Agent skills are packaged instructions that teach an artificial intelligence (AI) agent how to carry out a specific task. Each skill is a folder containing a text file called SKILL.md, which holds a short name, a description of when the skill applies and a set of written instructions, optionally accompanied by scripts, reference documents and templates. An agent keeps only the name and description of every installed skill in view, and reads the full instructions when a request matches. The format exists because general-purpose models lack the procedural knowledge of a particular company or workflow, and pasting that knowledge into every conversation wastes the model's limited working memory. Anthropic introduced skills for its Claude models on October 16, 2025, published the format as an open specification on December 18, 2025, and announced on October 22, 2026 that it was handing the standard to the Agentic AI Foundation (AAIF), a Linux Foundation project.

How a skill is built

The specification, maintained at agentskills.io, is short. SKILL.md opens with a block of YAML (a plain-text configuration syntax) called frontmatter, followed by free-form Markdown.

Only two frontmatter fields are required. name runs to 64 characters of lowercase letters, digits and hyphens, and must match the folder name. description can be up to 1,024 characters and, according to the specification, should state both what the skill does and when to use it, with keywords that help an agent recognise a relevant request. Four fields are optional: license; compatibility, a note of up to 500 characters on environment requirements such as network access or a particular runtime; metadata, a free map for version numbers or authorship; and allowed-tools, a space-separated list of tools the skill may use without asking, which the specification marks as experimental.

The body has no mandated structure. Three optional subfolders are conventional: scripts/ for executable code, references/ for longer documentation and assets/ for templates or images.

A Google Ads diagnostics skill published by Google shows what this looks like in practice. Its description says it "Diagnoses Google Ads account performance issues such as conversion loss (value or volume), low lead flow/volume, and lost impression share." Its compatibility line names the Google Ads Model Context Protocol (MCP) server tools it depends on, and its metadata records version 1.0.2.

Progressive disclosure

The design rests on a principle Anthropic calls progressive disclosure: information enters the model's context window in stages, only as a task requires it. The context window is the amount of text, measured in tokens, that a model can consider at once.

At the first level, the agent loads each skill's name and description at startup, which the specification estimates at about 100 tokens per skill. Anthropic's engineering post of October 16, 2025 says these entries sit in the agent's system prompt. At the second level, when a request matches a description, the agent reads the entire SKILL.md body. The specification recommends keeping that body under 5,000 tokens and 500 lines. At the third level, the agent opens bundled reference files only if the instructions point to them, and can run bundled scripts so that only their output, not their code, enters context.

An agent can therefore carry a hundred skills for roughly 10,000 tokens of metadata. Selection, however, is made by the model reading descriptions, not by a deterministic router, which is why the specification cites "Helps with PDFs" as a poor description.

Who builds and runs skills

Skills are written by platform vendors, software companies and individual users. Anthropic ships pre-built skills for PowerPoint, Excel, Word and PDF files. Google's google/skills repository, started in April 2026, contained 14 advertising skills as of November 2026, covering the Google Ads API, the Data Manager API and the Google Mobile Ads and IMA video SDKs.

On the consuming side, the "client" is any agent product that scans skill folders, injects the metadata and lets the model read files on demand. On Claude's API, skills run inside the code execution tool's container, which has no network access and cannot install packages at runtime, according to Anthropic's documentation. Skill data there is not eligible for zero data retention.

Origin and evolution

The October 16, 2025 announcement made skills available in the Claude apps for paid plans, in Claude Code (version 2.0.20, published that day) and through the API's /v1/skills endpoint. Yusuke Kaji, general manager for AI at Rakuten, was quoted in the launch post saying: "What once took a day, we can now accomplish in an hour."

The format spread quickly beyond Claude. On December 18, 2025, Anthropic published the specification as an open standard. The agentskills.io repository added logos for OpenAI's Codex on December 19, Factory on January 4, 2026 and Google's Gemini CLI on January 8, 2026. The repository's history shows later specification changes, from March to August 2026, were clarifications rather than new fields.

Google announced Agent Skills for its advertising and measurement products in June 2026, with an install command of npx skills add google/skills/skills/ads. Its Google Ads API documentation, last updated October 30, 2026, describes the skills as working with "AI assistants that support the open Agent Skills standard, including Google Antigravity and Claude Code."

On October 22, 2026, Anthropic said it was donating the standard, the Agent Skills name and logo, the GitHub organisation and the agentskills.io domain to the AAIF, which it co-founded with Block and OpenAI and which already hosts MCP. A governance document merged on November 4, 2026 names David Soria Parra and Mahesh Murag of Anthropic as lead maintainers alongside five core maintainers, and commits to "a small specification and a high bar for additions."

Why it matters for marketers

Skills turn agency and in-house expertise into a portable file: an audit checklist or reporting template written once can be reused by any compatible agent. PPC Land's coverage shows this happening inside marketing departments: Anthropic's own marketing team cut its weekly report build from two days to two hours using connectors plus custom prep, proofreading and action-items skills. When Anthropic launched Cowork in January 2026, skills were one of two infrastructure components the product built on, alongside connectors.

Ad platforms package knowledge the same way. Version 4.0 of Google's Google Ads API developer assistant modularised rules, skills and diagnostic commands into an installable package in August 2026. The scale is no longer marginal: Anthropic says more than 70 agent platforms, including ChatGPT, Cursor, GitHub Copilot and VS Code, have integrated the format, and that 1 million skills have been published and nearly 280 million installed. Those figures are company-reported and have not been independently audited.

