent Plugins standardizes the package around a skill, not the instruction file inside it. The convention question OSS Insight raised is still open.

Its sharper point is that skills are not stable objects: they "break when the model changes," and a file that worked with one model generation "might behave differently" with the next "not because the file changed, but because the model's interpretation of it did."⁹ If that is right, efficacy is a function of skill, model, harness and ambient context together — and no static certification could exist even in principle.

Skills, MCP, and Agent Plugins: which layer does what

The three specifications are complementary rather than competing. The Agent Plugins announcement lays out the division in a table of its own, reproduced here as published:¹

The top three rows name specifications with maintainers and version numbers. The bottom two name categories of actor — and as the MCP Registry shows, one of those categories now has an occupant, for servers at least. That is an actor volunteering, not a specification assigning. It mirrors what happened when the IETF began examining agent protocols earlier this year: transport and format standardize quickly because they are tractable; trust standardizes slowly because it is organizational as much as technical.

For context on where the format started, Anthropic shipped Agent Skills on October 16, 2025 and published it as an open standard for cross-platform portability on December 18, 2025, alongside organization-wide skill management and a partner directory.² Our earlier walkthrough of what Claude Skills are and how they load covers the mechanics. The official showcase lists 44 products supporting the format when retrieved for this article, from Claude Code and Codex to Gemini CLI, Goose, Snowflake Cortex Code and Pulumi Neo — a curated showcase of self-reported support maintained by the project, not a census.¹²

What this means if you ship agents

Five things follow from the evidence above, and none require waiting for a new specification.

Treat a skill as code you own, not content you install. The efficacy research measures curated and trained skills; nothing in it licenses assuming an arbitrary marketplace skill carries the same value. Vendor the skill into your repository, read it, and review it on the same cadence as the rest of your code.

Check for a scripts/ directory first. The 2.12x odds ratio is one of the cheapest security signals available, and it is visible from the file tree before installation.

Keep skills short and specific. SkillsBench found focused skills of at most three modules beating exhaustive bundles, and SkillOpt's median trained artifact was around 920 tokens built from one to four accepted edits. Both point the same direction.

Build the verifier before the skill. Both efficacy results depend on a deterministic check — SkillsBench pairs every task with a verifier, SkillOpt gates every edit on a held-out validation score. Without one you cannot distinguish an improvement from a regression, which is the failure mode SkillOpt was built around: skills that "grow longer and drift with each rewrite" while a plausible-looking revision quietly degrades performance.⁵

Re-run that verifier on every model upgrade. A skill's value is a property of its interaction with a specific model and harness, and both change under you. Pin the skill, pin the model, and treat a model upgrade as a change requiring re-measurement.

The bottom line

Agent Plugins 1.0 closes a real gap. As of August 6, 2026, a skill and its MCP server can ship as one package and load in five major agent clients — all of them, for now, built by the specification's own authors. Combined with the Agent Skills standard from December 2025 and MCP before it, moving a capability between agents is close to a settled problem.

Knowing whether the capability is worth moving is not. A curated skill was worth about 17 percentage points of pass rate on the one benchmark built to check; roughly a quarter of a published corpus carried a detected security defect; and the trust machinery that exists verifies who published an MCP server, not whether a skill is safe or effective. Some of that is a real gap. Some of it is a category error to expect from a package format at all — no signature can certify that a markdown file will still help after the next model release.

The practical version is short. The format layer is finished enough to build on. The measurement layer is yours, it does not come in the package, and it has a shelf life.