# Agent Skills in 2026: Portable, Popular, Unmeasured On August 6, 2026, the Agent Plugins Technical Steering Committee published Agent Plugins 1.0, a vendor-neutral package format that lets a single directory carry both agent skills and MCP server configuration across five agent clients.[^1] It arrives under eight months after Anthropic published the Agent Skills format itself as an open standard, on December 18, 2025.[^7] Neither specification says anything about whether the skill inside the package is any good — and on current evidence, that is the variable that decides everything. **In one line:** Agent skills are portable across dozens of AI agents, but portability is not efficacy. A paired benchmark found curated skills lift pass rates 16.6 points, while a scan of 31,132 marketplace skills found 26.1% carrying a vulnerability — what is inside a skill matters more than how it ships. ## TL;DR - **Agent Plugins 1.0** (August 6, 2026) standardizes exactly two component types — Agent Skills and MCP servers — inside one directory with a `plugin.json` manifest. Five clients support it: VS Code, Cursor, GitHub Copilot, ChatGPT & Codex, and Kiro.[^1][^2] - All five of those clients are shipped by organizations that co-authored the specification. That is normal for a three-day-old spec, but it means the client count currently measures author commitment, not third-party adoption. - The spec deliberately puts **distribution, runtime permissions, and trust outside its scope**. In its own words, "finding a package is also not the same as trusting or executing it."[^1] - **SkillsBench**, an 87-task paired benchmark, found curated skills raise average pass rates from 33.9% to 50.5% — **+16.6 percentage points** — with per-configuration gains between +4.1 and +25.7 pp.[^3] - **Microsoft Research's SkillOpt** trains the skill file itself and reports **+23.5 points** for GPT-5.5 in direct chat on a different six-benchmark suite. The two figures are not comparable, and this post does not stack them.[^4][^5] - A scan of **31,132 marketplace skills** found **26.1%** with at least one vulnerability, and skills bundling executable scripts were **2.12x** likelier to be affected than instruction-only ones.[^6] ## What you'll learn - What Agent Plugins 1.0 actually standardizes, and what it refuses to - Whether agent skills measurably improve agent performance, and by how much - What a *trained* skill is worth on its own benchmark suite - Why an argument for portable packaging turned up in a paper about optimization - How much of the public skills supply carries security problems - Which parts of the trust problem are genuinely solved, and which are not - What to do differently if you ship agents for a living ## What Agent Plugins 1.0 actually standardizes Agent Plugins 1.0 defines a directory layout and a manifest, and almost nothing else. A plugin is a folder containing `plugin.json`, an optional `skills/` directory holding one or more `SKILL.md` packages, an optional `mcp.json` describing MCP servers, and optional reverse-domain namespaces such as `com.example.client/` that a single vendor can use for anything outside the shared contract. The minimal manifest is two lines: a `$schema` pointer and a `name`.[^1] The announcement calls the file structure "the contract." Compatible clients read the manifest, look for skills in the fixed location, read MCP configuration from the fixed location, and ignore any namespace they do not implement. That is the entire interoperability surface — what the announcement describes as "a small interoperability floor."[^1] The restraint is the design. Client ecosystems are currently experimenting with agents, commands, hooks, rules, and UI extensions, and 1.0 leaves all of them out because they "do not yet have consistent semantics or security models across clients." The project also declines to promise more later: "No additional component type is committed for a future release."[^1] It was built by representatives from Amazon, Cursor, Microsoft, OpenAI, and Vercel, whom the specification site describes as the "initial Technical Steering Committee."[^12] Google announced on the same day that it is joining that committee as a core maintainer; the roster on the specification site had not been updated to reflect it when retrieved for this article. One governance detail deserves stating precisely, because coverage tends to blur it: the announcement ran on the Agentic AI Foundation's blog as a community guest post, and its own callout says Agent Plugins "is an independently governed open specification. It is not an AAIF project and has not submitted a proposal to become one."[^1] It is not, at time of writing, a Linux Foundation project the way [MCP is](/mcp-stateless-protocol-enterprise-authorization). ### The five clients, and who ships them Every client currently listed supports the Agent Skills component type. The variation is in MCP transports.