Agent Skills in 2026: Portable Now, Verified Rarely

On August 6, 2026, the Agent Plugins Technical Steering Committee published Agent Plugins 1.0, a vendor-neutral package format that lets a single directory carry both agent skills and MCP server configuration across five agent clients.¹ It is the second open specification in under eight months aimed at making agent skills travel between products, after Anthropic published the Agent Skills format itself as an open standard on December 18, 2025.² Neither of them says anything about whether the skill inside the package is any good.

In one line: Agent skills are now portable across dozens of AI agents, but portability is not efficacy. Benchmarks show curated skills lift agent pass rates by 16.6 percentage points while a quarter of marketplace skills carry at least one security vulnerability — so the skill's provenance matters more than its packaging.

TL;DR

• Agent Plugins 1.0 (August 6, 2026) standardizes exactly two component types — Agent Skills and MCP servers — inside one directory with a plugin.json manifest. Five clients support it: VS Code, Cursor, GitHub Copilot, ChatGPT & Codex, and Kiro.¹³
• The spec deliberately puts distribution, runtime permissions, and trust outside its scope. In its own words, "finding a package is also not the same as trusting or executing it."¹
• SkillsBench, an 87-task paired benchmark, measured what a good skill is worth: average pass rate rises from 33.9% to 50.5%, or +16.6 percentage points, with per-configuration gains between +4.1 and +25.7 pp.⁴
• Microsoft Research's SkillOpt trains the skill file itself as a parameter and reports +23.5 points for GPT-5.5 in direct chat, plus a skill trained in Codex that scored slightly higher when moved into Claude Code than one trained there natively.⁵⁶
• A scan of 31,132 marketplace skills found 26.1% containing at least one vulnerability, and skills that bundle executable scripts were 2.12x more likely to be affected than instruction-only ones.⁷

What you'll learn

• What Agent Plugins 1.0 actually standardizes, and what it refuses to
• Whether agent skills measurably improve agent performance, and by how much
• What a trained skill is worth compared to a hand-written one
• Why the strongest evidence for portable packaging came from a paper about optimization
• How much of the public skills supply carries security problems
• How Agent Skills, MCP, and Agent Plugins divide the stack between them
• What to do differently if you ship agents for a living

What Agent Plugins 1.0 actually standardizes

Agent Plugins 1.0 defines a directory layout and a manifest, and almost nothing else. A plugin is a folder containing plugin.json, an optional skills/ directory holding one or more SKILL.md packages, an optional mcp.json describing MCP servers, and optional reverse-domain namespaces such as com.example.client/ that a single vendor can use for anything outside the shared contract. The minimal manifest is two lines: a $schema pointer and a name.¹

The specification calls the file structure "the contract." Compatible clients read the manifest, look for skills in the fixed location, read MCP configuration from the fixed location, and ignore any namespace they do not implement. That is the entire interoperability surface — what the spec describes as "a small interoperability floor."¹

The restraint is the design. Client ecosystems are currently experimenting with agents, commands, hooks, rules, and UI extensions, and 1.0 leaves all of them out because they "do not yet have consistent semantics or security models across clients." The project also declines to promise more later: "No additional component type is committed for a future release."¹

It was built by representatives from Amazon, Cursor, Microsoft, OpenAI, and Vercel, with a Technical Steering Committee drawing core maintainers from each. One governance detail is worth stating precisely because coverage tends to blur it: the announcement ran on the Agentic AI Foundation's blog as a community guest post, and the post's own callout says Agent Plugins "is an independently governed open specification. It is not an AAIF project and has not submitted a proposal to become one."¹ It is not, at time of writing, a Linux Foundation project the way MCP is.

The five clients, and what each actually loads

Every client currently listed supports the Agent Skills component type. The variation is in MCP transports.³

Codex is the only one of the five that does not list legacy SSE. The page notes that clients "can adopt portable component types incrementally," so this table is a snapshot of a moving list rather than a stable capability matrix.

What the spec deliberately leaves out

Three things sit explicitly outside Agent Plugins 1.0, and the specification names them in a section headed "What remains client-owned": distribution (registries, marketplaces, installation, updates), runtime experience (permissions, approval flows, sandboxing, user interface), and trust (publisher identity, provenance, signatures, organizational policy).¹

This is defensible specification design. A package format that also tried to settle a trust model would plausibly have shipped later and been adopted more slowly. The authors are candid about the boundary: "Finding a package is also not the same as trusting or executing it: publisher verification, provenance, approval, sandboxing, and runtime policy remain separate responsibilities."¹

But it does mean something specific for anyone reading the announcement as a maturity signal. Between Agent Skills, MCP, and Agent Plugins, the ecosystem now has three well-specified layers for moving a capability between agents, and none of the three specifies how to establish that the capability works or is safe. That gap is not hypothetical, and the rest of this post is the measurement of it.

Do agent skills actually work?

