"Seventy-six malicious skills." That is the number that should stop you. Buried inside a press release that Web3 feeds reposted last week as a win for "decentralized AI governance," Anthropic quietly disclosed that its Agent Skills standard — a library now carrying a million packages and 280 million installs — already ships with a documented attack surface. Seventy-six poisoned skills. No version management. No permission declarations. No source verification.
The headline read: Anthropic donates Agent Skills to the Linux Foundation. The subtext read: the single most important behavioral layer of the AI agent stack just migrated from a private company into a neutral foundation, and the crypto crowd applauded because the word "decentralized" appeared in the same paragraph as "governance."
I read the primary source twice. The chart whispers; the ledger screams the truth. What the ledger says is that this is not a decentralization story. It is a centralization story wearing decentralization's clothes — and the crypto AI trade, which has spent two years pricing an on-chain agent economy, is on the wrong side of the repricing.
Before the analysis, the mechanics. Agent Skills, per Anthropic's own description, is SKILL.md — a natural language description of task steps — plus optional scripts and reference materials. Strip the branding and it is a Markdown file with a directory convention. There is no new compute paradigm here, no model architecture change, no training-method innovation. By any honest framework, this is an engineering-level innovation edging toward combination-level: known techniques recombined into a distributable format.
The layering against MCP is conceptually clean and worth stating precisely. MCP — Model Context Protocol — handles the connection layer: how an agent reaches external tools and data. Skills handles the behavior layer: how an agent completes a specific task. The analogy is the USB-C interface specification versus the device driver. One defines the port; the other defines what happens after you plug in. The problem is that the boundary blurs in practice, because the scripts a skill carries are themselves tool capabilities, functionally redundant with what an MCP server provides. That redundancy forces developers into pointless choices and invites the ecosystem to fragment along a seam nobody has drawn.
The timeline is where the reporting gets sloppy. The spec shipped in October 2025; governance transferred in December 2025 under the umbrella of the Agentic AI Foundation, or AAIF, co-founded by Anthropic, OpenAI, and Block that same year — a foundation that had already absorbed MCP. Two events, two months apart, compressed by secondary sources into a single sentence. That compression matters because it hides the actual strategy: release fast, govern later, and let adoption create the fait accompli before anyone audits the terms.
And the terms are the tell. The donated assets, per the disclosure, were the standard's name, its logo, the GitHub organization, and the website domain. The retained assets — never mentioned in the same breath — are the reference implementation (the Skills runtime inside Claude), the related patents, and the model-side optimizations that make Claude unusually good at executing SKILL.md. Anthropic gave away the flag. It kept the army. Governance, meanwhile, was handed to a body whose membership reads like a who's-who of the very companies competing to own the agent stack. That is not a flaw in the donation; it is the design. A neutral venue is only valuable to the donor if the donor's rivals are inside it, bound by its procedures.
Here is where my audit lens kicks in. Based on my experience mapping the AI-agent economy in 2025 — when I led a small team analyzing Berachain's economic design against agent-to-agent commerce and argued it was better positioned than traditional EVM chains — I have learned to read standards by what they omit. When I audited Uniswap V2's bonding curves against traditional market-making in 2020, the lesson was that liquidity depth, not narrative, predicts survival. Standards obey the same law. Skills omits four things, and each omission is structural, not cosmetic.
The first omission is version management. In an ecosystem with a million-odd skills, an upstream change to one skill silently alters the behavior of every downstream agent that depends on it. There is no dependency lock, no semantic versioning, no resolution graph. This is npm before semver — a world where a maintainer's Tuesday patch breaks a thousand production agents by Wednesday. The disclosure's phrase "has proposed establishing version management" is doing enormous work: proposed means it does not exist. A standard without version management is not a standard; it is a convention waiting to fail under load.
The second omission is cross-model portability, which is unverified and probably unverifiable in the near term. The "70+ platforms" figure — ChatGPT, Cursor, GitHub Copilot and the rest — describes format compatibility, meaning those platforms can parse a SKILL.md. It does not describe behavioral consistency. The same natural-language instruction executes differently depending on the underlying model's instruction-following and context-management. This is the most abused use of the word "standard" in the current cycle: file-format unity is not behavioral portability. Anyone who has run the same prompt across two frontier models knows the gap is not marginal; it is categorical.
