The Week Skills Stopped Being a Convenience
A skill, until about a month ago, was a text file. You wrote down how you wanted a task done, saved it somewhere the assistant could find it, and stopped re-typing the same instructions. Nobody scanned it. Nobody approved it. It was a convenience, roughly on the level of a saved search.
Between the sixth and the thirteenth of August, three vendors independently decided that a skill is something else.
TL;DR
- Three vendors made a skill into a governable object in eight days. Anthropic shipped security scanning for third-party skills and plugins, Google shipped custom skills already wrapped in an administrator off switch and a share-approval queue, and Treasure AI defined a saved workflow as a work folder skill. Scanning on upload and approval before sharing is how we have handled third-party code for twenty years, now applied to prose.
- Anthropic and Google shipped complementary halves of one control. A scanner inspects a skill body without telling you what it can reach. An approval queue records a sign-off that may or may not involve reading the thing. Each is missing the other’s half, and neither answers what the skill can change.
- The read-only phase of agent integration ended with no announcement. Gemini Enterprise’s GitHub connector went generally available with branch creation, comments, merges and file pushes; ChatGPT can update a Drive source file directly where authorised; Treasure AI agents read and write across every work folder. The writes arrived in the last sentences of availability notes.
- A provenance mark records processing, and it will be read as authorship. Anthropic’s Article 50(2) commitments cover Claude models launched in the EU from 2 August. Paste a paragraph in for tightening and what comes back carries a mark, and the cost of that misreading falls on whoever published the text.
Three vendors, eight days, one borrowed vocabulary
Anthropic shipped skill and plugin security scanning for Enterprise plans on the sixth of August, automatically checking third-party skills and plugins for malicious content whenever someone uploads or edits one. Google made custom skills generally available in Gemini Enterprise on the thirteenth, and made them administratively gated in the same breath: administrators have to turn skills and skill-sharing on in Feature Management, can configure which skills are available to whom, and approve sharing requests. Treasure AI, which is a customer data platform rather than an agent platform, shipped Work Folder Actions on the thirteenth and defined an action in its own release note as a work folder skill, convertible in either direction.
Three vendors, eight days, and none of them coordinated. What they converged on is a vocabulary, and it is a borrowed one. Scanning on upload, approval before sharing, availability scoping, an administrative off switch: that is how organisations have handled third-party code for two decades. It is now being applied to prose.
I want to be precise about why this is a shift rather than housekeeping. Until this week, the governable objects inside an agent platform were the model, the connector and the session. You could say which model an agent may use, which systems it may reach, and how long its authorisation lasts. A skill sat outside all three, because a skill does not add capability. It adds instruction. It changes what the agent decides to do with capability it already has, which is precisely the reason it slipped past the governance layer for as long as it did. A connector is obviously a hole in a perimeter. A paragraph of guidance does not look like one.
Except that a skill written by someone else, uploaded into a shared workspace, and invoked by a colleague who did not read it, is a set of instructions executing against production systems on the authority of whoever runs it. That is not a saved search. Anthropic’s response is to scan it. Google’s response is to make somebody sign off before it spreads. Both are correct and neither is sufficient on its own, which is worth saying because the two vendors have shipped complementary halves of one control and each is missing the other’s half.
Anthropic scans, and doesn’t say what it finds
The Anthropic item is one line in the release notes and it is in beta, which is fair enough for a first shipment. But the questions it raises are not advanced ones.
What does the scan detect? Prompt injection embedded in a skill body is the obvious case, but so is a skill that instructs an agent to exfiltrate the contents of a connector to an external endpoint, and so is one that simply tells the agent to skip a confirmation step. Those are three different detection problems and only the first looks like malware. What happens on a positive result: is the upload blocked, quarantined, flagged to an administrator, or allowed with a warning that the person uploading it will click through? And does anything re-scan an artefact that passed in June against a detection rule written in September, given that the skill sitting in a workspace has not changed but the understanding of what is dangerous has?
I am not asking rhetorically. These are the questions a security team will ask in the first meeting about enabling this, and the honest current answer is that the documentation does not say. That is normal for a beta and it will not be normal for long.
Google ships the approval queue with the feature
Gemini Enterprise took the other half, and the sequencing is what impressed me.
Custom skills reached general availability already wrapped in administration. Not scanning, but an off switch in Feature Management, a separate toggle for skill-sharing specifically, configurable availability, and an approval queue for share requests. Every clause in that release note after the first is a governance clause.
Compare this with how connectors arrived, at every vendor including this one. Capability first, administration afterwards, usually two or three releases later, usually after somebody’s security review stalled a rollout. My own previous edition counted seventeen new read-only data stores at Gemini Enterprise against exactly one new write action and read the ratio as a deliberate posture. Whether or not that reading was right, the skills release is unambiguous: this is a product team that decided the approval workflow was part of the feature rather than a follow-up.
What I cannot yet tell is what an administrator actually sees when approving a share. Approving a skill you have not read is a rubber stamp with an audit trail, which is worse than no control because it manufactures the appearance of one. If the approval interface shows the skill body, the systems it touches, and a diff when it changes, this is a real control. If it shows a name and a requester, it is a queue.
Treasure AI calls an action a skill, and means it
The third instance came from outside the group I usually watch, which is why it is the most interesting.
Treasure AI is a customer data platform. Its Studio product lets people work with customer data conversationally, and on the thirteenth it shipped Actions: a recurring workflow saved inside a work folder, rerunnable with one click or by typing a slash and its name. The release note then says something no product marketing team would have written by accident. An action is a work folder skill. You can ask the assistant to save a workflow as an action, and convert between skill and action from the work folder page.
