Agent Skills Are Becoming a Vendor Channel. Read the License First.

Agent skills started as a community convention: a folder of markdown that teaches a coding agent how to do something properly. In the last 48 hours that changed shape. Unity published 31 official skills for Claude Code under a restricted license. Google Maps Platform turned out to have shipped its own three months earlier under Apache 2.0. Four unrelated community skill repos hit GitHub trending overnight, every one of them MIT. The format is standardizing fast while the licensing splits in two directions. Unity’s collection runs roughly eighteen times larger than Google’s by word count. It is also the only one containing guidance for removing a competitor’s software from your project. None of this appears in any launch post. Best for developers already running Claude Code, Codex or Grok daily. Not ideal for anyone expecting these to work like normal open source packages.

Four agent skill repos hit GitHub trending this morning. Chinese government document formatting. App monetization. 3D visualization. United Arab Emirates corporate tax.

All four created in the last two days. All four MIT.

Meanwhile the two biggest names to ship official skills went in opposite directions on licensing. Neither mentioned it.

Something is happening to this format faster than anyone is documenting it.

What Actually Shipped

Every figure below came from the repositories themselves. I downloaded each build then counted.

Read that table sideways and the story appears. Three groups converged on one format within three months. They agree on almost nothing else.

Google Was First by Three Months

Google Maps Platform posted about its agent skills yesterday, describing them as new. They are not new.

What the repo says

The repository went up on June 15, 2026. Its last commit landed on August 17, which puts it 24 days stale as of this morning. It carries 46 stars. So Google shipped first-party agent skills roughly twelve weeks before Unity did, then largely stopped touching them.

That matters for how the Unity plugin story gets read. Unity looked like the opening move by a platform vendor. It was the loud move, not the first one.

Why nobody noticed

Google shipped one skill covering its whole platform, at 3,297 words, with two supporting files. No announcement thread. No marketplace listing on launch. It went up, it sat there, it collected 46 stars over a summer.

Unity shipped 31 skills through Anthropic’s plugin directory with a launch post from an account carrying 461,000 followers. One of those approaches gets written about. The other gets found by somebody reading repositories on a Thursday.

The Size Gap Is Eighteen to One

Unity’s collection runs about 59,870 words of instructions across 6,842 lines, plus 89 reference files that load only when a task calls for them. Google’s runs 3,297 words total.

What Unity spent it on

Depth, mostly. The depth is real. Skills detect which of Unity’s competing implementations your project uses before proposing anything. Several run a diagnostic pass first. The render pipeline migration skill alone runs 543 lines with six references attached.

That reflects the surface area. Unity ships three separate UI systems plus two render pipelines, so a large share of those words exist to stop an agent picking the wrong one.

What Google spent it on

Almost nothing, deliberately. One skill, one platform, a few thousand words telling the agent which APIs exist plus how to call them correctly.

Neither approach is wrong. They solve different problems. But if you assumed official skills means a comparable product across vendors, these two are not the same category of thing. No launch post tells you which you are getting.

Only One Collection Steers You Off Competitors

Here the two diverge in a way that has nothing to do with size.

Unity’s numbers

Inside Unity’s in-app purchases skill sit reference files named convert-revenuecat.md plus convert-adapty.md. Each runs a structured assessment of a project already using a rival monetization SDK, including a path to complete removal before Unity IAP goes in.

Across the collection: 107 references to Adapty, 106 to ironSource, 74 to RevenueCat, 50 to UniPay then 43 to Essential Kit.

The guidance itself reads fairly. Unity’s own file notes that RevenueCat calls Apple StoreKit plus Google BillingClient through its native code, so no clean swap exists. It tells the agent to assess what Unity IAP can actually replace before recommending anything.

Google’s numbers

I ran the same search across Google’s repo for Mapbox, OpenStreetMap, TomTom then Leaflet.

Zero mentions. Not one.

Google shipped documentation for its own APIs and stopped there. Given that Google Maps competes with Mapbox directly, the restraint is a choice rather than an oversight.

So the format now carries competitive positioning in one implementation while carrying none in another. Both call themselves official skills. A developer installing either sees the same thing in their plugin list.

The Community Is Still Shipping MIT

While two vendors picked opposite licenses, the people who invented this format kept doing what they were already doing.

