Seventy-six. That is the number of malicious packages security researchers at Snyk flagged inside an ecosystem its own documentation describes as exceeding one million skills and 280 million installs. Seventy-six out of a million is a rounding error, the kind of figure an evangelist is tempted to wave away โ until you remember that the ecosystem in question has no version management, no permission declarations, and no provenance verification. And the story that carried this figure into my feed last week was republished by a Web3 outlet and framed as a decentralization milestone.
That framing is what I want to examine. Not because it is wrong in every particular. Because it is instructive about how our industry reads governance.
Here is what was actually transferred. Anthropic donated the Agent Skills standard to the Linux Foundation โ specifically the standard's name, its logo, its GitHub organization, and its website domain. That is the complete list from the official statement. Read it again slowly. It is a list of brand and governance assets.
What did not appear on that list: the reference implementation inside Claude Code, any related patents, and the model-side tuning that makes Claude unusually competent at executing a SKILL.md file. The runtime stayed home. So did the optimization.
The recipient is the Agentic AI Foundation, co-founded in 2025 by Anthropic, OpenAI, and Block. AAIF had already absorbed MCP, Anthropic's earlier protocol for connecting agents to external tools and data. Now it holds both. The technical steering committee, per the announcement, is composed of individuals participating in a personal capacity rather than as company delegates.
For readers who have not tracked the architecture: MCP is the connection layer, the path an agent takes to reach tools and data. Skills is the behavior layer, the instructions for how an agent completes a particular task. A SKILL.md file is, at bottom, a structured set of natural-language steps plus optional scripts plus reference materials. Markdown with directory conventions. That is not a criticism. I have watched enough standards succeed to know that thin specifications travel further than elegant ones. The question worth asking is not whether the technology impresses. It is who holds the leverage once the specification is thin enough to be everywhere.
Let me put my own experience beside this. In 2025 I helped draft the Human-Centric AI governance framework submitted to the Ethereum Foundation's community grants program โ fifteen stakeholders, $250,000 in pilot funding, months of argument about how an AI-driven DAO stays accountable to human values. The hardest clause we negotiated was never about capability. It was about who answers when the system fails at 3am. Accountability does not survive a donation. It survives only when someone is contractually obliged to carry it.
Apply that test to a steering committee of individuals acting in a personal capacity. The neutrality is genuine โ no employer can issue instructions to a volunteer's evenings. So is the exposure. There is no employment contract behind a personal-capacity seat, no institutional backstop, no formal channel for an enterprise deployer to escalate a defect that costs them money. Look at how the IETF and W3C behave during rapid change cycles. Personal capacity lowers the temperature of political conflict and raises the latency of every fix.
The four gaps. Version management is absent. The announcement says Anthropic "has proposed" establishing version management, a formal proposal process, and security guidelines. Proposed. Meaning the standard, as it stands, does not have them. In an ecosystem already carrying a million packages, upstream drift โ one skill changes, a downstream agent's behavior mutates without warning โ cannot be traced. Anyone who shipped software through npm before semver existed understands precisely what this costs.
Permission declarations are absent. A skill can specify steps. It cannot specify what it is allowed to touch. The sandbox boundary is delegated to the runtime, which is to say, delegated to whoever built the runtime and whichever incentives they answer to.
Provenance is absent. No signature requirement, no verified publisher identity, no supply chain manifest. Snyk's seventy-six findings are the symptom. The disease is that nothing in the format ever made detection the author's responsibility rather than the scanner's.
And fourth, the one that matters most to me: cross-model portability has never been validated. "Seventy-plus platforms" describes format compatibility โ they can parse the Markdown. It does not describe behavioral consistency. A natural-language instruction executes at wildly different fidelity depending on the underlying model's instruction-following and context management. The word "standard" is doing enormous work here. A unified file format is not a unified behavior. It is a shared envelope with a different letter inside on every platform.
