The MCP Skills extension went Final, with digest-bound approval.

SEP-2640 was marked Final on September 11, merged September 13, with docs pages and support tracking through September 16. Servers declaring io.modelcontextprotocol/skills must implement skills/list and skills/get and serve skill files through resources/read; every entry carries full YAML frontmatter plus a manifest of each file's URI, SHA-256 digest and byte size. Hosts must restrict reads to the retained manifest, verify digest and size before use, and re-request user approval when any file changes. Servers should stay under 512 files or 16 MiB per skill. Given how much of this year's security story has been unsigned skills, digest-bound approval is the right primitive arriving late.