Agent Skills go neutral, Claude Code closes fail-open gaps, and MCP retries get a stop sign

A quiet window, and this issue says so. The one structural change is that Agent Skills is no longer an Anthropic project: it now sits next to MCP in a neutral foundation. Claude Code shipped three small releases, mostly security hardening. The research section has three papers worth your time, two of them on the harness questions this issue keeps returning to.

The top 3

1. Agent Skills now lives at the Agentic AI Foundation

On 22 October Anthropic announced it is donating Agent Skills, the SKILL.md folder format for giving an agent reusable knowledge and workflows, to the Agentic AI Foundation, which is hosted by the Linux Foundation. The foundation already holds MCP. Anthropic also handed over the name, logo, GitHub organisation and the agentskills.io domain. Maintainers will act as individuals, with engineers from Anthropic, Google, OpenAI and others. The proposed roadmap covers versioned releases, a formal proposal process, and security guidance for people who write and install skills. By Anthropic’s own figures, more than 70 agent platforms have integrated the format, about a million skills have been published and nearly 280 million installed.

Why it matters: a skill is now a portable artifact rather than a Claude feature. A folder you write once is meant to run in ChatGPT, Cursor, Copilot and VS Code as well. The same post says skills can bundle executable scripts, and the roadmap lists security guidance as a future item, so a million published skills with no vetting story is the part to watch. Treat an installed skill like an installed dependency.

Source: Anthropic, Donating Agent Skills to the Agentic AI Foundation, agentskills repository

2. Three Claude Code releases close places where safety checks failed open

2.1.309 fixes PowerShell hooks that did not block when the hook program exited with code 2, and Windows PreToolUse and PermissionRequest hooks that failed open when Git for Windows was not installed. 2.1.310 fixes the same family: hooks whose command was only quoted strings let a call through when Git Bash was missing. 2.1.309 also stops sandboxed commands and auto-accepted edits from modifying the file passed with --mcp-config, and stops sandboxed Bash on macOS and Linux from running shell startup files outside the sandbox. A disabled MCP server could previously be reconnected by a later permission prompt in print and SDK sessions; that is fixed too.

Why it matters: these are fixes, not new features, but they share a shape: a guard that existed on paper and did nothing in a particular environment. If you use hooks as a control, a missing interpreter or a platform you did not test is a way for the control to vanish. Upgrade, then test the failure path of every blocking hook on every platform your team uses.

Source: Claude Code CHANGELOG, 2.1.309 and 2.1.310

3. A timed-out MCP call now tells the model not to repeat it

2.1.310 changes the error for an MCP tool call that times out in a non-interactive session while the server’s elicitation (a question the server asked the user) is unanswered. It now tells Claude that no answer came and not to repeat the call. Issue 4 covered 2.1.307 retrying HTTP MCP calls only for read-only or idempotent tools; this is the model-side counterpart. Separately, 2.1.310 stops requests failing on gateways that reject the effort-2025-11-24 beta value or mid-conversation system messages, by retrying without them.

Why it matters: repeat behaviour is being decided in two places, the client’s transport retry and the model’s own next move, and both now lean on what the server declares about its tools. A server that asks questions in unattended runs needs a plan for the unanswered case.

Source: Claude Code CHANGELOG, 2.1.310

Signal radar

Skill supply chain is the next MCP-registry problem

WATCH Medium confidence.

Issue 4 cited a third-party analysis suggesting most MCP registry servers go stale. Skills have the same shape at larger scale, and they can carry scripts. The foundation’s roadmap names security guidance for authors and installers but gives no date. Expect the first public write-ups of a malicious or broken popular skill before that guidance lands. This is an inference from the numbers, not a reported incident.

Source: Anthropic announcement

Cursor’s Origin marketplace and cloud agents

WATCH Speculative, unverified.

A secondary outlet, tech-insider.org, reports Cursor shipped a public app marketplace called Origin on 13 October, plus cloud agents that manage up to 300 repositories. I could not reach Cursor’s changelog to confirm the dates or the numbers. Its only support here is that single article, so treat it as a lead to check.

Source: tech-insider.org, summary of Cursor’s October releases (secondary, unverified)

Research frontier

What open-source projects tell their coding agents: a census of AGENTS.md and CLAUDE.md

CONTEXT Horizon: already shipping. Single author (Pawel Zarzycki); no institution stated.

arXiv 2610.31715. A census of 22,854 popular, active GitHub repositories in thirteen languages, reading each root AGENTS.md and CLAUDE.md as one instruction set. 26.3% of repositories have agent instructions, rising to 59.6% among the most-starred, and where both files exist CLAUDE.md usually just points to AGENTS.md. Of the directives, 74.0% give no reason. Projects split on AI attribution: commit-message rules more often forbid it, while pull-request rules more often require disclosure. A third of instruction sets look tool-generated, and four in five were edited after creation.

Why it matters: this is the first large look at what teams actually put in these files, and the gap is the “why”. A rule with no reason is hard for an agent to apply to a case it wasn’t written for, and hard for the next maintainer to judge. If you keep one of these files, give each rule its reason in a short clause, and make one file the source of truth with the other pointing to it.

