The Unbundling of ChatGPT: Agents, Skills and MCP

The One-Chatbot Era Is Over: Why AI Is Unbundling

For two years, the AI world revolved around a single question: which chatbot is best? That question is now obsolete. The monolithic chatbot is unbundling into composable parts — agents that gain capabilities by installing skills and connecting to tools, rather than waiting for one vendor to build everything in.

The shift happened fast. On November 25, 2024, Anthropic open-sourced the Model Context Protocol (MCP), a standard for connecting AI assistants to data sources and tools. Then in December 2025, it published Agent Skills as an open standard — markdown-based instruction packages that teach agents how to perform specific tasks — and donated MCP to the Linux Foundation's Agentic AI Foundation, making it vendor-neutral.

The adoption curve tells the story. OpenAI's Codex, Google's Gemini CLI, GitHub Copilot, and Cursor have all embraced the Agent Skills standard. Skills now run across Claude.ai, Claude Code, and the Claude Developer Platform, and the ecosystem has exploded past 100,000 published skills and counting.

The architecture is genuinely elegant. A skill costs roughly 100 tokens at startup — just a name and description — while MCP tool definitions can consume thousands of tokens before any work begins. As Sentry co-founder David Cramer puts it, "If skills teach you to cook, MCP provides the instruments that let you do it." Skills hold the process; MCP holds the access. They are complementary layers, not competitors.

But scale has outpaced quality. An analysis of 47,150 public skills found an average quality score of just 6.2 out of 12, and security researchers found roughly 21% of sampled skills carried serious risks. The uncomfortable reality:

• The skills ecosystem grew exponentially with no gatekeeping — anyone can publish.
• Quality varies wildly; curated skills lifted agent pass rates by 16.2 percentage points over uncurated ones.
• Security researchers demonstrated silent codebase exfiltration through a malicious skill in a coding agent.
• MCP gained structured OAuth-based governance; skills have no equivalent.

This is the core challenge for anyone adopting AI agents today: the library is enormous, but there is no reliable way to tell which skills actually help and which quietly introduce risk. Anthropic's own guidance is to treat installing a skill like installing software — read it before you trust it.

That is exactly the gap SkillzBench is being built to close: a free, independent directory that verifies, security-scans, and benchmarks skills, with a free MCP connector that wires only the skills you choose into your agent. In an unbundled world, trust becomes the scarce resource — and it has to be earned skill by skill.

Skills vs. MCP Is the Wrong Debate: How the Two Layers Fit Together

The "Skills versus MCP" framing makes for great headlines and terrible architecture advice. In practice, the two layers solve different problems, and the emerging default is to use both.

Skills hold process and knowledge. A skill is a small markdown package — essentially an onboarding guide for an agent — and it costs roughly 100 tokens at startup, because the agent initially loads only the skill's name and description. MCP holds live access to tools and data. Tool definitions for every connected server load at session start, which can easily run into thousands of tokens before any real work happens.

David Cramer of Sentry put the distinction plainly: if skills teach you to cook, MCP provides the instruments that let you do it. Anthropic makes the same point from the design side, describing skills as a way to teach agents more complex workflows that involve external tools and software.

Why does the split matter in daily use?

• A skill can tell the agent which tools to call, and in what order. The skill holds the process; MCP or a CLI holds the access.
• Because agents read skills on demand rather than all at once, the context bundled into a skill is effectively unbounded.
• One practitioner measured a 35x difference in token usage between a CLI approach and an MCP approach for the same task — a single anecdote, not an industry benchmark, but a useful illustration.
• If a skill's scripts start implementing authentication, retries, and paging for a large API, you are writing a bad MCP server in disguise.

The convergence is now explicit. MCP's own documentation recommends using skills to build MCP servers, and cross-vendor adoption runs from Claude and Codex to Gemini CLI, GitHub Copilot, and Cursor. Skills and MCP are two layers of one stack, not rival camps.

That stack is also where the risk concentrates. An analysis of 47,150 public skills found an average quality score of just 6.2 out of 12, while security researchers sampling nearly 700 skills flagged roughly 21.1% with serious risks. Treat installing a skill like installing software — and check what you are loading before it ships.

The Quality and Security Gap Nobody Is Talking About

A skill can teach your agent to cook — but nothing in the recipe guarantees the kitchen isn't bugged. As the skills ecosystem races past 100,000 packages, the evidence suggests most of what's on the shelf simply isn't very good, and some of it is actively dangerous.

The quality numbers come first. SkillsBench's analysis of 47,150 public skills found an average quality score of just 6.2 out of 12 — barely half the available marks. The same research found that curated skills lifted agent pass rates by 16.2 percentage points over uncurated ones, which means the gap between a good skill and a random one isn't academic. It's the difference between an agent that completes the task and one that quietly fails.

Security is the sharper problem. NSFOCUS Tianyuan Lab audited a sample of nearly 700 skills and found that roughly 21.1% carried serious risks, with another 39.5% rated medium severity. The most common issue was code execution — including patterns like shell=True — followed by input validation failures and unsafe file operations. Notably, the highest-risk categories were security tools themselves, along with educational content and browser automation skills.