The third omission is retrieval and routing. Ask the obvious question: how does an agent locate, filter, and load one relevant skill out of a million inside a finite context window? This is the skill-retrieval problem — embedding indices, hierarchical loading, conflict resolution between competing skills that claim the same task. None of it is addressed. Without a routing layer, a million skills is not ecosystem prosperity; it is a noise catastrophe dressed as a marketplace. The number is a vanity metric until someone solves discovery.
The fourth omission is permission and provenance. The 76 malicious skills are the proof of concept. There is no signing requirement, no software bill of materials, no permission declaration inside the skill format, and therefore no clean way to map a skill's execution scope onto an enterprise's existing IAM stack. Snyk has stepped in to scan for malice — which is precisely the point: the security layer is being built by a third party because the standard itself declined to specify it.
Now the business logic, because "donation" is a strategy, not a gesture. Trace the money. Skills is free and open. A developer uses a skill to build an agent. The agent runs, and running requires model API calls. Anthropic books token revenue. This is structurally identical to npm being free, Node.js flourishing, and the cloud providers capturing the economics. Skills is customer acquisition, not a revenue line. The donation carries three motives stacked on top of each other: a neutrality endorsement that clears the enterprise-procurement bar (nobody buys a standard owned by one vendor), regulatory insulation against the antitrust and self-preferencing scrutiny that single-company standards attract, and the externalization of governance, documentation, and community cost onto a foundation and its contributors.
The real bet is subtler and it is the thing the crypto audience missed entirely. Anthropic is not betting on the skill ecosystem. It is betting on the perception that Claude is the model that executes skills best. The more the ecosystem grows, the more valuable that execution differential becomes — the exact Android playbook, where the operating system is open and Google retains GMS. The standard is neutral. Which model runs it best is not neutral. That asymmetry — open flag, retained army — is the highest craft in a standard war, and it is invisible in the press release.
Look at who is harvesting the periphery. skills.sh, operated by Vercel, has emerged as the directory and distribution channel — the npm registry of the agent era. Snyk owns the scanning layer. Neither belongs to Anthropic. This is the classic open-source value spill: the sponsor sows, the neighbors reap. But it also reveals where the durable margin sits. Whoever controls the registry controls visibility and ranking, and visibility is the only scarce resource in a market of a million near-identical packages. Vercel is quietly auditioning for the role of npm for agents, and the crypto world, which spent 2021 building decentralized package registries, is not even in the conversation.
Then there is the collateral damage to the middleware layer. LangChain, LlamaIndex, CrewAI — their core asset was the abstraction for decomposing a task across an LLM. Skills standardizes that abstraction into a file format, which commoditizes the pure orchestration layer and shoves framework value toward runtime and observability. History does not repeat, but it rhymes in code: this is Kubernetes standardizing container orchestration and marginalizing Mesos and Docker Swarm in the span of a product cycle. My window for the squeeze is 12 to 24 months. The prompt-trading market fares worse — PromptBase and its cousins sell tuned text, which is a collectible; Skills sells executable, composable, versionable packages, which are dependencies. That is dimensional replacement, not competition. And the RPA vendors face the most direct collision of all, because a task-step description and a process recording occupy the same abstraction rung.
The fifth thing Skills opens, and the press release ignores, is the enterprise knowledge-management market. Confluence, Notion, and the corporate wiki exist to sediment institutional knowledge. Skills makes that knowledge directly executable by an agent. Two categories of product that have coexisted for a decade now collide, and whoever wins the collision inherits the enterprise AI budget. The flip side is a leakage channel nobody has priced: a skill file can encode internal SOPs, business rules, and data schemas, and once it circulates through a public registry, that intellectual property walks out the door in plain Markdown. The standard offers no redaction primitive, no classification tag, no distribution control. Enterprises will discover this the way they always do — after the incident.
