tech-leads-club/agent-skills
A cross-agent skill registry adds scanning, integrity checks, and auditable installs for teams that want reusable coding-agent workflows without blindly trusting marketplace packages.
Agent Skills packages workflows for Cursor, Claude Code, Copilot, and other agents behind a CLI and MCP server. The repository says marketplace research found **13.4%** of skills had critical issues; its catalog is **100% open source**, contains no binaries, and is scanned before publishing.
Treat agent skills as executable supply-chain inputs. Pin them through lockfiles and **content hashing**, prefer project-local copies when appropriate, inspect prompts and references, and use the audit log when updating or removing installed capabilities.
Agent Skills packages workflows for Cursor, Claude Code, Copilot, and other agents behind a CLI and MCP server. The repository says marketplace research found **13.4%** of skills had critical issues; its catalog is **100% open source**, contains no binaries, and is scanned before publishing. Treat agent skills as executable supply-chain inputs. Pin them through lockfiles and **content hashing**, prefer project-local copies when appropriate, inspect prompts and references, and use the audit log when updating or removing installed capabilities. The security posture is described by the maintainers, and the marketplace comparison is not substantiated in the supplied material. Human curation and **Snyk Agent Scan** reduce known risks but do not prove that a skill's instructions are safe or suitable for your repository.
Agent Skills turns portable skill installation into an explicit dependency-management and supply-chain problem. Compared with broader calls for skill governance, it adds concrete controls—source-only artifacts, scanning, lockfiles, content hashes, local copies, and update logs—while narrowing their assurance: maintainer curation and scanners reduce known exposure but cannot establish instruction safety or repository fit.