Microsoft's Skill Play: Fewer Calls, Bigger Context, and the Hidden Tax on Agent Architecture

Every benchmark tells you more than the presenter intended. Microsoft's distributed skills demo over MCP is a perfect case. Six to seven model calls compressed to three. Latency cut from 15.48 seconds to 6.35. A claimed 60% speedup. Then the number that should make any engineer stop: tokens went from 11,134 to 13,533. Up 22%. Read those three data points together. More tokens, dramatically less time. That combination only works if the bottleneck was never compute. It was orchestration. Serial round-trips. The latency is the friction of poor architecture. The proposal is SEP-2640, an MCP extension pushing distributed skills as the post-agent architecture. Strip the branding and this is not a model breakthrough. No new attention mechanism. No new training objective. No new alignment method. This is a re-layering of agent orchestration. Combinatorial innovation. Existing primitives — MCP Resources, file-style process documents, progressive disclosure — reassembled into a new chassis. The old model: every expert agent runs its own reasoning loop. Each specialist call means a model invocation, a network round-trip, serial latency accumulation. The Microsoft model: one advisor reasoning loop. Skills load into its context on demand. Expert agents disappear. In their place, files. SKILL.md process documents. Typed MCP tools. skill:// URI addressing. Three model calls instead of seven. The math is clean. The engineering reality is not. Progressive disclosure is the engineering core here. Each skill advertises itself in roughly 100 tokens. Full loading stays under 5,000. Resources and scripts load on demand. That's not model capability improvement. That's explicit management of context budgets and KV cache limits. Context engineering, dressed up as an architecture proposal. It works. But it inherits every weakness of the context window it depends on. Here's what the demo numbers actually prove. If the bottleneck were compute, a 22% token increase could not produce a 60% latency drop. The gains come from removing serial round-trips from the critical path. That's orchestration overhead, not inference efficiency. The architecture removes hops. But it transfers pressure to the parent agent's context window. And that cost scales superlinearly as skill counts grow. Four skills cost 22% more tokens. What happens at twenty? Fifty? Five rounds of multi-step reasoning with context accumulating each turn? The proposal's own data is a warning disguised as a win. The proposal's own document flags the API as experimental and subject to change. The demo's skill discovery mechanism uses a fixed historical draft revision of index.json, not the final spec. Implementation and specification have already drifted. And the engineer behind the demo admits process reuse and prompt-cache hit rates are unstable, with live telemetry fluctuating. The 60% figure is a blend of architecture gains and infrastructure luck. I spent six months in 2017 reverse-engineering a top-ten ICO's vesting contracts, hunting an integer overflow that could have drained twelve million dollars. That habit — distrusting the headline, checking the arithmetic — applies here. The token curve is the vulnerability. No production-grade benchmark exists yet. The demo ran four skills over three paired runs. That's not a stress test. That's a smoke test. The SKILL.md provenance issue is the strangest omission in the coverage. Nobody flagged the obvious. SKILL.md. Progressive disclosure. Skill advertising around 100 tokens, loading under 5,000. That is the signature design of Anthropic's Agent Skills. Microsoft is taking a competitor's private convention and protocolizing it. Standardizing it. Converting a de facto standard into an open one, under working-group governance where Microsoft holds implementation primacy. That's a power move disguised as open-source contribution. And the original reporting missed it entirely. The deeper structural consequence: this architecture assumes the advisor is a frontier model. Skills eliminate the space where specialist agents run their own models — including fine-tuned small models. The pattern only works when a single large-context model absorbs multiple skill instructions, maintains schema compliance, and resists attention degradation over long contexts. That's a bet on frontier model economics. Structurally hostile to vertical models and independent agent runs. Procedural knowledge changes form too. No longer embedded in model weights or siloed services. It becomes text artifacts. Versionable. Diffable. Auditable. For compliance teams, that's a gift. For vendors wrapping domain know-how in proprietary agents as a moat? Existential. Skills can be copied to any MCP-compatible runtime. Platform lock-in and technical lock-in both weaken. Microsoft's framing is careful. A2A for cross-trust-boundary delegation. MCP for tools and data. Complementary, they insist. But the definition of what counts as a bounded skill versus an autonomous agent — that line is drawn by Microsoft's hand. Define the boundary of autonomy, and you define the size of your competitor's market. Now the part that worries me most. Security. The original piece gave safety three sentences. Default tool approval. Refusal to execute bundled scripts from downloaded archives. Then a hand-wave: the broader trust model for enterprise distributed skills is still developing. That's not a temporary gap. That's a missing foundation. Three risk classes follow directly from the architecture. First, supply chain poisoning. Remote skills distributed via MCP servers. Clients download them. Execute them. Or — after approval fatigue sets in and enterprises disable the prompt to chase automation — execute them silently. The described mitigation is passive defense. It conflicts with the automation the architecture promises. Second, skill:// namespace spoofing. No registration authority. No