Agent Plugins 1.0 開放標準出爐：AI Agent 擴充套件終於可以「寫一次，到處用」

The standard aims to solve a problem every AI agent developer has felt: having to package the same skill or tool connection differently for ChatGPT, Cursor, GitHub Copilot, and VS Code. Agent Plugins defines one package format that all compatible clients can load.

What the 1.0.0 specification actually defines

Agent Plugins 1.0.0 is a packaging-only standard. A minimal plugin is a directory containing exactly two things :

• A plugin.json manifest file at the root, identifying the spec version and naming the plugin
• A skills/ subdirectory containing Agent Skill files (.md files with instructions for the agent)

Optionally, a plugin can include an mcp.json file to configure MCP (Model Context Protocol) server connections, supporting all three transport methods . The spec defines how to bundle both Agent Skills (instruction-based capabilities) and MCP server configuration into a single distributable format .

What the standard deliberately does not specify: installation flows, permissions, sandboxing, trust models, or runtime behavior. Those are left entirely to individual client implementations . As one analysis put it, the standard is "a thin layer" over existing skills and MCP configs rather than a full runtime specification .

Launch clients and governance

At launch, the same plugin format is supported by six major clients :

• OpenAI's Codex and ChatGPT
• Cursor
• GitHub Copilot
• Amazon's Kiro
• VS Code

The Technical Steering Committee consists of core maintainers from Amazon, Cursor, Microsoft, OpenAI, and Vercel . Google joined as a Core Maintainer on launch day, represented by Kevin Hou, a senior staff engineer at Google DeepMind . The project's specification repository has been developed in the open since April 2026, and the project claims no single company's product roadmap sets the format's direction .

Notably absent from the steering committee: Anthropic — the inventor of both MCP and Agent Skills .

Security concerns: a standard that explicitly punts on safety

Because Agent Plugins only standardizes packaging and leaves security to each client, it inherits a well-documented set of risks. Earlier in 2026, security researchers demonstrated that malicious Agent Skills can routinely bypass commercial scanners :

• Trail of Bits researchers bypassed malicious-skill detectors for ClawHub, Cisco, and Vercel's skills.sh platform — in three of four cases in under an hour — using whitespace inflation, bytecode hiding, and prompt injection .
• HKUST researchers found that across eight scanners and 1,613 in-the-wild malicious skills, packing techniques bypassed every scanner at over 90% .
• ESET Research analyzed around 800,000 agentic skills between March and May 2026 and found over 25,000 suspicious cases .
• Security firm AIR demonstrated a fake skill that passed every scanner and reached an estimated 26,000 agents by pointing to an external link that swapped from benign to malicious after approval .

The Agent Plugins specification's minimal scope means none of these problems are addressed at the standard level. Each client must solve them independently — or not .

Developer reactions: praised and dismissed

Opinion among developers is sharply divided :

• Dax Raad (SST developer-tools framework) said he was "very much against" it, calling it "a thin standard" whose useful parts will end up in client-specific extensions anyway .
• Angie Jones celebrated the interoperability, posting "Oh we neeeeded this! I've been begging for a way to use my Skills and MCPs across the various harnesses I use" .
• Commenters on the OpenAI community forum welcomed the standardization as "the only realistic path toward reusable agent extensions that are not permanently locked to a single vendor" .

Competitive implications: USB-C for AI agents, or a moat for incumbents?

Agent Plugins arrives as the industry's competitive focus shifts from AI models to infrastructure and agent ecosystems . The standard lowers the barrier for smaller developers — package once, reach every major agent client. But it also risks entrenching platforms with the largest user bases, since the real differentiation (permissions, trust models, installation flows, marketplace reach) happens in client-specific extensions above the standard layer . The absence of Anthropic — the inventor of both MCP and Agent Skills — from the steering committee also raised eyebrows, signaling a potential competitive bloc among the signatories .

By defining only the narrowest common denominator, the standard reduces fragmentation for developers while ceding the most consequential decisions — security, trust, distribution — back to the platforms that implement it .