Then there is retrieval. A million skills, and an agent has a finite context window. How does it discover, filter, and load the right one? That demands embedding indexes, tiered loading, conflict resolution between overlapping skills. The announcement addresses none of it. Without routing, a million skills is not an ecosystem. It is noise with a registry attached.
There is a second-order problem nobody is discussing. Skills turns organizational knowledge into a distributable asset โ internal SOPs, expert workflows, business rules packaged into shareable files. That opens the enterprise market. It also opens a leakage channel with no lid. A skill file can carry process details, data structures, and operational logic out the door inside a Markdown document that looks like documentation. I spent 2021 negotiating royalty structures for AfriChains so that creators in Cape Town townships would retain long-term value from their work. The lesson I took was simple: culture on-chain, heart on-screen โ and provenance is not a technical nicety, it is the difference between a creator being paid and a creator being plundered. The same principle applies to a bank's internal lending workflow.
The business logic. Skills has no price. Its commercial value runs entirely through a different pipe: a developer builds an agent with skills, the agent runs, the agent calls a model API, tokens get billed. This is the npm structure โ registry free, ecosystem free, value captured one layer down by whoever sells the compute. Anthropic seeded the format and harvests the inference. The standard was customer acquisition. It was never meant to be a product.
The donation itself carries three motives that have nothing to do with generosity. Neutrality endorsement, because enterprise procurement treats vendor-controlled standards as a lock-in risk and will not sign the contract. Regulatory avoidance, because a standard owned by one company invites the same self-preferencing scrutiny the EU has applied to app store distribution. And cost externalization, because governance, documentation, and community operations now carry a marginal cost of zero on Anthropic's books.
The surrounding commercial layer is already forming, and notably Anthropic does not own it. skills.sh, operated by Vercel, functions as a directory and distribution channel โ the npm registry position, which is to say the position that controls visibility and ranking. Snyk is building the scanning layer. Whoever holds the registry holds the sort order, and sort order is power. Watch what that does to the prompt marketplaces too. PromptBase-syle platforms sell a tuned paragraph; Skills sells an executable, composable, versionable dependency. That is not competition. It is displacement, and the abstract orchestration layers inside LangChain and CrewAI will feel the same pressure the way Mesos felt Kubernetes.
Here is where I diverge from the coverage, and from the Web3 outlet that republished it. The narrative attached to this story is decentralization. The structural reality runs the other way. MCP, Skills, and Google's A2A โ connection, behavior, and agent-to-agent collaboration โ are all converging into a single foundation's governance. Agent standard-setting is centralizing at speed, and the Linux Foundation is becoming the de facto clearinghouse for it. That is not a scandal. It may even be the correct outcome. But it is not decentralization, and an audience sold the word deserves to be told the difference.
I have watched this exact substitution before. "Decentralized sequencing" has been a PowerPoint for two years while the sequencer sits on a single node. DAO governance has been a compliance shield while the foundation wallet stays fully traceable on-chain. The label moves first; the control moves last, or never. Code is law, but ethics is conscience โ and a governance label is neither until someone is accountable for holding it.
So test the "seventy-plus platforms" claim the way I test an L2's decentralization claim: ask what a platform actually does, not what it parses. Ask whether Skills is a first-class native capability or a Markdown reader bolted onto an IDE. Ask who sits on the technical steering committee and whether voting weight tracks membership tiers. Ask what happens when OpenAI, which co-founded the foundation, also maintains a competing AGENTS.md format while co-holding a seat on Skills' evolution. That is not a conspiracy theory. It is a conflict of interest disclosed by the structure itself, and structure is the only disclosure that ever matters.
Watch three things over the next twelve months. Whether the version management proposal becomes a ratified mechanism with real dependency locking, or stays a paragraph in a press release. Whether the steering committee publishes seat allocation and ties it to anything other than seniority. And whether AGENTS.md, SKILL.md, and A2A converge or collide inside the same foundation โ because that collision, not the donation, will decide what an agent can portably do across borders, models, and jurisdictions.
Solidarity over speculation. The standard was given away with a press release and a logo file. The leverage, as always, was not named in the announcement.