StateMirror: catching hallucinated tool calls before they run

WATCH Horizon: 12 months. Sun Yat-sen University and Singapore Management University.

arXiv 2610.32648. Coding agents often propose actions that can’t work in the real environment: a path that doesn’t exist, a package that isn’t installed. Across 4,398 agent trajectories, each such mistake cost a median of 3 extra steps and 22.4K tokens to recover from. StateMirror sits at the harness boundary, extracts what each action assumes (files, packages, commands) by analysing the code and command, and checks those assumptions against the live repository before running anything. On 2,508 actions it caught these mistakes with 0.940 precision and 0.817 F1, beating the strongest LLM judge by 35.3% F1, in about 1.5 ms instead of 17.7 s and with no tokens. On 79 live tasks it cut execution time by 15.8% and tokens by 11.8% without lowering the solve rate. These are the authors’ own figures.

Why it matters: it is the deterministic version of the pre-tool-use hooks this issue’s Top 3 is about. A cheap check on state, not a model’s opinion, stops a whole class of wasted turns. You can approximate it today with a PreToolUse hook that verifies paths and packages exist before a command runs. Connects to the Harness layer entry on the Watch board; no status change.

Cache engineering for agents

WATCH Horizon: 2+ years for serving stacks you don’t run yourself. Tsinghua University, with The Chinese University of Hong Kong.

arXiv 2610.28577. Submitted 20 October; featured on Hugging Face Daily Papers on 22 October with 159 upvotes. Today, keeping an agent’s context small means trimming or summarising its history, which invalidates the cached prefix and forces the model to re-read what it kept. The paper lets the agent act on its key-value cache directly instead: drop selected parts from future attention and re-position what stays, without rewriting the history. A policy that rolls tool responses out of the cache scored 1.7 points higher on average and cost 27.7% less than threshold-triggered summarisation. Their serving engine, AKV, reached up to 1.2x output throughput. Code is public.

Why it matters: it reframes context engineering as cache engineering. The cost of an agent run depends on what you can drop without paying to re-read the rest. You can’t use this through a hosted API today, but it is the direction prompt-cache pricing and “compact before the cache expires” features are heading. Connects to the Context engineering entry on the Watch board; no status change.

Papers were found through the arXiv API and Hugging Face Daily Papers, and each was read from its abstract and full-text pages.

New capabilities to adopt

Upgrade to 2.1.310 and test your blocking hooks

ACT NOW

The fail-open fixes only help once you are on the fixed version. Write a throwaway hook that must block, remove its interpreter or break its path, and confirm the tool call is refused. About 20 minutes per platform.

Write one skill and run it in a second agent

ACT NOW

A SKILL.md folder is now meant to be portable. Take a repeated chore of yours and turn it into a skill, then check whether another agent that supports the format runs it the same way. About 45 minutes; see the experiment below.

Scripts that call claude ultrareview

WATCH

2.1.309 makes claude ultrareview require workspace trust. Scripts pass --trust-workspace, which takes no value, or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1. Only the first is a sensible default; the variable turns the check off. About 5 minutes if you have such a script.

Source: Claude Code CHANGELOG, 2.1.309 and 2.1.310

Disruption watch

One entry is new and the rest held. The full board, with history, is on the Watch page.

• New: Portable agent skills. Hitting the market. Evidence: the 22 October donation to a neutral foundation, 70-plus integrating platforms and about a million published skills (all Anthropic’s figures). It enters at that rung rather than Watching because the adoption claim is already broad; no independent count exists. What to do differently: write reusable agent procedures as skills, and vet the ones you install.
• Harness layer, Hitting the market, held. The 2.1.309 and 2.1.310 fixes are repair work and add history, not a rung.
• MCP and tool protocols, Repricing the work, held. The “do not repeat the call” error adds to the repeat-semantics story from issue 4.
• Everything else held. Open-weight models, app generation, autonomous QA, design generation, pricing pressure and AI-native infrastructure had no verified dated news this window. That is a lack of evidence, not a fresh check.

Practice shifts

Test the failure path of every guard

ACT NOW

On Monday, list the hooks, sandbox settings and permission rules you rely on. For each, break the thing it depends on (interpreter, path, network) and see whether it blocks or lets the call through. A control you have never seen fail closed is a guess.

Version your procedures as skills, not prompts

WATCH

If you paste the same multi-step instructions into agents, move them into a folder with a SKILL.md, commit it, and review changes like code. A portable format makes that worth doing now.

Decide what a server does when nobody answers

CONTEXT

If your MCP server asks questions mid-call, define behaviour for an unattended run: a safe default, or a clear failure the model will not retry.

This week’s experiment

Build a skill and find out how portable it really is. 45–60 minutes.

Build: pick a chore you repeat, such as “review a pull request against our checklist” or “write release notes from merged PRs”. Write it as a skill folder: a SKILL.md with a name, a description that says when to use it, and numbered steps, plus one small script it calls. Install it in Claude Code, then in one other agent that lists Agent Skills support.

Done when:

1. The skill runs end to end in both agents on the same sample input.
2. You have written down every difference in output or behaviour, and whether it came from the skill file or the agent.
3. The script fails visibly, not silently, when its input is missing.
4. A three-line note says what you would check before installing someone else’s skill.

---

Sourcing: Anthropic’s announcement and the Claude Code changelog were read directly. The three papers were read on arXiv; their figures are the authors’ own. The agentskills repository page was read for its star count only. The Cursor item rests on one secondary article and is marked unverified.