Then there's the proof that this isn't theoretical. Mitiga Labs built a working proof-of-concept showing silent full-codebase exfiltration through a malicious skill loaded into Cursor. The attack required only four user interactions, and the skill-audit log came back empty. As Mitiga put it, skills aren't merely prompts — they're pre-baked behaviors, so a single one-click install can quietly wire exfiltration into your delivery flow.

The warning from practitioners and vendors alike has converged on one rule:

• Treat installing a skill like installing software — read the SKILL.md and its scripts before you use it, per the consensus guidance from practitioners and Anthropic's own documentation.
• Avoid one-click installs with no verification step — Mitiga calls this "the real red flag."
• Check what the skill's scripts actually do — if they implement authentication or network calls, they may be a bad MCP server in disguise.
• Watch what the agent does after installation, not just what it says — visibility into agent actions is the last line of defense.

This is exactly the gap SkillzBench is being built to close: an independent directory that pins every skill version to a commit SHA, security-scans and quality-judges each package, and benchmarks skills in a sandbox before you ever load them into an agent. Until verification becomes the default, the 6.2/12 average and the 21.1% serious-risk rate are the ecosystem's honest report card — and every unverified install is a bet against those odds.

How to Adopt Skills and MCP Without Getting Burned

Installing a skill is not like adding a bookmark — it is like installing software on your machine. That is the warning from multiple independent sources, and the data backs it up: in a sample of nearly 700 skills, security researchers at NSFOCUS found serious risks in about 21% of them, while a Mitiga Labs proof-of-concept demonstrated silent full-codebase exfiltration through a malicious skill loaded in Cursor.

The practical rules are simple. Before installing any skill, read the SKILL.md file and any bundled scripts yourself — a skill is Markdown plus optional executable code, and you should know what it does before your agent runs it. Pin every skill to a specific version so upstream changes cannot silently alter behavior, and check the license before you use anything in a commercial workflow.

Beyond basic hygiene, prefer curated skills over random downloads. The numbers are striking: an analysis of 47,150 public skills found an average quality score of just 6.2 out of 12, yet curated skills lifted agent pass rates by 16.2 percentage points over uncurated ones. Curation is not cosmetic — it measurably changes whether your agent succeeds.

Finally, match skills and MCP to the workload empirically rather than ideologically. Skills hold the process; MCP holds the access. If a skill's scripts start implementing authentication, retries, and paging for a large API, you are writing a bad MCP server in disguise. Test both approaches on your actual task and keep what works.

This is exactly the problem SkillzBench is being built to solve: a free directory that crawls and dedupes skills from GitHub, pins every version to a commit SHA, runs security scans and license checks, and benchmarks each skill in a sandbox with the same model — with and without the skill — publishing the Lift in percentage points so you can see what actually helps. A free MCP connector with per-agent loadouts lets you toggle skills and tools per agent, so the agent only sees what you chose. Everything is free; ad revenue funds the platform and never touches scores.

Until verification tooling is in your hands, treat every one-click install as the red flag it is. Skills, proven — join the SkillzBench waitlist to be first in line when the directory and MCP connector go live.

What Comes Next: Governance, Standards and Your Move

The protocol layer is hardening fast — but the skills layer still runs on trust and vibes. That asymmetry is where the next wave of incidents lives.

MCP's governance roadmap is well-defined. Enterprise-Managed Authorization reached stable status on June 18, 2026, with Okta as the first identity provider, and client and server adoption now spans Claude, VS Code, Asana, Atlassian, Figma, Linear, and Supabase. The July 2026 spec update went stateless — retiring the initialize handshake and session headers so servers run behind plain load balancers. A further revision, announced for the end of July 2026, targets hardened authorization and asynchronous tasks.

Skills have no equivalent. There is no OAuth layer for a SKILL.md file, no identity provider vouching for a markdown instruction package, and no audit trail when a skill silently changes between versions. Meanwhile the ecosystem has crossed 100,000 skills, with security research finding roughly 21% serious risk density in a sample of nearly 700.

What the ecosystem needs on the skills side is a verification layer — something that treats every skill like software, not like a prompt. Concretely, that means:

• Pinning every version to a commit SHA so you always know exactly what code and instructions you are running
• Security-scanning and license-checking before a skill ever reaches an agent
• Benchmarking each skill in a sandbox — same model, with and without the skill — so you can see measured Lift instead of marketing claims
• Tracking upstream changes and re-scanning when a maintainer pushes an update

This is precisely the gap SkillzBench is building to fill: a free, independent directory of agent skills plus a free MCP connector, organized around five pillars — Discover, Verify, Benchmark, Equip, and Stay current. Every skill gets a 0–100 trust score from security, quality, license, maintenance, and community signals, with benchmark Lift always shown separately and money never touching scores.

The unbundling of ChatGPT is not slowing down. Skills and MCP will keep diverging into specialized layers, and the winners will be the teams that adopt both — with verification. Start building your verified skill stack now: join the free SkillzBench waitlist and get early access to the directory, the benchmarks, and the MCP connector the day they launch.