Track SEP-2640 Skills extension compatibility and trust boundaries

[groupthinking]

Decision

WATCH → TEST when the SEP is accepted or an official SDK reference implementation lands.

Verified state

• The MCP Skills working group added a stable-format rendering of the io.modelcontextprotocol/skills extension on September 4, 2026: ext-skills commit f1f8605.
• The repository explicitly labels the work experimental and says it is not an official MCP specification or recommendation.
• SEP-2640 remains open; it is the canonical proposal.

Why this matters here

If adopted, the extension becomes a standard distribution surface for Agent Factory/OpenProtocol workflow instructions alongside MCP tools. It also imposes trust requirements that should map to EventRelay receipts and policy controls:

• skills/list and skills/get, plus optional resources/directory/read
• skill identity as originating server + URI, never URI or display name alone
• complete per-file SHA-256/size manifests, or explicit "dynamic"
• origin-tagged model context and origin-bound resource reads
• explicit per-skill approval for host-side execution and permission grants
• approval revocation when the resource/digest set changes
• cache write isolation or digest re-verification on every read
• no silent name shadowing across servers or local skills

Bounded next action

When the trigger below occurs, implement a fixture-only conformance spike:

1. Add a sample server capability for io.modelcontextprotocol/skills.
2. Exercise skills/list, skills/get, and ordinary resources/read.
3. Store the compound identity {server_identity, skill_uri}.
4. Verify byte size and SHA-256 before exposing any file to model context.
5. Reject digest drift, cross-origin reads, silent name collisions, and unapproved execution.
6. Emit an EventRelay receipt for listing, approval, retrieval, verification, and denial.
7. Keep the adapter feature-flagged and draft-only.

Activation trigger

Start implementation only when one of these is verified:

• SEP-2640 is merged/accepted, or
• an official MCP SDK ships the required reference implementation with a pinned draft revision suitable for interop testing.

Non-goals / safety boundary

• Do not label this an official standard while SEP-2640 is open.
• Do not equate MCP-served skills with local trusted skills.
• Do not enable remote skill execution, merge, deploy, or modify production configuration.

Estimated implementation effort after trigger: 1–2 engineering days.

[linear-code]

GRV-476

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.