ownership verification described. Typosquatting is trivial. This is a standard-design flaw, not an implementation detail. Third, prompt-injection surface expansion. Skill content loads directly into the advisor's reasoning context. SKILL.md plus tool outputs. This is the classic attack pattern: untrusted text injected into a high-privilege agent's context. Progressive disclosure shrinks the exposure window but doesn't eliminate it. Once a skill is selected and loaded, the injection is complete. Vulnerabilities aren't patched by good intentions. The architecture creates these vectors by construction. My 2026 work integrated an LLM agent framework with a privacy-preserving zk-rollup. I found a prompt-injection vulnerability in the oracle feed that let malicious agents manipulate transaction outputs. Simulated loss: two million dollars. The lesson: any system that concatenates untrusted content into a reasoning context needs provenance, sandboxing, and audit trails before deployment. Not after. The commercial picture is more coherent. Microsoft is doing what enterprise platforms do. Open protocol, paid runtime. MCP stays open. Value capture sits in managed execution, skill registration, governance, and distribution through Azure AI Foundry and Copilot Studio. The Red Hat playbook. The targeting is precise: platform engineering teams. Reuse. Version management. Consistency. Publish once, run everywhere. High-value, high-stickiness enterprise scenario. But it's experimental. No pricing. No SLA. No audit logs. No liability model. Regulated industries won't touch it until those exist. Six to twelve months from sellable. There's a counterintuitive cost angle the coverage shrugged off. Skills increase per-request token consumption by 22%. Enterprise pays per token. Unit task cost rises. The trade-off between latency-driven concurrency gains and direct inference cost is unexamined. No dollar figures. No throughput data. The efficiency narrative hides a context bandwidth tax. The unanswered question is unit economics. Is distribution priced per server, per invocation, or bundled into Azure subscriptions? What anchors enterprise willingness to pay — saved ops headcount or faster agent rollout? No answers yet. No dollar figures anywhere in the proposal. That's not a detail gap. That's a business model still in utero. Infrastructure implications are unambiguous. Load shifts from many small requests to fewer large ones. GPU memory per request rises. KV cache pressure increases. Skill instructions form stable, cacheable prefixes. The demo's own admission — prompt-cache hit rate unstable — reveals the dirty secret. The 60% speedup includes cache and reuse benefits not attributable to the architecture itself. Cache hit rate becomes the hidden KPI. Prefix caching vendors just found their market. For model providers, the implication is stark. This architecture sets 128K context as the soft floor. Long-context stability and cross-request prefix reuse become competitive differentiators. The model that degrades gracefully under fifty skill definitions wins the advisor role. The model that loses the middle of its context loses the deployment. The competitive dimension is where this gets interesting. Microsoft is not the MCP owner. Anthropic is. Google owns A2A. Microsoft, a third party, submits an extension to the official MCP track. It reaches final status. Suddenly the definition of what counts as a bounded skill versus an autonomous agent — the line determining whether A2A or MCP covers a scenario — sits in Microsoft's hands. That's standard-setting as competitive strategy. The framing is neutral. The effect is not. Every scenario reclassified as bounded ability shrinks A2A's territory. Every protocolization of Anthropic's private skill format pulls their de facto standard into governance structures where Microsoft carries implementation weight. The single biggest risk isn't technical. It's fragmentation. Anthropic keeps Agent Skills proprietary. Google builds lightweight capability descriptions into A2A. AWS ships its own governance implementation. Five vendors converging on MCP with different governance layers — that's either convergence or surface compatibility hiding divergence. The write-once-run-everywhere promise dies in committee. What's the play for builders? Three windows. First, inference-layer prefix caching and context optimization infrastructure. The architecture's performance depends on cache hit rates. Measurable, defensible. Second, skill supply chain governance. Signing. Scanning. Registration. Audit trails. Nobody owns this category yet. Third, productizing domain know-how as distributable MCP skills. Distribution costs just dropped. The first vertical vendors to skill-ify their offerings take the marketplace. Strategic positioning is clear. This is a protocol power play wrapped in an architecture proposal. The technical direction has merit — conditionally. It wins when long-context costs are low. It loses to A2A-style delegation when they're not. Optimization isn't about reducing work. It's about respecting the constraints the user actually operates under. Right now, the constraint is context, not speed. The demo proved latency can be compressed. It also proved tokens inflate. The next production-grade benchmark will show whether that inflation curve stays linear as skills scale — or whether attention dilution turns the advisor into a very fast, very expensive bottleneck. Watch three signals. Anthropic's official response to SEP-2640: compatibility or cold war. Google's counter on the A2A side. And the first honest enterprise deployment with fifty skills. If the skill supply chain gets governance before it gets exploited, this architecture survives. If not — code that doesn't handle supply chain risk isn't ready for mainnet reality. The gas isn't the problem. The gas is the friction of poor architecture. And unresolved security debt has a way of becoming mainnet reality, whether the devs are ready or not.