[^2] | Client | Shipped by | Agent Skills | MCP transports | |---|---|---|---| | VS Code | Microsoft | Yes | stdio, Streamable HTTP, legacy SSE | | Cursor | Cursor | Yes | stdio, Streamable HTTP, legacy SSE | | GitHub Copilot | Microsoft | Yes | stdio, Streamable HTTP, legacy SSE | | ChatGPT & Codex | OpenAI | Yes | stdio, Streamable HTTP | | Kiro | Amazon | Yes | stdio, Streamable HTTP, legacy SSE | Two things follow from that table. First, every client on it comes from an organization on the steering committee — four distinct organizations, since Microsoft ships two and Vercel ships none. No implementation from outside the authoring group appears on the list, which is unremarkable for a specification three days old but does mean the client count currently measures author commitment rather than ecosystem uptake. Second, Codex is the only one of the five that does not list legacy SSE, which given MCP's move toward a stateless core reads as forward-leaning rather than as a gap. The page notes that clients "can adopt portable component types incrementally," so this table is a snapshot of a moving list rather than a stable capability matrix. ## What the spec deliberately leaves out Three things sit explicitly outside Agent Plugins 1.0, under a heading the announcement titles "What remains client-owned": **distribution** (registries, marketplaces, installation, updates), **runtime experience** (permissions, approval flows, sandboxing, user interface), and **trust** (publisher identity, provenance, signatures, organizational policy).[^1] This is defensible design. HTTP does not define certificate policy; PKI does. A package format that also tried to settle a trust model would plausibly have shipped later and spread more slowly. The authors are candid about the boundary: "Finding a package is also not the same as trusting or executing it: publisher verification, provenance, approval, sandboxing, and runtime policy remain separate responsibilities."[^1] So the interesting question is not whether Agent Plugins covers trust — it says it does not — but whether the layers it delegates to have picked it up. For MCP servers, partly yes. For skills, much less so. That is worked through below, after the efficacy evidence that makes it matter. ## Do agent skills actually work? Curated ones do, by a measured margin. **SkillsBench**, whose latest revision landed on June 14, 2026, is a benchmark of 87 tasks across 8 domains, each paired with a curated skill and a deterministic verifier. Running all 87 tasks under matched no-skills and curated-skills conditions across 18 model-harness configurations, the average pass rate rose from **33.9% to 50.5% — a gain of 16.6 percentage points**.[^3] Two secondary findings are more actionable than the headline: - **Configuration-level gains ranged from +4.1 to +25.7 percentage points.** All 18 configurations improved, with a factor of six between the smallest and largest gain. Note the level of aggregation: these are per-configuration averages over 87 tasks. The abstract reports no per-task deltas, so it does not establish that every individual task improved — only that every configuration did on average. Nothing here licenses assuming a skill helps on your particular task. - **Focused skills with at most three modules outperformed larger or exhaustive bundles.** The instinct to cram every edge case into one SKILL.md is measurably counterproductive. The paper also reports that smaller models equipped with skills can match larger models without them — a substitution effect that turns up again, independently, in the optimization literature below. The methodological point SkillsBench is really making sits in its framing: it describes paired evaluation as "the foundation for rigorous measurement of Skill efficacy on agentic, expertise-heavy work," which is a polite way of saying its authors found no standard way to check whether any of this helped. Anthropic shipped the format on October 16, 2025; the first version of this benchmark for it appeared on February 13, 2026, roughly four months later.[^3][^7] Measurement lagged adoption, and the gap has never really closed. ## What a trained skill is worth Microsoft Research's **SkillOpt**, published on the MSR blog on June 30, 2026, asks a different question: not "does a skill help?" but "what happens if you train it?"[^4] The setup treats the skill file as a trainable parameter sitting outside a frozen target model. A separate optimizer model reads scored rollouts, proposes bounded add, delete, and replace edits to a single skill document, and an edit is accepted only when it strictly improves a held-out validation score. A textual learning-rate budget caps edits per step, a rejected-edit buffer feeds failures back as negative signal, and an epoch-wise slow update consolidates longer-horizon lessons. All of it happens at training time — the authors report the method adds "zero inference-time model calls at deployment."