Research snapshot: 2026-08-26
Decision horizon: Revisit this boundary quarterly, or when the Agent Skills
specification makes a breaking change. Do not expand it in response to individual
vendor features.
Agent Skills Platform turns a human workflow into a portable, evidence-backed Agent Skill and governs that artifact from proposal through retirement across the agent platforms an organization already uses.
An Agent Skill is a reusable workflow package that guides an agent from a recognized situation to a verified outcome. It can use retrieved knowledge, MCP tools, APIs, deterministic scripts, and agent judgment, but it is not itself a RAG system, MCP server, or agent runtime.
RAG supplies knowledge. MCP supplies capabilities. The harness supplies execution. A skill organizes them into a governed path toward a verified outcome.
It is the control plane for skill supply, not an agent runtime, model host, MCP gateway, identity provider, endpoint manager, or general marketplace for every agent extension.
The unit it governs is not merely a SKILL.md file. It is a versioned workflow
package containing:
The open format has converged on a small stable core: a directory with SKILL.md,
optional scripts, references, and assets, loaded through progressive disclosure.
The specification deliberately leaves execution and distribution to clients
(Agent Skills specification).
Major clients now implement the same artifact differently. GitHub supports project
and personal locations plus gh skill discovery, install, update, and publication
(GitHub Docs).
Cursor adds nested scope, manual invocation, modes, and plugin distribution
(Cursor Docs). Anthropic separates Claude Code,
claude.ai, API, and managed-agent surfaces, with different sharing and runtime
constraints (Claude Skills overview).
Microsoft supports file-, code-, class-, and MCP-backed skill providers
(Microsoft Agent Framework).
Those differences will keep changing. The portable workflow package and its trust evidence are the stable layer. The product owns that layer and uses replaceable adapters for the rest.
Every shipped feature must strengthen at least one capability below.
| Capability | Product responsibility | Proof of success |
|---|---|---|
| Capture | Extract a consequential, repeatable workflow from a person, documents, examples, or prior runs. Discover required APIs, MCP tools, schemas, and constraints before prescribing execution. | The creator confirms the decision contract and representative cases. |
| Compile | Generate a spec-conformant, portable package with minimal instructions, deterministic helpers, environment discovery, readiness gates, and safe mutation boundaries. | The package validates and runs without factory-source dependencies. |
| Prove | Evaluate routing, non-triggering, instruction following, outputs, coexistence, security, compatibility, and representative outcomes. Bind evidence and attestations to immutable content. | A reviewer can reproduce the claimed behavior from the committed artifact. |
| Govern | Enforce ownership, separation of duties, approval policy, risk tiers, versioning, lineage, update, rollback, quarantine, retirement, clean recreation, staleness, and audit history. | An operator can explain what is active, why it is trusted, who owns it, and how to stop it. |
| Deliver and learn | Make approved skills discoverable by outcome; install exact versions through governed adapters; collect consented, privacy-safe activation, correction, success, and retention signals. | Another team discovers and reuses a skill without its author, and evidence informs the next lifecycle decision. |
The artifact lifecycle is fixed:
proposal → discovery → generated → evaluated → approved → published
↓ ↓
rejected quarantined → retired → recreated
An installed skill also has an environment state:
unconfigured → discovering → ready → executing
↓ ↓ ↓
incompatible degraded blocked
Publication means the artifact is approved. It does not claim that every consumer environment is ready. A skill must inspect and prove its local prerequisites before consequential execution.
Integrate with those systems. Do not absorb them.
Three market facts determine the product shape.
Authoring quality is the bottleneck. A 2026 study of 138,133 public skills
found 91.8% had at least one detected defect; weak routing, bloated bodies, and
poor resource organization dominated. Spec-aware prompting, linting, repair, and
safety gates improved quality
(Zhang et al.). Another study found skill
smells in more than 99% of examined SKILL.md files and that smells rarely
disappeared through normal evolution
(Hong et al.).
A skill is executable supply-chain content. Anthropic tells enterprises to review code execution, exfiltration, triggers, coexistence, outputs, ownership, versions, and periodic regressions, and to separate authors from reviewers (enterprise guidance). A large-scale security study found vulnerabilities in 26.1% of 31,132 analyzed skills and found script-bearing skills 2.12 times more likely to contain a vulnerability (Liu et al.). These findings justify gates; scanners alone are not proof of safety.
Distribution and runtime remain fragmented. Anthropic explicitly documents that custom skills do not sync across its surfaces, and runtime network/package capabilities differ by surface. GitHub and Cursor use different scopes and management affordances. Therefore portability certification and adapters belong in this product; owning every runtime does not.
Anthropic’s current authoring recommendation also starts with evaluations and a baseline rather than extensive instructions (authoring best practices). That supports the product’s evidence-first generation pipeline.
A proposed feature enters the roadmap only when all five answers are yes:
If any answer is no, document the request and reject it from core scope. A platform adapter may still be justified when customers already use that platform and the adapter preserves the same lifecycle semantics.
The north-star event is:
A person captures a valuable workflow; an independent operator approves its evidence; someone in another team discovers and successfully reuses the exact approved version without assistance; the organization can later update, stop, explain, or erase and recreate it safely.
Measure the funnel, not inventory size:
Guardrails are time to quarantine, owner coverage, evidence freshness, regression rate, permission expansion, and unsupported-environment attempts.
Do not build new platform integrations merely because a vendor adds a new skill folder, invocation control, marketplace UI, or agent wrapper. Update an adapter only when a target customer needs it and the organizational acceptance test can exercise it. Do not add speculative metadata; require evidence that it improves routing, safety, compatibility, or a lifecycle decision.
The control plane now requires environment discovery/readiness, risk-based mutation boundaries, portfolio-level routing tests, organizational onboarding, and conditional human-approved semantic contracts. It governs semantic definitions consumed by skills; it does not become a semantic-layer database, ontology editor, data catalog, warehouse query engine, or autonomous definition generator. The next maturity step is evidence: run the bounded three-skill experiment across isolated configurations before expanding the semantic surface. Runtime probes, identity, analytics, and semantic storage remain integrations. Everything else is a separate product.
Use this gate at the end of every product increment. Stop building when any stop condition is true. Move ahead only when every move condition is true.
When the stop conditions win, the correct product action is maintenance, onboarding, measurement, or no work. A quiet roadmap is evidence of discipline, not product inactivity.