Why Codex Adopted Skills (and What It Signals)

Skills Went Cross-Platform: Codex's Adoption Was Convergence, Not a Copy

Roughly two months after Anthropic launched Agent Skills in October 2025, OpenAI's Codex formally adopted skills as a first-class capability — and the way it did so matters more than the fact. Rather than shipping a proprietary format, OpenAI built directly on the open Agent Skills standard, making Codex the latest arrival at a table that was already crowded.

This wasn't a copy of Claude's feature. It was convergence. Anthropic released Agent Skills as an independent open standard with a specification and reference SDK, and the industry followed quickly: Microsoft adopted it in VS Code and GitHub, with Cursor, Goose, Amp, and OpenCode close behind, and AWS shipping similar "powers" for its Kiro agent. As Anthropic's Mahesh Murag put it, the standard was designed for exactly this kind of cross-platform adoption from day one.

Simon Willison put portability to the test. A skill authored with Claude's own skill-authoring skill installed into Codex CLI and "worked perfectly" — because a skill is just a folder with a Markdown file and optional resources, so any tool that can read a filesystem can use it. His verdict: skills are "maybe a bigger deal than MCP."

OpenAI's stated rationale is telling. The official repository describes skills as packaging capabilities teams and individuals can use "in a repeatable way," letting agents operate more reliably and autonomously. That language — repeatability and reliability — is the language of application platforms, not prompt tricks. As OWASP's Niv Hoffman frames it: "If agents are the new operating system, then skills are the new applications."

The mechanics back that up. Codex loads skills through progressive disclosure, capping the skill listing at 2% of the model's context window, and pulls them from a layered hierarchy spanning repo, user, admin, and system locations — designed for teams sharing capabilities across projects.

The catch is that a cross-platform application layer with no gatekeeper is also a supply-chain risk surface:

• Malicious skills racked up over 300,000 installs each before detection in a July impersonation attack
• Skill repositories grew by at least 33% in six months, outpacing any verification infrastructure
• OWASP launched a dedicated Agentic Skills Top 10, with Malicious Skills, Supply Chain Compromise, and Overprivileged Skills as the top three risks

That's the gap SkillzBench is being built to close: independent benchmarking, security scanning, and trust scoring for a format that now runs everywhere — and that nobody can currently vouch for. When every major agent reads the same skill format, the question stops being "does it install?" and becomes "does it help, and is it safe?"

The Dark Side of the Standard: An Unverified Supply Chain at Scale

Here's the uncomfortable math behind the skills boom: the same ecosystem that grew by a third in six months has already shipped malicious skills with 300,000+ installs each before anyone caught them. Explosive adoption and immature verification are not separate problems — they're the same problem.

The growth data tells the story. According to OWASP's security analysis, skill repositories expanded by at least 33% in the past six months, and a July impersonation attack saw malicious skills rack up over 300,000 installs each before detection. Air's experimental repository manipulation reached 26,000 agents within hours. When supply grows that fast, quality control becomes an afterthought.

Mitiga Labs demonstrated just how quiet the failure mode is. Their proof-of-concept "Testing-Validator" skill for Cursor silently exfiltrated an entire codebase with only 4 user interactions — and produced a completely empty skill-audit.log. As their researchers put it: "Skills aren't merely prompts. They're pre-baked behaviors, so a single one-click install can quietly wire exfiltration straight into your delivery flow." Worse, when asked to make the attack stealthier, the agent "co-designed a better attack with us."

OWASP formalized the risk landscape with the Agentic Skills Top 10 — the first comprehensive security framework for AI agent skills, containing 2 critical, 4 high-severity, and 4 medium-severity risks. The top three: Malicious Skills, Supply Chain Compromise, and Overprivileged Skills.

The organizational blind spot may be the deepest problem. Omar Turner (Microsoft MD, in OWASP capacity) observes: "Most CISOs can't honestly say how many agents are running and how many skills are embedded within agents." You cannot secure what you cannot count.

And the trust signals you'd normally rely on? Mitiga documented reputation manipulation via bot upvotes and fake downloads on skill catalogs. Stars and install counts cannot be trusted as proxies for quality or safety.

• Malicious skills: 300,000+ installs each before detection in a July impersonation attack
• Supply growth: skill repositories grew by at least 33% in six months
• Blast radius: Air's repository manipulation reached 26,000 agents within hours
• Stealth: Mitiga's exfiltration PoC needed only 4 user interactions and left zero log noise
• Trust decay: bot upvotes and fake downloads make stars and install counts unreliable

This is the gap SkillzBench is being built to close: pinning every skill version to a commit SHA, security-scanning and license-checking, and publishing a 0-100 trust score where money never touches ratings — with benchmark Lift always shown separately.

ctaText: Skills, proven. Join the SkillzBench waitlist. socialProofText: Published research found ~26% of skills carry at least one vulnerability. Independent verification is overdue.