[^5] Across 6 benchmarks, 7 target models, and 3 execution modes, SkillOpt reports best or tied-best results on all 52 evaluated model-benchmark-harness cells — 52 being the combinations actually run, not the full cross-product — against human-written skills, one-shot LLM-generated skills, and four prior methods including [GEPA](/prompt-optimization-ai-agents-gepa) and TextGrad.[^4][^5] For GPT-5.5, the gains over no skill were **+23.5 points in direct chat** (58.8 to 82.3), **+24.8 inside Codex**, and **+19.1 inside Claude Code**.[^4] The artifact economics are the part worth internalizing. The deployed file, `best_skill.md`, has a median length of roughly **920 tokens across the paper's six case studies**, and because the validation gate rejects most proposals, only **one to four edits** are accepted into the final version. One benchmark's 39.0-point gain came from a **single accepted edit**.[^4] Whatever a skill is, it is not a large object, and its value is not proportional to its length. Two caveats belong next to those numbers. First, this is a vendor-run evaluation: Microsoft evaluating Microsoft's method, with the competing baselines configured by the same authors. "Best or tied-best in all 52 cells" is the kind of clean sweep that warrants independent replication before it becomes a planning assumption. Second, and more importantly: **The SkillsBench and SkillOpt numbers are not on the same axis, and this post does not stack them.** SkillsBench runs 87 agentic, expertise-heavy tasks; SkillOpt runs SearchQA, SpreadsheetBench, OfficeQA, DocVQA, LiveMathematicianBench and ALFWorld. Different suites, different baselines, different harnesses. Reading them as a ladder — "curated is worth 16, trained is worth 23" — would be wrong. What the two jointly establish is narrower and still useful: two independent groups, on unrelated task sets, found double-digit percentage-point swings attributable to the contents of a markdown file. The variance lives in the skill, not the packaging. ## The transfer result that bears on package formats SkillOpt's transfer experiments contain an argument for portable skill packaging that the paper itself never makes — Microsoft presents it as evidence about what its optimizer learns, not as a case for a package format. A spreadsheet skill trained inside Codex, then dropped into Claude Code with no further optimization, lifted the no-skill baseline from **22.1 to 81.8 — a gain of 59.7 points**. That is *slightly above* the 80.4 achieved by training the skill directly inside Claude Code.[^4] The two harnesses expose different tool surfaces, which is why the authors read this as evidence the method learns general workflow logic rather than harness-specific recipes. If that generalizes, portability is not a convenience feature: a skill would be a genuinely transferable asset whose value survives a change of runtime, which is the premise Agent Plugins 1.0 is built on, arrived at from the opposite direction. As OpenAI's Nick Cooper put it in the Agent Plugins announcement, "Useful capabilities should be able to travel across agents."[^1] The hedge matters here. This is one reported skill on one benchmark pair, described as "the clearest example" of transfer rather than as an average, and it beats its own native-training control by 1.4 points on a benchmark where scores swing by more than 40. Treat it as a promising single observation, not a rule. ## Agent skills security: about a quarter of the sampled supply A January 2026 study collected **42,447 skills from two major marketplaces** and systematically analyzed **31,132** of them with a detection pipeline combining static analysis and LLM-based semantic classification. It found **26.1% contained at least one vulnerability**, spanning 14 distinct patterns across four categories: prompt injection, data exfiltration, privilege escalation, and supply chain risk.[^6] | Finding | Share of analyzed skills | |---|---| | At least one vulnerability | 26.1% | | Data exfiltration patterns | 13.3% | | Privilege escalation patterns | 11.8% | | High-severity patterns "strongly suggesting malicious intent" | 5.2% | The most operationally useful number is not a percentage but an odds ratio: skills that **bundle executable scripts were 2.12x likelier to contain a vulnerability** than instruction-only skills (OR = 2.12, p < 0.001).[^6] That maps cleanly onto a distinction the format itself makes — a SKILL.md with a `scripts/` directory is a different risk object from one without, and it is visible from the file tree before you install anything. The authors' own conclusion is that the ecosystem needs "capability-based permission systems and mandatory security vetting."