Agent Skills Standard Transferred to Linux Foundation, Plus Three Updates to AI Coding Tools

Four Layers of Agentic Coding Infrastructure Are Taking Shape

The latest short video from AI Daily Signal uses four news briefs to sketch out the four layers of agentic coding infrastructure: neutral governance of standards, the tooling of agents-as-code, workspace trust gating, and changes to editor default behavior. The four items may seem unrelated, but together they point to the same trend — around the practice of having AI agents write code, the industry is shifting from "a feature from some company" to "an engineering system with public rules to follow."

Below, each item is broken down, with an explanation of why each one deserves developers' attention.

1. The Agent Skills Standard Is No Longer Exclusively Controlled by Anthropic

According to AI Daily Signal, Anthropic has transferred its Agent Skills standard to the Agentic AI Foundation — an organization hosted by the Linux Foundation and co-founded with Block and OpenAI. The two figures provided in the source material illustrate the standard's actual penetration: more than 70 platforms have adopted it, with installs approaching 280 million.

The significance lies in the change in governance structure. Previously, de facto control over this skill format rested with a single company, and other platforms adopting it meant binding their tool ecosystems to one vendor's roadmap. After the transfer, the evolution of the standard is decided jointly by foundation members, and adopters no longer need to worry that the rules could one day be rewritten unilaterally.

The direct impact on ordinary developers is indirect but real: cross-platform skill packages are more likely to remain compatible, and skill descriptions written for one platform will not become invalid due to upstream changes. For a format that has already reached hundreds of millions of installs, neutral governance is a prerequisite for its continued expansion, not an optional gesture.

What Are Agent Skills

Agent Skills is a format specification proposed by Anthropic for describing the capabilities that AI agents can invoke. It typically exists as structured files (such as skill manifests, prompt templates, and tool declarations), allowing different platforms to discover, load, and execute agent skills in a unified way. You can think of it as the "plugin description protocol" of the agent world: write a skill package once, and multiple platforms can reuse it.

What Linux Foundation Hosting Means

The Linux Foundation is a nonprofit open-source foundation that hosts many critical open-source projects, including the Linux kernel, Kubernetes, and Node.js. Standards hosted by it typically adopt an open governance model: technical decisions are made by votes of member committees or technical steering committees rather than dictated by a single donating company. This structure reduces the risk of vendor lock-in and is an important precondition for enterprises to be willing to bet on a standard over the long term.

2. Cursor Releases Agent SDK: Write Agents Like Ordinary Software

Cursor has launched the Agent SDK, allowing developers to define coding agents in code — prompts written in Markdown, tools implemented in TypeScript. According to the source material, this framework is precisely the underlying support for Cursor's own BugBot and Security Reviewer.

This detail is more persuasive than the SDK itself: it is not an interface hastily built for external users, but something first proven in the company's internal products and then released externally.

The core value of "agents-as-code" lies on the engineering side. Once prompts and tools land in files, they can enter version control, have unit tests written for them, go through CI pipelines, and be deployed by environment. Changes in agent behavior now have diffs to inspect, rather than being scattered in a text box in some configuration UI. For teams that have already brought AI agents into production workflows, this determines whether agents can be managed as formal assets.

The Relationship Between "Agents-as-Code" and Infrastructure-as-Code

The approach of the Agent SDK can be compared to how Infrastructure as Code (IaC) transformed the operations industry. Before IaC, server configurations were scattered across console clicks and manual scripts, making them hard to reproduce and audit; after tools like Terraform turned configuration into declarative code, environments could be version-controlled and automatically tested. Agents-as-code does the same thing, except the object shifts from servers to the prompts, tool permissions, and behavioral logic of AI agents.

The Significance of BugBot and Security Reviewer

BugBot is Cursor's built-in automated code review agent, which checks for defects when code is committed; Security Reviewer focuses on scanning for security vulnerabilities. These two products have high reliability requirements. The fact that the SDK was validated by them before external release shows that its abstractions can already carry production-grade workloads, rather than being merely lightweight wrappers for demos.