And the unit economics are a black box. Every skill description that enters an agent's context window consumes tokens, and tokens cost money. A workflow that loads five skills to complete a task pays for five sets of instructions on every invocation. The disclosure offers zero quantification of this overhead, which is precisely the number an enterprise needs to build a total-cost-of-ownership model before it commits. A standard that cannot be costed cannot be procured at scale. The absence is not an oversight; it is a convenience for the sponsor, whose revenue rises with every token the ambiguity generates.
The secondary casualties are quieter but real. Low-code agent builders — the Coze and Dify class of products — see their differentiation eroded the moment the orchestration layer becomes a portable file. And the geopolitical question goes entirely unasked: will the agent platforms of ByteDance, Alibaba, and Baidu adopt a standard governed by a US foundation whose steering committee is staffed by their American competitors? Standards are not adopted in a vacuum; they are adopted along the grain of trade and trust. A fragmented agent-standard map — US-aligned foundation on one side, sovereign stacks on the other — is a plausible and under-priced scenario.
Here is the crypto bridge, and it is uncomfortable. My 2025 research with a local university projected a $10 billion autonomous machine-economy market within five years, premised on agents requiring micro-transactions for data access and API calls — a use case I argued fit Layer-2 economics. I still believe the demand is real. But the behavior layer of that economy is now being written by a US foundation, governed by Anthropic, OpenAI, and Block, in rooms where the largest crypto-native agent projects have no seat. If the standard for how agents act lives off-chain, crypto's role narrows to settlement and payment rails — a real business, but a thinner margin than the tokens are pricing. Consider the unit economics I flagged in my Layer-2 work: agent commerce depends on micro-transactions, and micro-transactions depend on cheap blockspace. Post-Dencun blob capacity is not infinite; when it saturates, rollup fees reprice upward, and the thin margins of machine-to-machine payments compress with them. So the crypto side of the agent economy faces a double squeeze — a standardized behavior layer that lives off-chain, and a settlement layer whose costs are themselves cyclical. Neither pressure appears in the token narratives.
The consensus reading of this event, at least in the Web3 feeds that reposted it, is that a major AI lab embracing foundation governance is a tailwind for decentralized AI. I think the opposite is closer to the truth. The agent-standard war is not decentralizing; it is centralizing at speed, into a single neutral-looking venue. MCP, Skills, and Google's A2A — connection, behavior, and collaboration layers respectively — are all converging on the Linux Foundation ecosystem. That is not a plurality of governance; it is a consolidation of it, laundered through the word "neutral." The Web3 audience cheered a centralization event because the packaging said otherwise.
The second blind spot is the competition hiding inside the foundation. OpenAI is simultaneously an AAIF co-founder, a listed maintainer of Skills, and the force behind AGENTS.md — a functional competitor to Skills. That means Anthropic handed its behavioral standard to the care of its strongest rival, who retains a competing alternative and, inside the technical steering committee, a credible veto over Skills' direction. Maintained "in personal capacity" cuts both ways: it lowers the temperature of corporate warfare, but it strips contributors of contractual commitment and slows the standard's response time exactly when speed matters. Anyone who has watched W3C and IETF cadence during a fast-moving platform shift knows how this ends — slowly.
The third blind spot is the one crypto keeps making. In 2017, the ICO wave believed tokens would decentralize everything; the standards that actually won — ERC-20 — were thin, and the value accrued to exchanges and infrastructure. The pattern is repeating. The thin standard here is SKILL.md, and the value is accruing to the model layer and the registry. Crypto AI tokens that priced ownership of the agent standard are mispriced, because the standard was never the moat — execution and distribution were.
So watch three things, none of which are on a crypto exchange. First, the AAIF technical steering committee seat allocation: if OpenAI's weight there grows, Anthropic's retained execution edge gets diluted and the Claude-runs-skills-best premium compresses. Second, whether any crypto-native agent project builds an on-chain registry before Vercel's skills.sh becomes the default — because a registry is a settlement layer, and settlement layers are where crypto actually has a claim. Third, the Snyk-shaped security market: 76 malicious skills is a floor, not a ceiling, and the firm that owns agent-package attestation owns a toll road.
Capital flows where intelligence meets speed. Right now the intelligence is in the foundation and the speed is in the registry — and both are off-chain. The crypto AI trade is early to the narrative and late to the infrastructure. That gap is the trade.