[^6] Three qualifications keep this honest. The detection method reports 86.7% precision and 82.5% recall, so 26.1% is a detector-dependent estimate, not a census. The sample covers two marketplaces as of January 2026, not the products on any showcase today. And it is prevalence across a published corpus, not across installs — the OSS Insight analysis cited below notes the long tail of published skills is "vast and largely unused," so exposure-weighted risk is plausibly lower.[^9] None of this surprised the people who shipped the format. Anthropic's own launch post carries the warning in plain language: "this feature gives Claude access to execute code. While powerful, it means being mindful about which skills you use — stick to trusted sources to keep your data safe."[^7] Anthropic authored the format and operates the showcase, so it is not a neutral party here; it is also the party that said the quiet thing first. ## Which parts of trust are actually solved Here is where a lazy version of this argument goes wrong. It is tempting to say the stack has no trust layer at all. It does — just not where skills live, and not doing the job people assume. The **MCP Registry** performs real publisher verification. Server names use a reverse-DNS format such as `io.github.username/server`, and the registry's namespace authentication "ensures that only the legitimate owner of a GitHub account or domain can publish servers under that namespace, providing trust and accountability in the ecosystem."[^11] That is the *publisher identity* half of the "publisher identity, provenance, signatures" concern Agent Plugins hands off, and somebody picked it up. Provenance attestation and signing are not part of it. But read the next section of the same page. The registry "delegates security scanning" to the underlying package registries and to downstream aggregators, and describes itself as focusing "on namespace authentication and metadata hosting, while relying on the broader ecosystem for security scanning of actual server code."[^11] It is also still in preview, and it indexes **MCP servers** — not skills. There is no equivalent registry-level identity layer for `SKILL.md` packages. So the accurate version of the gap is narrower and more useful than "nobody is doing trust": - **Who published it** is partly solved, for MCP servers, by registry namespace verification. - **Whether the code is safe** is delegated at every layer — the registry to package registries and aggregators, Agent Plugins to clients, Anthropic's guidance to the user's judgment about "trusted sources." - **Whether the skill actually helps your task** is not a trust question at all, and no signature can answer it. That is what SkillsBench exists to measure, and it has to be re-run per model, per harness, per task. The third will not yield to a specification. Publisher identity is a solvable coordination problem; efficacy is not a coordination problem at all. ## The supply is large, concentrated, and widely redundant A February 2026 analysis of **40,285 publicly listed skills** from a major marketplace found publication happens "in short bursts that track shifts in community attention," that content is "highly concentrated in software engineering workflows," and that the ecosystem shows "strong ecosystem homogeneity, with widespread intent-level redundancy" alongside a "pronounced supply-demand imbalance across categories." It also flags "non-trivial safety risks, including skills that enable state-changing or system-level actions" — a second safety signal, from a different corpus than the January scan.[^8] The GitHub-side picture, as measured by OSS Insight on March 24, 2026, showed the skills-collection category taking on 250,000 stars in ten weeks, with 57,000+ `AGENTS.md` files, 21,000+ `CLAUDE.md` files, and 31,000+ skill definitions under `.claude/skills/` across public repositories.[^9] Those figures are roughly four and a half months old and describe the first-quarter surge, not a current count. OSS Insight is the analytics arm of a commercial database vendor and the piece is a first-person opinion essay built on its own telemetry — a well-instrumented argument rather than a neutral data release. Its argument still cuts against the tidy reading of Agent Plugins. OSS Insight identified a format war — "Claude Code reads `CLAUDE.md` and `.claude/skills/`. Codex reads `AGENTS.md`. Cursor does its own thing" — and Agent Plugins does not settle it. That war is about instruction-file conventions; Agent Plugins standardizes the package *around* a skill, not the instruction file inside it. The convention question OSS Insight raised is still open. Its sharper point is that skills are not stable objects: they "break when the model changes," and a file that worked with one model generation "might behave differently" with the next "not because the file changed, but because the model's interpretation of it did."