3. Cairo CLI 2.33: Confirm Trust Before Cloning a Repository

Version 2.33 of Cairo CLI adds a trust gate: before loading a folder's hooks, agents, or MCP servers, it first asks the user to confirm whether they trust that folder. The confirmation prompt appears only once per folder, and the choice is automatically saved so the user is not asked again.

This closes off a real attack surface. Configuration files in a repository can define hooks and MCP servers, and such configurations have execution capability when loaded. If a tool reads them unconditionally by default, then cloning an untrusted repository is equivalent to directly running the agent configuration inside it. With a one-time trust confirmation added, the act of cloning can no longer silently change agent behavior, while daily use does not turn into a string of pop-ups — asking only once per folder is a pragmatic trade-off between security and experience.

Why hooks, agents, and MCP servers Have Execution Capability

Cairo CLI is a smart contract development toolchain launched by Circle. In its configuration, hooks are scripts automatically triggered by specific events (such as before compilation or deployment), agents are agent behavior definitions, and MCP servers are external tool services connected through the Model Context Protocol. What the three have in common is that once loaded, the commands or service connections declared in the configuration may be executed, so repository configuration files essentially carry code execution semantics.

The General Pattern of Trust Gating

This "confirm once per directory" design has precedents in development tools, such as VS Code's Workspace Trust mechanism: when opening an unfamiliar folder, automated tasks and debug execution are restricted first, and the user decides whether to grant full permissions. It pushes the security boundary down from a "global switch" to "per-project granularity," striking a balance between preventing silent execution and avoiding frequent interruptions.

4. Devin Desktop Turns Off the Agent Diff Staging Area by Default

This month, Devin Desktop (i.e., Windsurf) changed the agent diff area to be off by default, so edits made by the agent are written directly to files rather than first entering a staging preview area. Users can still re-enable it in settings.

This change looks like merely a switch flipped in the other direction, but what it actually changes is the default path of the workflow. A staging preview means every agent edit must be manually reviewed before being written to disk — safe but slowing the pace; direct writing treats the agent as a trusted editor — prioritizing efficiency. Which way the default leans reflects how much the product is betting on the judgment that "the agent is already reliable enough." For developers accustomed to reviewing agent changes one by one, they need to actively go into settings to restore the old behavior; for those pursuing speed, there is one less confirmation step. Both preferences are valid, but there is only one default.

What These Four News Items Together Reveal

Lay out the four items by layer: the transfer of Agent Skills to the foundation addresses who sets the rules at the standards layer; the Cursor Agent SDK addresses how agents are managed in an engineering way at the agent layer; Cairo CLI's trust gate addresses how the execution layer prevents untrusted configurations from being silently loaded; and the default-value adjustment in Devin Desktop addresses where the interaction layer places people in the process by default.

The four directions are not centrally coordinated, yet they move in the same direction at the same time: agentic coding is filling in the infrastructure it lacks as a serious engineering practice. Standards must be neutral, agents must be testable, execution must have boundaries, and editor default behavior must take a clear stance. If any layer is missing, the whole system will get stuck somewhere. For developers, what is worth watching is not any single feature release, but the fact that these four layers are meshing with one another.

One-line Summary

Four news briefs show that agentic coding is forming four layers of infrastructure: standards, tooling, trust, and interaction.

Paragraph Summary

Using four news briefs from AI Daily Signal as its thread, the article outlines four layers of agentic coding infrastructure: Anthropic transfers the Agent Skills standard to the Agentic AI Foundation under the Linux Foundation, moving standards governance toward neutrality; Cursor releases the Agent SDK, writing prompts in Markdown and tools in TypeScript so agents can be version-controlled and tested like ordinary software; Cairo CLI 2.33 adds one-time folder trust confirmation before loading hooks, agents, or MCP servers, closing the attack surface of silently executing configuration when cloning a repository; and Devin Desktop turns off the agent diff staging area by default, letting agent edits be written directly to disk. The author believes that although the four are not centrally coordinated, together they are pushing agentic coding from isolated features toward an engineering system with public rules to follow.