What landed overnight

Four skill repos hit trending in the last two days. A Chinese government document formatter at 285 stars in its first day with 55 forks. An app monetization skill at 161 stars with 21 forks. A 3D visualization skill turning prompts into Three.js scenes, 130 stars. A United Arab Emirates corporate tax skill at 87.

MIT across all four. No exceptions.

The one that got rejected

The top result by raw stars was something else entirely, sitting at 354 stars in a single day with no license file, no meaningful description then no project behind it. It failed verification immediately.

Worth knowing because star count alone tells you nothing now. Roughly a third of what surfaces in this category each week is not actually open source. The fastest climber is often the emptiest repo.

What the spread says

Government paperwork. Paywalls. Blender scenes. Corporate tax in one specific jurisdiction. Nobody coordinated that. It’s what happens when a format gets simple enough that domain experts can package what they know without learning anything new.

That accessibility is the whole reason vendors are moving in. We wrote about skills getting a distribution layer when the open question was whether anyone would publish to it. Four strangers answered before breakfast.

What a Skill Actually Contains

Worth pausing on the mechanics, because the format is simpler than the coverage suggests.

It is a markdown file

A skill is a folder holding a file called SKILL.md. Inside is a short header describing what the skill covers plus when to use it, then instructions written in plain language. That is the entire specification. No code, no build step, no package manager.

The agent reads the header, decides whether the current task matches, then loads the body only when it does. That lazy loading is why a collection can run 60,000 words without flooding the context window on every request.

Reference files carry the depth

Bigger skills split detail into a references folder. Unity ships 89 of these. Google ships two. They load on demand when the main instructions point at them, so a skill can be shallow at the top while holding a manual underneath.

Unity’s render pipeline migration is the clearest example. The main file runs 543 lines, then six references sit behind it holding the parts most projects never need.

Why the simplicity matters

Anyone who knows a subject well can write one. That is precisely what happened on GitHub trending this morning, where a tax specialist plus a Blender artist shipped skills within hours of each other without sharing a language or a toolchain.

The barrier to publishing authoritative context for an AI agent is now a text file. Vendors noticed. So did everyone else.

Nobody Agrees on How to Install Them

The format converged. The plumbing did not.

Three competing patterns

Unity ships through plugin marketplace commands, one to add the marketplace then one to install. Several community repos use npx skills add followed by a repo path, which is the pattern the Google Maps announcement pointed at. Others expect you to clone the repo then symlink it into a skills directory by hand.

None of these interoperate. A skill written for one install path works fine once loaded, so the incompatibility sits entirely in distribution rather than in the skills themselves.

What that costs you

Discovery, mostly. There is no single index, no search across collections, no way to know whether an official skill exists for the API you are about to use. You find out because somebody tweets it, which is how the Google Maps collection stayed invisible for twelve weeks.

Expect consolidation here. The format is too useful to stay this scattered. Whoever builds the index that everyone actually searches ends up controlling what agents learn.

The Permissions Nobody Scoped

One more thing surfaced while reading these files. It applies well beyond Unity.

What the format allows

A skill can declare which tools an agent may use while running it. That declaration sits in the file header. It is the main safety control the format offers.

Across Unity’s 31 skills, three declare it. The command line skill declares shell access, which makes sense given what it does. The remaining 28 declare nothing.

What declaring nothing means

Those skills inherit whatever permissions your agent already runs with. So the setting lands wherever you last left it, which for most people means broad access they configured months ago for something unrelated.

That is not a vulnerability. Community skills mostly behave the same way. But Unity specifically cites a security review as a reason to prefer official skills over community ones. If that review happened, it evidently did not cover permission scoping on 28 of 31 files.

The wider problem

Skills are instructions loaded automatically into a tool with file access. Nobody publishing them right now treats scoping as standard practice. No install path prompts you about it. As more vendors ship official collections, that gap gets larger rather than smaller.

Why Vendors Are Moving In

The incentive is plain once you see it from their side.

Every hallucinated API is a support ticket

When an agent invents a method signature for your product, the developer does not blame the model. They file a bug against you, or they give up and use something else. Skills are the cheapest possible fix, since a few thousand words of context prevents a class of failure that no amount of documentation rewriting has solved.

That logic applies to anyone with an API. Payment processors, cloud vendors, game engines plus mapping platforms all sit in the same position, which is why you should expect a lot more of this.

The part that should bother you

Whoever writes the skills shapes what the agent suggests before you have formed a preference.