Yes — curated ones do, by a measured margin. SkillsBench, whose latest revision landed on June 14, 2026, is a benchmark of 87 tasks across 8 domains, each paired with a curated skill and a deterministic verifier. Running all 87 tasks under matched no-skills and curated-skills conditions across 18 model-harness configurations, the average pass rate rose from 33.9% to 50.5% — a gain of 16.6 percentage points, or a 25.5% normalized gain.⁴

Two secondary findings are more actionable than the headline:

• Configuration-level gains ranged from +4.1 to +25.7 percentage points. The benefit is real everywhere in that sample but varies by a factor of six depending on the model and harness. A skill is not a fixed-value asset.
• Focused skills with at most three modules outperformed larger or exhaustive bundles. The instinct to cram every edge case into one SKILL.md is measurably counterproductive.

The paper also reports that smaller models equipped with skills can match larger models without them — a substitution effect that turns up again, independently, in the optimization literature below.

The methodological point SkillsBench is really making is in its framing: it describes paired evaluation as "the foundation for rigorous measurement of Skill efficacy," which is a polite way of noting that its authors found no standard way to check whether any of this helped. Anthropic shipped the format on October 16, 2025; the first version of this benchmark for it appeared on February 13, 2026, about four months later.⁴² The measurement lagged the adoption.

What a trained skill is worth

Microsoft Research's SkillOpt, published on the MSR blog on June 30, 2026, asks a different question: not "does a skill help?" but "what happens if you train it?"⁵

The setup treats the skill file as a trainable parameter sitting outside a frozen target model. A separate optimizer model reads scored rollouts, proposes bounded add, delete, and replace edits to a single skill document, and an edit is accepted only when it strictly improves a held-out validation score. A textual learning-rate budget caps edits per step, a rejected-edit buffer feeds failures back as negative signal, and an epoch-wise slow update consolidates longer-horizon lessons. Crucially, all of this happens at training time — the authors report the method adds "zero inference-time model calls at deployment."⁶

Across 6 benchmarks, 7 target models, and 3 execution modes — 52 evaluation cells — SkillOpt reports best or tied-best results in all 52, against human-written skills, one-shot LLM-generated skills, and four prior methods including GEPA and TextGrad.⁵⁶ For GPT-5.5, the gains over no skill were +23.5 points in direct chat (58.8 to 82.3), +24.8 inside Codex, and +19.1 inside Claude Code.⁵

The artifact economics are the part worth internalizing. The deployed file, best_skill.md, has a median final length of roughly 920 tokens, and because the validation gate rejects most proposals, only one to four edits are accepted into the final version. One benchmark's 39.0-point gain came from a single accepted edit.⁵ Whatever a skill is, it is not a large object, and its value is not proportional to its length.

Two caveats belong next to those numbers. First, this is a vendor-run evaluation: Microsoft evaluating Microsoft's method, with the competing baselines configured by the same authors. "Best or tied-best in all 52 cells" is the kind of clean sweep that warrants an independent replication before it becomes a planning assumption. Second, and more importantly:

The SkillsBench and SkillOpt numbers are not on the same axis. +16.6 pp and +23.5 pp come from different benchmark suites, different task mixes, and different baselines. Reading them as a ladder — "curated is worth 16, trained is worth 23" — would be wrong. What they jointly establish is narrower and still useful: two independent research groups, on unrelated task sets, found double-digit percentage-point swings attributable to the contents of a markdown file. The variance lives in the skill, not the packaging.

The transfer result that bears directly on package formats

Buried in SkillOpt's transfer experiments is an unusually strong empirical argument for portable skill packaging, and it comes from a paper that has nothing to say about packaging.

A spreadsheet skill trained inside Codex, then dropped into Claude Code with no further optimization, lifted the no-skill baseline from 22.1 to 81.8 — a gain of 59.7 points. That is slightly above the 80.4 achieved by training the skill directly inside Claude Code.⁵ The two harnesses expose different tool surfaces, which is why the authors read this as evidence the method learns general workflow logic rather than harness-specific recipes.

If that result generalizes, portability is not a convenience feature. It means a skill is a genuinely transferable asset whose value survives a change of runtime — which is exactly the premise Agent Plugins 1.0 is built on, arrived at from the opposite direction. As OpenAI's Nick Cooper put it in the Agent Plugins announcement, "Useful capabilities should be able to travel across agents."¹

The hedge: this is one reported skill on one benchmark pair, presented as "the clearest example" of transfer rather than as an average across many. A single data point that slightly exceeds its own native-training control is interesting and should not yet be treated as a rule.

Agent skills security: about a quarter of the sampled supply

A January 2026 study collected 42,447 skills from two major marketplaces and systematically analyzed 31,132 of them with a detection pipeline combining static analysis and LLM-based semantic classification. It found that 26.1% contained at least one vulnerability, spanning 14 distinct patterns across four categories: prompt injection, data exfiltration, privilege escalation, and supply chain risk.⁷

The breakdown:

The most operationally useful number is not a percentage but an odds ratio: skills that bundle executable scripts were 2.12x more likely to contain a vulnerability than instruction-only skills (OR = 2.12, p < 0.001).⁷ That maps cleanly onto the structural distinction the format itself makes — a SKILL.md with a scripts/ directory is a different risk object from one without, and it is trivial to check before installing.

