tech-leads-club/agent-skills
A cross-agent skill registry adds scanning, integrity checks, and auditable installs for teams that want reusable coding-agent workflows without blindly trusting marketplace packages.
Agent Skills packages workflows for Cursor, Claude Code, Copilot, and other agents behind a CLI and MCP server. The repository says marketplace research found **13.4%** of skills had critical issues; its catalog is **100% open source**, contains no binaries, and is scanned before publishing.
Treat agent skills as executable supply-chain inputs. Pin them through lockfiles and **content hashing**, prefer project-local copies when appropriate, inspect prompts and references, and use the audit log when updating or removing installed capabilities.
Agent Skills packages workflows for Cursor, Claude Code, Copilot, and other agents behind a CLI and MCP server. The repository says marketplace research found **13.4%** of skills had critical issues; its catalog is **100% open source**, contains no binaries, and is scanned before publishing. Treat agent skills as executable supply-chain inputs. Pin them through lockfiles and **content hashing**, prefer project-local copies when appropriate, inspect prompts and references, and use the audit log when updating or removing installed capabilities. The security posture is described by the maintainers, and the marketplace comparison is not substantiated in the supplied material. Human curation and **Snyk Agent Scan** reduce known risks but do not prove that a skill's instructions are safe or suitable for your repository.
This makes skill governance operational at installation and update time: provenance, pinned content, hashes, inspection, and audit history become part of the agent harness. It reinforces prior warnings that reusable skills are supply-chain dependencies, while narrowing the repository’s own safety claims: scanning and curation reduce exposure but cannot establish behavioral suitability for a specific codebase.