Unity’s monetization guidance arrives phrased helpfully, sourced from the vendor, loaded automatically the moment an agent detects a Unity project. A developer asking an ordinary question about their purchase flow gets an assistant already holding a position on whether RevenueCat should stay.

Nothing about that is illegal or even unusual as business practice. It’s just new to sit inside the tool rather than in an ad. Anyone who followed how quietly vendor terms shift will recognise the pattern of a change nobody announces.

The Format Is Going Portable Faster Than the Tooling

Skills began as a Claude convention. They are not one anymore.

One body, three wrappers

Unity’s repository carries three parallel plugin folders. One for Claude Code, one for Codex, then a generic agents folder holding its own marketplace manifest. The 31 skills sit underneath all three, written once.

That structure is the quiet signal in the whole release. A vendor writing agent documentation now writes it once, then wraps it for whichever tool the developer happens to run. Instructions are the asset now. Everything else is a delivery detail.

The version numbers tell on them

Unity’s announcement described Claude Code as the first agent to receive the plugin, with others following later this year. Claude’s manifest reads 0.1.2-beta. Codex sits at 0.1.3-beta.

Codex is a version ahead of the agent Unity announced first. So this was built cross agent from the start, then framed around whichever directory carried the announcement furthest.

Why that helps you

Portability means a skill you write for one agent probably survives your switching to another. Given how often people move between Claude Code, Codex plus Grok right now, that is worth more than it sounds.

It also means vendor skills will spread faster than any single platform can review them. Anthropic can vet what enters its directory. Nobody vets a symlinked folder.

What to Watch Next

Three things will settle this within months rather than years.

First, whether any vendor besides Google keeps a permissive license once collections get big enough to matter commercially. Unity set the precedent for restriction at scale. Precedents in this industry get copied quickly.

Second, whether a real index appears. Discovery currently runs on tweets, which is why a Google collection sat unnoticed for twelve weeks while a Unity launch reached 461,000 followers in a morning. Whoever fixes discovery decides what most agents end up loading.

Third, whether anyone starts scoping permissions before a skill causes a problem that makes the news. Controls already exist for this. Almost nobody uses them.

My own bet is that the license question settles first, because it is the one with lawyers attached. Discovery follows whenever somebody ships an index good enough that developers stop searching GitHub by hand. Permissions settle last, after an incident, the way these things usually go.

What You Should Actually Do

Check the license before you install

This takes ten seconds. Open the repo, look for a license file, then confirm GitHub recognises it. A blank space where MIT or Apache normally sits means the terms are custom, which is exactly what happened with Unity.

Restricted does not mean unusable. It means you cannot fork the work into something competing with the vendor, so read before you build on top of it.

The practical risk is narrow but real. If you are studying a vendor’s skills to learn how professionals structure them, then publishing your own version for a different platform, a restricted license is exactly the thing that stops you.

Check what it says about competitors

Search the reference folders for the names of tools you already use. If a vendor’s skill contains a removal path for your current SDK, that is worth knowing before an agent surfaces it mid task.

Check the last commit date

A stale skill collection is worse than none, since it teaches your agent an API that shifted three releases ago. Google’s has not moved in 24 days. Unity’s moved this morning. That gap tells you which one is maintained.

Then install them anyway

Assuming the terms work for you, these are still worth having. A good skill prevents the specific failure that eats an afternoon. The cost of a bad one is a single wasted prompt.

If you are building your agent setup from scratch, our Claude Pro review covers whether the subscription underneath makes sense, plus the OpenClaw deep dive maps how the surrounding tooling fits together. For skills people actually run daily, our roundup of Claude Code repos is a better starting point than trending.

The Part Worth Keeping

A folder of markdown became a distribution channel while everyone was watching model releases.

Three months ago Google put one up quietly and let it go stale. Yesterday Unity put up 31 with a launch post, a restricted license nobody mentioned, plus removal guides for two competitors. This morning four strangers shipped MIT skills for government paperwork then corporate tax. One empty repo with no license collected 354 stars for nothing.

That is the whole market in 48 hours. No standard, no norms, no expectation that official means open or that open means maintained.

Skills work. That part is settled. What is not settled is who gets to write the context your agent reads before it answers you. Right now the answer is whoever showed up.

Check the license folder. It takes ten seconds and nobody else is doing it.

Charts and Blocks

Instruction words shipped, by publisher

How the three groups compare