That is a data platform adopting the same object model as the agent platforms, unprompted, in the same week. It suggests the shape is converging on its own merits, with no sign that anyone is copying anyone, and it raises the question this series should probably be tracking from here: whether these three implementations converge on a format as well as a concept. If they do, an organisation writes a skill once. If they do not, it writes the same operating knowledge three times and maintains three copies that drift, which is the CMS problem, the tag management problem and the customer data problem all over again in a new medium.
Treasure AI also shipped the most candid governance note I have read from any vendor in either of my two watchlists. On the twelfth, it isolated agent execution so that every chat runs in its own environment, and explained why: customer records, exports and downloaded data that the assistant wrote outside a work folder had been accumulating in a location no file browser exposed. The remediation moved those files somewhere visible. A vendor publishing, in plain language, that its agent had been leaving customer data where nobody could see it is not a comfortable release note to write, and it is exactly the disclosure standard the rest of the market should be held to.
The read-only phase ended without an announcement
Underneath the skills story, something else finished this week, and nobody marked the occasion.
Gemini Enterprise’s GitHub connector reached general availability on the twelfth with tool actions that create branches, add issue comments, merge pull requests and push files. ChatGPT gained Google Drive browsing in Library on the thirteenth, and at the end of the availability note, after the part about keeping a document open beside the conversation, sits the clause that where supported and authorised, ChatGPT can update the source file directly. Treasure AI agents can now read and write across every work folder rather than only their own. And on my MarTech beat this week, Klaviyo published 260 MCP tools that build segments, run campaigns and author flows on a live customer engagement platform.
Last week I wrote that seventeen read-only data stores against one write action was a governance posture whether or not anyone stated it as one. That ratio has now moved and no one announced that it had. The writes did not arrive in keynotes. They arrived in the last sentence of availability notes, which is the normal way significant defaults change, and it is why reading changelogs in full is worth the hour it costs.
A mark that proves processing rather than authorship
The other item worth your attention is a policy document rather than a feature.
On the eleventh of August Anthropic published its commitments under the EU AI Act’s Article 50(2) Code of Practice on Transparency of AI-Generated Content, which it has signed as a provider of both generative AI models and generative AI systems. Claude models launched in the EU on or after the second of August will support machine-readable marking at launch: embedded watermarks in generated text, and digitally signed provenance metadata in generated files where supported. The marks apply across the Platform API, Claude, Claude Code, Claude Cowork and Claude Tag, wherever Claude is offered, worldwide. Models launched before that date fall under the law’s transition period and support for them is described as in progress.
Two things the coverage got wrong, and I would have repeated both if I had not opened the source. The page states commitments and plans; it does not declare that marking is live everywhere today. And the second of December 2026 backfill date that appeared in several reports does not appear in Anthropic’s document, which says only that the law includes a transition period. Do not attribute that date to the vendor.
The consequence that will take longest to work through is a semantic one. A detected mark indicates that the model processed the content. Authorship is a separate claim, and the mark says nothing about it. Paste a paragraph into Claude and ask for it to be tightened, and what comes back carries a mark. That distinction is precise, it is in the vendor’s own documentation, and it is going to be flattened into “AI wrote this” by the first tool that scans a submitted document and the first person who reads its output. The cost of that flattening lands on whoever published the text, which is to say on you.
Four releases, no new capability
A last observation, in the same register as my previous edition.
Antigravity shipped four times in seven days. Version 2.6.0 on the seventh made long conversation histories open faster and custom hooks and subagents more reliable. 2.7.1 on the eleventh brought side-by-side previews for image diffs, screen-reader and keyboard accessibility work, eleven improvements and twenty fixes. 2.8.0 on the twelfth persisted sidebar folder state and fixed artifact previews. 2.8.1 on the thirteenth fixed chat responsiveness. No new capability in any of them.
Following the enterprise sign-in work at the end of July, that is what a product looks like once people are using it rather than evaluating it. Accessibility fixes in particular get shipped because somebody in a real organisation could not use the thing, and their organisation was large enough that it mattered. Nobody ships them to win a demo.
The write inventory nobody publishes
Here is the artefact I want and cannot find anywhere: a per-platform list of every write-capable action, maintained by the vendor, versioned.
Every element of it exists. Google documents its connector tool actions. OpenAI documents Drive permissions. Klaviyo counted its tools. Treasure AI described its file semantics precisely enough that you could reason about them. What no one publishes is the consolidated list, in one place, that lets a security team answer the only question they actually have, which is what this thing can change.
Skills becoming governable is genuine progress and I did not expect to be writing it three editions in. But scanning an instruction is not the same as knowing what the instruction can reach. The approval queue at Google approves a skill, not the set of writes that skill can trigger. The scanner at Anthropic inspects a body and tells you nothing about a blast radius.
Three vendors made skills governable in eight days, which is faster than this industry usually moves. In the same eight days the writes those skills can trigger arrived in the closing sentences of availability notes, and nobody has published the list.
Sources
Skills become a governable object
The read-only phase ends
EU AI Act provenance marking
Antigravity release cadence
Scanned and quiet this week
The digest behind each weekly article is produced through a structured AI-assisted scan of official release notes and product update sources. I review the output, verify the relevant signals and write the interpretation.
This article draws from the AI Tools Weekly Digest scans run on August 14, 2026, covering release notes and product updates across the major agentic work platforms. The dated record behind it is in AI Watch, Week 33.
If you find errors or gaps in coverage, I want to know. The process improves when the output is challenged.
