Agent Skills well-known index: more than 70 platforms adopted the format, and in 36 days one scanner asked for my site's index

Agent Skills, a format for packaging instructions an AI agent can load when a task calls for them, became a foundation-run standard on October 22, 2026, and Anthropic says more than 70 agent platforms have integrated it.¹ Platforms adopting the format is not the same as agents fetching skills from websites. The standard never mentions a website address for skills, and that idea lives in a separate draft.²⁴ My site has published a skills index at the draft’s address since August 20. In 36 days of crawler logs, one requester asked for it, once, and it calls itself a probe. Publishing an index today is a bet on a future reader, so it should cost little and stay correct.

In 36 days of this site’s crawler logs, one requester asked for its agent skills index, on one day, and that requester names itself a probe.

What is the Agent Skills well-known index?

The Agent Skills well-known index is a file a website can publish at /.well-known/agent-skills/index.json to list the skills it offers, so an agent can find them at a predictable address. It is defined by “Agent Skills Discovery via Well-Known URIs,” a draft at version 0.2.0 kept in Cloudflare’s GitHub organization, not in the Agent Skills project’s own.⁴

The draft states its purpose plainly. “A well-known URI provides a predictable location for agents and tools to discover skills published by an organization or project.”⁴ Each entry in the index names a skill, points to its file and carries a digest, a fingerprint computed from the file’s exact contents, written as “sha256:” followed by the fingerprint.⁴

This site has published an index at that address since August 20, 2026, listing two skills. One answers questions from the site’s daily AI search news digest, and one reads its articles as Markdown.

Does the Agent Skills standard say how agents find skills on a website?

The Agent Skills standard does not say how agents find skills on a website. Its home page, specification and guide for agent builders never use the phrase “well-known,” and when the standard talks about discovery it means a step inside one agent. The specification says “The name and description fields are loaded at startup for all skills,” so the agent already holds the skills it knows about.²

The guide for agent builders says where skills come from. “A locally-running agent can scan the user’s filesystem for skill directories,” while a cloud agent needs “an API, a remote registry, or bundled assets.”³ For a remote agent it suggests “cloning a configuration repository, accepting skill URLs or packages through your agent’s settings, or letting users upload skill directories through a web UI.”³ None of those routes starts from a website’s own address.

Anthropic’s announcement of the move to the Agentic AI Foundation doesn’t mention a web address for skills either. It reports that “1 million skills have been published and nearly 280 million installed,” and lists a roadmap of “versioned releases, a formal proposal process, and security guidance.”¹

Who asks for a website’s agent skills index?

On this site, one requester asked for the agent skills index in 36 days of crawler logs, from September 20 to October 25, 2026. It was Andi-AgentSurfaceProbe, whose label points to andisearch.com, and it came on September 28 only. It read the index and then both skill files the index lists, so it followed the index instead of guessing addresses.⁵

The table below gives every request under the skills address in the log.

Date	Address	Requester
September 28, 2026	/.well-known/agent-skills/index.json	Andi-AgentSurfaceProbe/1.0
September 28, 2026	/.well-known/agent-skills/query-pulse-corpus/SKILL.md	Andi-AgentSurfaceProbe/1.0
September 28, 2026	/.well-known/agent-skills/read-articles-as-markdown/SKILL.md	Andi-AgentSurfaceProbe/1.0

Other machine-facing files drew far more interest. Over the same 36 days, 19 distinct requesters asked for the site’s llms.txt, a plain-text guide for AI tools, on 21 different days.⁵ The other agent-discovery addresses drew only scanners, tools that check whether a site publishes such files. Those included AgentTrustBot, AgentReadinessScanner and the same Andi probe. No requester that identifies as an agent platform running skills appears under any of them.⁵

Scanners checking for the file and grading the site on it is a separate pattern, covered in the article on what agent-readiness scanners check.

Does a stale skill digest break anything?

A stale skill digest, the fingerprint an index lists for each skill file, breaks the skill for any agent that checks it, while the server keeps answering normally. The discovery draft says “Clients MUST verify artifact digests after download,” and “clients MUST NOT use unverified content.” So when a skill file changes and its fingerprint in the index does not, the file still loads and the index still parses, and a careful agent refuses the skill.⁴

Think of a tamper seal on a jar. If the jar is refilled and resealed with the old seal number, the shelf still looks full, and the only person who notices is the one who checks the number before eating.

Nothing in a site’s uptime or error monitoring would catch it, because every request still succeeds. On this site, the publish checks recompute every fingerprint for that reason and stop the deploy if one no longer matches its file.

How did I count the requests?

I counted requests from this site’s crawler log for September 20 to October 25, 2026, a daily record of bot requests built from Cloudflare’s analytics, with one row per date, user agent and address.⁵ Every row whose address starts with /.well-known/agent-skills/ counted. A requester is one full user agent (the label a program sends to say what it is), and a scanner is a requester whose own label calls it a probe, audit or checker.

I set the bar for a failed claim before counting. If requests had appeared in at least three of the six weeks covered, or had come from two or more requesters that are not scanners, the claim that almost nothing asks for the index would have failed. They appeared in one week, from one scanner.⁵

The log has limits worth knowing. It is sampled, so one requester seen is not one requester ever. It also keeps only requests whose label marks them as a bot, so an agent fetching the index while presenting as an ordinary browser would not appear. The fair reading is that no self-identified agent asked, on one small site with two skills.

Should a website publish an agent skills index?

A website can publish an agent skills index if it costs little to keep correct, but should expect almost no requests yet. On this site it drew one scanner in 36 days, and the standard that more than 70 platforms adopted does not tell agents to look for it.¹²⁵

If you publish one, generate the index and its fingerprints from the skill files on every build, so an edit can never leave a stale fingerprint behind. Then measure who asks for it in your own logs, the way the article on OpenAI’s discovery pilot measures crawler arrivals, and re-check after the standard’s first versioned releases.¹ Similar files have the same gap between publishing and being read, as the article on llms.txt and the article on Lighthouse’s AI catalog audit show.