[^9] If that is right, efficacy is a function of skill, model, harness and ambient context together — and no static certification could exist even in principle. ## Skills, MCP, and Agent Plugins: which layer does what The three specifications are complementary rather than competing. The Agent Plugins announcement lays out the division in a table of its own, reproduced here as published:[^1] | Concern | Primary question | Responsibility | |---|---|---| | Reusable instructions | What instructions and resources can an agent reuse? | Agent Skills | | Runtime connections | How does an AI application connect to tools and context? | MCP | | Packaging | How are reusable extension components packaged together? | Agent Plugins | | Discovery | How can clients and users find artifacts? | Catalogs and registries | | Trust and execution | What may be installed, trusted, and run? | Publishers, provenance systems, and client policy | The top three rows name specifications with maintainers and version numbers. The bottom two name categories of actor — and as the MCP Registry shows, one of those categories now has an occupant, for servers at least. That is an actor volunteering, not a specification assigning. It mirrors what happened when [the IETF began examining agent protocols](/ietf-ai-agent-protocol-standard-agentproto) earlier this year: transport and format standardize quickly because they are tractable; trust standardizes slowly because it is organizational as much as technical. For context on where the format started, Anthropic shipped Agent Skills on October 16, 2025 and published it as an open standard for cross-platform portability on December 18, 2025, alongside organization-wide skill management and a partner directory.[^7] Our earlier walkthrough of [what Claude Skills are and how they load](/claude-skills-custom-ai-modules-for-smarter-workflows) covers the mechanics. The official showcase lists 44 products supporting the format when retrieved for this article, from Claude Code and Codex to Gemini CLI, Goose, Snowflake Cortex Code and Pulumi Neo — a curated showcase of self-reported support maintained by the project, not a census.[^10] ## What this means if you ship agents Five things follow from the evidence above, and none require waiting for a new specification. **Treat a skill as code you own, not content you install.** The efficacy research measures *curated* and *trained* skills; nothing in it licenses assuming an arbitrary marketplace skill carries the same value. Vendor the skill into your repository, read it, and review it on the same cadence as the rest of your code. **Check for a `scripts/` directory first.** The 2.12x odds ratio is one of the cheapest security signals available, and it is visible from the file tree before installation. **Keep skills short and specific.** SkillsBench found focused skills of at most three modules beating exhaustive bundles, and SkillOpt's median trained artifact was around 920 tokens built from one to four accepted edits. Both point the same direction. **Build the verifier before the skill.** Both efficacy results depend on a deterministic check — SkillsBench pairs every task with a verifier, SkillOpt gates every edit on a held-out validation score. Without one you cannot distinguish an improvement from a regression, which is the failure mode SkillOpt was built around: skills that "grow longer and drift with each rewrite" while a plausible-looking revision quietly degrades performance.[^4] **Re-run that verifier on every model upgrade.** A skill's value is a property of its interaction with a specific model and harness, and both change under you. Pin the skill, pin the model, and treat a model upgrade as a change requiring re-measurement. ## FAQ **What is Agent Plugins 1.0?** An open, vendor-neutral package format published August 6, 2026 that lets one directory carry Agent Skills and MCP server configuration together, so a compatible client can discover and load both without the author rewriting manifests per client. It standardizes two component types, a manifest, fixed component locations, validation and failure-isolation rules, portable path variables, and client extension namespaces.[^1] **Does Agent Plugins replace Agent Skills or MCP?** No. It packages them without changing their native formats. Skills stay in `SKILL.md`, MCP behavior stays governed by the MCP specification, and Agent Plugins defines only how they travel together.[^1] **Do agent skills measurably improve performance?** Curated ones do. SkillsBench's paired evaluation across 87 tasks and 18 model-harness configurations found average pass rates rising from 33.9% to 50.5%, with per-configuration gains between +4.1 and +25.7 percentage points.[^3] Those are averages over tasks — the expected value of a good skill, not a guarantee on any single task. **Are agent skills portable across different AI agents?** Increasingly. The official Agent Skills showcase lists 44 supporting products, and Agent Plugins 1.0 adds a shared package boundary across five clients.