Limitations and security disputes

Because a skill can contain both instructions the model will follow and code it can execute, it is a software supply chain risk. Anthropic warns that "a malicious Skill can direct Claude to call tools or run code in ways that don't match the Skill's stated purpose," and recommends using skills only from trusted sources.

Independent research has quantified the problem. A study submitted to arXiv on January 15, 2026 by researchers from Quantstamp, Nanyang Technological University and other institutions analysed 31,132 skills from two public marketplaces and found that 26.1% contained at least one vulnerability, spanning prompt injection, data exfiltration, privilege escalation and supply chain risks. Skills bundling scripts were 2.12 times more likely to be vulnerable. Snyk's ToxicSkills report of February 5, 2026 scanned 3,984 skills, mainly from the ClawHub registry, and found 534 (13.4%) with at least one critical issue and 76 confirmed malicious payloads. Publishing there required only a SKILL.md file and a week-old GitHub account, with "No code signing. No security review," according to Snyk. A second paper, accepted to USENIX Security 2026, identified 157 malicious skills among 98,380, all of which registries removed after disclosure. The samples differ, so the percentages are not directly comparable.

Other limits are structural. The specification has no signing, permission manifest or sandbox requirement; allowed-tools remains experimental and is implemented differently across clients. Portability also has limits: a skill that assumes a particular MCP server will not work in an agent lacking it. Anthropic's donation post lists versioned releases, a formal proposal process and security guidance as roadmap items.

What agent skills are not

MCP servers give an agent access to external tools and data, such as an ad account's reporting API. Skills tell the agent how to use those tools for a particular job. Google's diagnostics skill depends on the Google Ads MCP server.

Agent plugins are distribution bundles. Claude Code's plugin system, released on October 9, 2025 in version 2.0.12, packages commands, subagents, hooks and MCP server configurations, and can include skills. Salesforce's 37 sales skills, for example, ship inside a plugin. A skill is one component; a plugin is the container.

System prompts are loaded in full for every conversation; skills load only when relevant. Subagents are separate agent instances with their own context windows, whereas a skill runs inside the agent that loads it.

The phrase "agent skills" also has an older meaning in contact-centre software, where it refers to the competencies used to route calls to human agents. That sense is unrelated.

Recent developments

The AAIF transfer is the main change of the past fortnight. Anthropic's October 22 announcement named engineers from Anthropic, Google and OpenAI as future maintainers, and on November 4, 2026 the repository added its governance document and a Linux Foundation legal notice; no representative to the AAIF had been designated by then. Google updated its Google Ads API agent skills page on October 30, 2026. On the security side, Anthropic now offers skill content scanning for Claude Enterprise customers, though its documentation says the scan does not cover skills uploaded through the Skills API or the developer console.

Timeline

  • October 9, 2025 - Claude Code 2.0.12 releases a plugin system for commands, agents, hooks and MCP servers.
  • October 15, 2025 - Anthropic initialises its public skills repository on GitHub.
  • October 16, 2025 - Anthropic launches Agent Skills across Claude apps, Claude Code 2.0.20 and the API, with pre-built document skills.
  • December 18, 2025 - Anthropic publishes Agent Skills as an open standard at agentskills.io and adds organisation-wide skill management.
  • December 19, 2025 - OpenAI's Codex is added to the agentskills.io list of supporting clients.
  • January 8, 2026 - Google's Gemini CLI is added to the client list.
  • January 15, 2026 - "Agent Skills in the Wild" paper reports vulnerabilities in 26.1% of 31,132 skills.
  • February 5, 2026 - Snyk publishes ToxicSkills, finding 76 malicious payloads among 3,984 skills.
  • April 10, 2026 - Google's google/skills repository begins.
  • June 23, 2026 - Google adds advertising skills to the repository.
  • August 25, 2026 - Google Ads API developer assistant v4.0.0 modularises skills into an installable package.
  • August 26, 2026 - Salesforce announces 37 prebuilt sales skills for Claude.
  • October 22, 2026 - Anthropic announces the donation of Agent Skills to the Agentic AI Foundation.
  • October 30, 2026 - Google updates its Google Ads API agent skills documentation.
  • November 4, 2026 - Agent Skills governance document adopted, naming lead and core maintainers.

Summary

Who: Anthropic created the format; Mahesh Murag and David Soria Parra lead its maintenance under the Agentic AI Foundation. Google, OpenAI, Microsoft's GitHub, Cursor and more than 70 agent platforms support it, and vendors such as Google and Salesforce publish skills.

What: A folder built around a SKILL.md file with a name, a description and instructions, plus optional scripts and references, which an agent loads progressively when a task matches.

When: Launched October 16, 2025; opened as a standard December 18, 2025; donated to the AAIF on October 22, 2026, with governance adopted November 4, 2026.

Where: In Claude's apps, Claude Code and API, and in third-party agents including Codex, Gemini CLI, Cursor, GitHub Copilot and Google Antigravity, with skills distributed through GitHub repositories and public registries.

Why: To give general-purpose agents specialised, reusable procedural knowledge without filling their context window, at the cost of a new supply chain attack surface that researchers found affected roughly a quarter of public skills in early 2026.