Two qualifications keep this honest. The detection method reports 86.7% precision and 82.5% recall, so 26.1% is a detector-dependent estimate rather than a census. And the sample covers two marketplaces as they stood in January 2026, not the products listed on the official showcase today.

None of this is a surprise to the people who shipped the format. Anthropic's own launch post carries the warning in plain language: "this feature gives Claude access to execute code. While powerful, it means being mindful about which skills you use — stick to trusted sources to keep your data safe."² The gap is not that nobody said it. The gap is that "stick to trusted sources" is advice, and none of the three specifications above defines what makes a source trusted or who certifies it.

The supply is large, concentrated, and largely redundant

A February 2026 analysis of 40,285 publicly listed skills from a major marketplace found that publication happens "in short bursts that track shifts in community attention," that content is "highly concentrated in software engineering workflows," and that the ecosystem shows "strong ecosystem homogeneity, with widespread intent-level redundancy" alongside a "pronounced supply-demand imbalance across categories."⁸ In plain terms: thousands of people wrote roughly the same coding skills, and the categories with the most demand are not the ones with the most supply.

The GitHub-side picture, as measured by OSS Insight on March 24, 2026, showed the skills-collection category taking on 250,000 stars in ten weeks, with 57,000+ AGENTS.md files, 21,000+ CLAUDE.md files, and 31,000+ skill definitions under .claude/skills/ across public repositories. Their reading was that skills are "a transitional layer" rather than the load-bearing abstraction of the agent era.⁹ Those figures are roughly four and a half months old at time of writing and should be read as a snapshot of the first-quarter surge, not a current count.

What has changed since March is precisely the thing OSS Insight identified as unresolved: the format war. Agent Plugins 1.0 is five major vendors agreeing on a package boundary, which is a real answer to "every new agent invents slightly different conventions." What has not changed is anything downstream of the boundary.

Skills, MCP, and Agent Plugins: which layer does what

The three specifications are complementary rather than competing, and the announcement lays out the division explicitly.¹

The top three rows have specifications with named maintainers. The bottom two rows have candidates and open questions. That asymmetry is the story of agent skills in 2026, and it mirrors what happened when the IETF began examining agent protocols earlier this year: transport and format standardize quickly because they are tractable, while trust standardizes slowly because it is organizational as much as technical.

For context on where the format started, Anthropic shipped Agent Skills on October 16, 2025 and published it as an open standard for cross-platform portability on December 18, 2025, alongside organization-wide skill management and a partner directory.² Our earlier walkthrough of what Claude Skills are and how they load covers the mechanics. The official showcase now lists 44 products supporting the format, from Claude Code and Codex to Gemini CLI, Goose, Snowflake Cortex Code, and Pulumi Neo — though it is a curated showcase of self-reported support, not a census.¹⁰

What this means if you ship agents

Five things follow from the evidence above, and none of them require waiting for a new specification.

Treat a skill as code you own, not content you install. The efficacy research measures curated and trained skills. Nothing in it licenses the assumption that an arbitrary marketplace skill carries the same value, and the security scan says roughly a quarter of the sampled supply carries a defect. Vendor the skill into your repository, read it, and review it on the same cadence as the rest of your code.

Check for a scripts/ directory first. The 2.12x odds ratio is one of the cheapest security signals available, and it is visible from the file tree before you install anything.

Keep skills short and specific. SkillsBench found focused skills of at most three modules beating exhaustive bundles, and SkillOpt's median trained artifact was around 920 tokens built from one to four accepted edits. Both point the same direction.

Build the verifier before the skill. Both efficacy results depend on a deterministic check — SkillsBench pairs every task with a verifier, SkillOpt gates every edit on a held-out validation score. Without a verifier you cannot tell an improvement from a regression, which is the failure mode SkillOpt was designed around: skills that "grow longer and drift with each rewrite" while a plausible-looking revision quietly degrades performance.⁵

Adopt the package format on its merits, not as a quality signal. Agent Plugins 1.0 solves a genuine packaging problem well. It does not, and does not claim to, tell you anything about what is inside the package.

The bottom line

Agent Plugins 1.0 is a well-scoped piece of work that closes a real gap: as of August 6, 2026, a skill and its MCP server can ship as one package and load unmodified in five major coding agents. Combined with the Agent Skills standard from December 2025 and MCP before it, the movement problem is essentially handled.

The measurement problem is not. The research that landed in the same twelve months says a curated skill is worth about 17 percentage points of pass rate, a trained one considerably more on its own benchmarks, and roughly a quarter of the public supply carries a security defect — while every specification in the stack states plainly that trust, provenance, and vetting are somebody else's job. That is a defensible engineering boundary and an uncomfortable operational one.

The practical version is short. The format layer is finished enough to build on. The quality layer is still yours to build, and until you build it, a portable skill is just a defect that travels well.