[^2][^10] There is also early evidence the *value* transfers and not just the file: SkillOpt reports a skill trained in Codex performing slightly better in Claude Code than one trained there directly, though that is a single reported case.[^4] **Is it safe to install skills from a marketplace?** Treat it as installing unreviewed code. A scan of 31,132 marketplace skills found 26.1% with at least one vulnerability and 5.2% showing high-severity patterns suggestive of malicious intent, with script-bundling skills 2.12x likelier to be affected.[^6] Anthropic's guidance is to stick to trusted sources.[^7] **Is anyone verifying who publishes a skill?** For MCP servers, partly: the MCP Registry ties server names to verified GitHub accounts or domains through reverse-DNS namespace authentication, though it is still in preview and explicitly delegates security scanning elsewhere.[^11] There is no equivalent registry-level identity layer specifically for `SKILL.md` packages, and Agent Plugins 1.0 places publisher identity outside its scope.[^1] **Can a good skill substitute for a bigger model?** Sometimes, on specific tasks. SkillsBench reports smaller models with skills matching larger models without them, and SkillOpt reports an optimized GPT-5.4-mini averaging 64.3 against a no-skill GPT-5.4 at 59.7.[^3][^4] That is task-level substitution on benchmark suites, not a general claim about model capability. ## The bottom line Agent Plugins 1.0 closes a real gap. As of August 6, 2026, a skill and its MCP server can ship as one package and load in five major agent clients — all of them, for now, built by the specification's own authors. Combined with the Agent Skills standard from December 2025 and MCP before it, moving a capability between agents is close to a settled problem. Knowing whether the capability is worth moving is not. A curated skill was worth about 17 percentage points of pass rate on the one benchmark built to check; roughly a quarter of a published corpus carried a detected security defect; and the trust machinery that exists verifies who published an MCP server, not whether a skill is safe or effective. Some of that is a real gap. Some of it is a category error to expect from a package format at all — no signature can certify that a markdown file will still help after the next model release. The practical version is short. The format layer is finished enough to build on. The measurement layer is yours, it does not come in the package, and it has a shelf life. --- [^1]: Harald Kirschner, "From Skills and Tools to Portable Agent Plugins," Agentic AI Foundation blog, August 6, 2026. Community guest post from the Agent Plugins Technical Steering Committee; the post states Agent Plugins is independently governed and is not an AAIF project. [^2]: "Compatible Clients," Agent Plugins documentation, retrieved August 9, 2026. Client-to-vendor attributions are the author's. [^3]: Xiangyi Li et al., "SkillsBench: Benchmarking How Well Agent Skills Work Across Diverse Tasks," arXiv:2602.12670, submitted February 13, 2026, last revised June 14, 2026 (v4). Figures cited are from the v4 abstract; the benchmark's task and configuration inventory changed across revisions. [^4]: Yifan Yang et al., "SkillOpt: Agent skills as trainable parameters," Microsoft Research blog, June 30, 2026. [^5]: Yifan Yang et al., "SkillOpt: Executive Strategy for Self-Evolving Agent Skills," arXiv:2605.23904, submitted May 22, 2026, revised May 25, 2026 (v2). [^6]: Yi Liu et al., "Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale," arXiv:2601.10338, submitted January 15, 2026. Detection pipeline reports 86.7% precision and 82.5% recall. [^7]: "Introducing Agent Skills," Anthropic, October 16, 2025, with an in-post update dated December 18, 2025 announcing publication of Agent Skills as an open standard. [^8]: George Ling, Shanshan Zhong and Richard Huang, "Agent Skills: A Data-Driven Analysis of Claude Skills for Extending Large Language Model Functionality," arXiv:2602.08004, submitted February 8, 2026. [^9]: OSS Insight, "Agent Skills Are Not the Endgame — They're Just a Transitional Layer," March 24, 2026. A first-person opinion essay built on OSS Insight's own GitHub analytics as of that date. [^10]: "Client Showcase," Agent Skills, retrieved August 9, 2026. Count of 44 products taken from the page's own client listing, which renders client-side; the showcase reflects self-reported support. [^11]: "The MCP Registry," Model Context Protocol documentation, retrieved August 9, 2026. The registry is described as in preview. [^12]: "Agent Plugins," specification site, retrieved August 9, 2026: "Its initial Technical Steering Committee includes Core Maintainers from Amazon, Cursor, Microsoft, OpenAI, and Vercel." Google's announcement of its own core-maintainer role was made separately on August 6, 2026 and is not yet reflected in this roster.

#mcp-registry

مهارات العميل في ٢٠٢٦: متنقلة، شائعة، وغير مقاسة