Daily signal: Agent Skills moves to a neutral foundation with security guidance still a roadmap item, and MCP's config and constraint proposals meet their security reviewers

Executive summary

The one structural development is governance: the standard that defines how agents pick up reusable instructions and scripts (Agent Skills) now sits with the same foundation as MCP. That is good for neutrality and for a future security process, but today’s announcement promises guidance, not controls, while a million skills are already in circulation. Everything else in the window is review activity on open MCP proposals, which is where the security argument is being had.

For the incident that dominates today, a poisoned AI-gateway release, see the threat alert and the security brief.

Recommendation (opinion): treat every skill you install as you treat a dependency that can run code, because that is what it is, and do not wait for the foundation’s guidance to set an internal allow-list.

Models

No frontier model launch is confirmed in the window. The Anthropic newsroom listing shows a 22 Oct post on Agent Skills and a guest-investigator call, a 21 Oct post on its Long-Term Benefit Trust and nothing about a model. One aggregator reports an Anthropic agent product preview on 21 Oct (named Claude Duet there); it is not in the newsroom listing, so I do not treat it as confirmed. The shelved OpenAI model and the Gemini 4 items were covered on 19 Oct.

MCP

SEP-2633: one mcp.json, and the consent questions that come with it

OfficialDraft · active 21 Oct

What is proposed. A minimal client-side configuration format that any MCP client could adopt, so server entries can move between tools. It defines stdio and streamable-HTTP entries, a server-name pattern and a table of secret-reference schemes such as env:. It is the client-side counterpart to server.json.

Security read. Standardising where server definitions live also standardises the attack: a repository that ships a shared file ships a launch command to every client that reads it. Reviewers have raised the right points: the consent screen must show the full command and arguments, folder trust must not equal consent to run declared servers, headless modes must require explicit approval, and environment-variable secrets leak into agent context when env files are sourced, so a secret-manager scheme should be first-class. A maintainer has also asked whether it should be an extension rather than core, which would make any consent rules advisory. Missing from the draft as of the page I read: OAuth fields (confidential-client credentials, an auth-posture field) and integrity digests for npm-launched servers, both requested by reviewers.

Recommendation (opinion): support the proposal only with a normative consent section. A common file format without a common consent rule makes the weakest client the entry point for every repository.

Sources: SEP-2633 pull request

SEP-2778: when a size limit is a security control and a breaking change

OfficialDraft · active 21 Oct

The proposal adds over thirty length, format and pattern constraints to the draft schema, with shared aliases for URI, MIME type, description, title and identifier, a 256-character cap on a completion argument name and a cut of the icon list from 20 to 10. The stated aim is to mitigate XSS, open redirects, injection and resource exhaustion and to give SDKs a common basis for validation. Reviewers pushed back: previously valid values (long descriptions, base64 icons above the 8,192-character cap) would start to fail after an SDK upgrade, and about 2 percent of real tool descriptions in public registries exceed 1,024 characters. They also ask what a client should do with an out-of-limit server result (drop the item, fail the list, log it). The sponsor supports a subset. Why it matters: tool descriptions are the prompt-injection channel in MCP, so a limit on their length and shape is a real, if blunt, control; the open question is whether the ecosystem accepts a compatibility cost for it. Sources: SEP-2778 pull request

SEP-3415 (Events): the security model survives review so far

The draft requires an authenticated principal for subscribe and unsubscribe calls, caches verification per principal and URL so varying arguments cannot multiply verification requests at a victim, sends verification through the same SSRF-hardened path as deliveries (delivery-time IP validation, no redirects, per-host rate limits), and offers optional Ed25519 signatures whose key must come from an origin the client already authenticates. The only 22 Oct activity is a comment about whether the events notification should be a standalone method instead of changing a core type. Still open: how a gateway discovers the signing key, and per-subscription scoping of event IDs to avoid dropping legitimate events. Covered in depth on 19 Oct. Sources: SEP-3415 pull request

Agent ecosystem and interoperability

Agent Skills goes to the Agentic AI Foundation

Official22 Oct

What happened. Anthropic announced that it is donating the Agent Skills open standard, the name and logo, the GitHub organisation and the agentskills.io domain to the Agentic AI Foundation, part of the Linux Foundation, which already hosts MCP and was co-founded by Anthropic, Block and OpenAI. Maintainers from several companies will serve as individuals, with David Soria Parra and Mahesh Murag as lead maintainers. The post says about 1 million skills have been published, nearly 280 million installed, and more than 70 agent platforms have integrated the format, including ChatGPT, Cursor, GitHub Copilot and VS Code. The proposed roadmap includes a formal proposal process and “security guidance for people who write and install skills”.

Security read. A skill is a folder with a SKILL.md file plus optional scripts and references that an agent loads on demand. That makes it three things at once: instructions the model will follow (prompt-injection surface), code the agent may run (execution surface) and an installable unit that spreads between platforms (supply-chain surface). Earlier research, which I saw only as search extracts and did not open, put numbers on this: Snyk’s February audit of about 4,000 public skills reported 13.4 percent with a critical-level issue, and Koi Security’s audit of one registry found 341 malicious skills out of 2,857. Publishing, per Snyk, needed only a markdown file and a week-old GitHub account. The donation post mentions none of signing, scanning, provenance or a registry, and says where the million skills live only implicitly. A neutral foundation is the right place to add them, but until it does, trust decisions stay with each platform, and the same skill can be treated very differently by two of the 70.

Why it matters. The same pattern played out with browser extensions and npm: ecosystems scale first and add provenance later, usually after an incident. The LiteLLM compromise is a reminder that attackers now target the AI toolchain directly, and skills are the least-governed link in it.

Mitigation and detection. Keep an internal allow-list of skills and pin them by commit hash; review any script a skill bundles as you would a dependency; run agents that load third-party skills without production credentials; and log which skill was active when a tool call ran.

Recommendation (opinion): ask the foundation for three things in its first proposal round: signed skill manifests, a declared-capabilities field (network, file, shell) that clients must enforce, and a standard way to report a malicious skill. Without them, “security guidance” will be documentation that most installers never read.

Sources: Anthropic: Donating Agent Skills to the Agentic AI Foundation · agentskills repository (landing page only)

Trends and signals

• The consent step is the contested control. Today’s MCP review comments, the 22 Oct SEP-2848 discussion and the Claude Code allowedMcpServers change (see the security brief) all turn on the same question: what counts as the user saying yes.
• Standards bodies are catching up to installed bases, not ahead of them. A million skills and thousands of MCP servers exist before signing or capability declarations do.
• Quiet release lines are not safe ones. The TypeScript SDK and A2A have not shipped since 5 Oct and 28 May; the advisories published this week (see 21 Oct) are the fixes still waiting for consumers to adopt them.

Sources

Anthropic newsroom · modelcontextprotocol repository pull requests · MCP TypeScript SDK releases · A2A releases · Claude Code releases

Related reports

• Threat alert: LiteLLM 1.107.0
• Security brief, 23 Oct
• Daily signal, 22 Oct