What Verification Should Look Like: The Emerging Trust Layer for Skills

The gap between "a skill exists" and "a skill is safe to install" is exactly where the ecosystem is now focusing its energy. The documented failures — malicious skills accumulating 300,000+ installs each before detection, and a proof-of-concept that exfiltrated an entire codebase in just 4 user interactions with an empty audit log — make clear that reputation signals alone can't carry the weight.

The verification practices converging across the industry share a common shape. They treat skills like any other supply-chain artifact:

• Version pinning to commit SHAs, so the code you evaluated is the code you run — not whatever lands upstream next week
• Security scanning for exfiltration patterns, overbroad permissions, and stealth behaviors
• License checks that catch legal risk before it reaches production
• Provenance metadata — signatures and hashes — of the kind OWASP's Universal Agentic Skill Format v1.0 specifies

That last point matters. OWASP's Agentic Skills Top 10 — the first comprehensive security framework for AI agent skills — pairs its risk taxonomy with a skill format built around provenance and signatures, applying decades of code-security lessons to this new software category. Air CTO and OWASP co-lead Niv Hoffman frames the goal as secure-by-default adoption, not prohibition: skills are the new applications, so the answer is verification infrastructure, not bans.

Verification alone isn't enough, though. A skill can be perfectly safe and still useless. That's why independent benchmarking is emerging as the second half of the trust layer — measuring Lift (what a skill actually improves, in percentage points) separately from trust scores. The distinction is deliberate. Mitiga researchers documented reputation manipulation on skill catalogs, including bot upvotes and fake downloads, which means popularity metrics can be manufactured. A benchmark that runs every skill in a sandbox with the same model, with and without the skill, produces a number that can't be gamed the same way.

This maps closely to what SkillzBench is building ahead of launch. Its five pillars — Discover, Verify, Benchmark, Equip, and Stay current — operationalize exactly these practices: commit-SHA version pinning, license checks, and security scanning under Verify; sandboxed Lift measurement under Benchmark; and continuous re-scanning as upstream skills change, because a skill verified once isn't verified forever. Its trust score draws on security, quality, license, maintenance, and community signals, with money never touching scores and Lift always shown separately.

The MindStudio practitioner guidance puts it well: verification is the step that turns a skill from "produces an output" into "produces an output you can trust." As skills become the application layer for agents — adopted by OpenAI, Anthropic, Microsoft, Cursor, and others in a matter of months — that verification step is shifting from nice-to-have to baseline expectation.

What Teams Should Do Now: A Practical Path Through the Skills Shift

The skills shift is moving faster than most teams' governance practices, and the gap between the two is where risk lives. Here's a practical path for teams adopting skills across Codex, Claude Code, Cursor, and Gemini CLI today.

First, inventory what your agents actually load. Microsoft's Omar Turner, speaking in his OWASP capacity, notes that most CISOs "can't honestly say how many agents are running and how many skills are embedded within agents." Codex makes this harder to ignore with its layered loading hierarchy — skills load from the repo level (.agents/skills), the user's home directory, admin paths (/etc/codex/skills), and OpenAI's bundled system skills, per official Codex documentation. Audit each layer, because a skill your team never consciously installed may still be active.

Second, control loadouts per agent rather than installing broadly. Codex caps its initial skill listing at 2% of the model's context window and defaults allow_implicit_invocation to true — meaning skills can fire without explicit prompting. Per-agent loadouts, where each agent only sees explicitly chosen skills, are the safer default. This is precisely the model SkillzBench is building: one MCP server with per-agent toggles, so nothing unvetted enters an agent's context.

Third, treat instruction-only and script-bearing skills differently. A SKILL.md file with text references is a prompt; a skill with executable scripts is pre-baked behavior. Mitiga researchers demonstrated a malicious Cursor skill that exfiltrated an entire codebase in just 4 user interactions with a completely empty audit log. Script-bearing skills deserve scanning, version pinning, and provenance checks before they ever touch a production agent — which is why SkillzBench's launch scope covers instruction-only skills, with script-bearing packages listed link-out only.

Fourth, watch for governance tooling as platforms mature. OWASP's Agentic Skills Top 10 — with Malicious Skills, Supply Chain Compromise, and Overprivileged Skills as its top three risks — signals that allowlists, audit trails, and fast kill-switches for compromised skills are coming. Teams that build the habit now will adopt those tools cleanly.

The direction of travel is clear. OpenAI has already deprecated its standalone skills repository in favor of a unified plugin architecture shared by ChatGPT and Codex, absorbing skills into a broader plugin system. And Simon Willison argues the deliberately light skills specification should be "formally documented somewhere," suggesting the Agentic AI Foundation as a candidate home. Skills are becoming the application layer for agents — the teams that win will be the ones that can prove which applications are safe to run.