Source: https://toddschiller.com/blog/extensibility-radar-2026-09-04.html # Note This Week in Extensibility: portable skills for MCP, a confirm-before-acting flag for web agents, and rules for which sites can message a browser extension Sep 04, 2026 by [Todd Schiller](https://toddschiller.com/pages/about.html) Week of August 29 – September 4, 2026: the Model Context Protocol accepts a format for packaging reusable agent skills that move between apps, WebMCP adds a way for sites to flag consequential actions for human confirmation, and W3C WebExtensions writes its first spec text for which websites may directly message an installed extension. extensibilitypluginssandboxesweb standardsMCPWebMCPWebExtensionsApple This week's changes give a user's agent more structured and safer control over the software it touches. MCP accepted a way to package skills that move between AI apps, WebMCP added a way for sites to flag consequential actions for human confirmation, and WebExtensions standardized how extensions declare which website may message them directly. ## Customization: MCP accepts a portable skills format **The Model Context Protocol accepted a proposal for packaging reusable agent skills that load across different AI apps.** The maintainers [accepted it this week](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2640) and started the work to turn it into a finished part of the specification. It defines a common way to bundle a skill, i.e., a set of instructions and capabilities, and serve it so that any conforming AI host can find and load it. Early working versions already show up in several AI coding assistants, including Claude Code. Today a skill written for one assistant rarely transfers to another. **Why it matters:** it moves a user's customization out of a single app and makes it portable. A skill packaged once could follow a person across the assistants they use, rather than being rebuilt for each one. ## Agentic web: WebMCP adds a confirm-before-acting flag **WebMCP added a way for a website to mark an action as consequential or hard to undo, so a user's agent knows to pause for confirmation.** The [change merged this week](https://github.com/webmachinelearning/webmcp/pull/217) lets a page distinguish an action that sends or deletes something from one that only drafts or previews it. That gives the user's agent a signal for when to stop and ask a human first. WebMCP lets a website expose in-page actions that a user's own agent can call directly instead of scraping the page. Chrome will ship support starting in Chrome 154.0.8017.0. **Why it matters:** without a shared signal for risky actions, a site can only let an agent do everything or nothing. Flagging the consequential actions lets the agent pause on those and proceed on the rest. ## Standards: browser extensions specify which sites can securely message them **W3C WebExtensions published its first formal specification text for which websites may send messages directly to an installed extension.** The [merged specification](https://github.com/w3c/webextensions/pull/873) defines the manifest setting an extension uses to name the web addresses, and other extensions, allowed to open a direct messaging channel to it. Chromium browsers already implemented the behavior, but it was not part of a shared draft spec. **Why it matters:** an explicit communication channel between websites and browser extensions makes the communication more secure, as DOM-event-based messaging could be intercepted or spoofed. ## Infrastructure: the layers that run customer code in isolation **Two of the layers products use to run a customer's or an agent's code in isolation shipped security and runtime work this week.** Apple's open-source [container isolation project](https://github.com/apple/containerization) landed a run of security fixes for how it fences off the file system and inter-process communication when running Linux containers on a Mac. The embeddable engine [Wasmer 7.4.0](https://github.com/wasmerio/wasmer/releases/tag/v7.4.0), used to run plugin or untrusted code inside a host application, added a maximum output-size budget to its Singlepass compiler. Singlepass is the compiler hosts reach for when running untrusted modules, and the budget caps how much machine code a single guest can generate. **Why it matters:** tighter file-system and inter-process fencing lets a product isolate the customer or agent code it runs more reliably, without building the containment itself. ## Blogosphere: Michael Dubakov's malleable software essay The HackerNews community [discussed Michael Dubakov's new essay on malleable software](https://news.ycombinator.com/item?id=49508059). Michael's new August 18th essay, ["Malleable software = solid bases + custom code"](https://www.mdubakov.me/malleable-software-solid-bases-custom-code/), revisits [his 2019 no-code essay](https://fibery.com/blog/gems/no-code-revolution-why-now/), and argues for a stable product with a thin layer of user-authored customization rather than no-code tools that ask non-programmers to assemble everything themselves. ## On the radar - **September 10:** W3C WebExtensions Community Group public call. - **September 17:** W3C WebExtensions Working Group call, and the submission deadline for the WACE 2026 WebAssembly academic workshop. - **September 21–22:** WebAssembly Community Group calls. - **October 26–30:** the W3C WebExtensions Community and Working Groups meet at TPAC in Dublin. --- *This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.* More on - [`#extensibility`](https://toddschiller.com/tag/extensibility.html) (17) - [`#plugins`](https://toddschiller.com/tag/plugins.html) (17) - [`#sandboxes`](https://toddschiller.com/tag/sandboxes.html) (17) - [`#web standards`](https://toddschiller.com/tag/web-standards.html) (17) - [`#MCP`](https://toddschiller.com/tag/mcp.html) (14) - [`#WebMCP`](https://toddschiller.com/tag/webmcp.html) (15) - [`#WebExtensions`](https://toddschiller.com/tag/webextensions.html) (7) - [`#Apple`](https://toddschiller.com/tag/apple.html) (4)