# tech-leads-club/agent-skills

Source: [GitHub](https://github.com/tech-leads-club/agent-skills)  
Feed7 permalink: https://feed7.dev/p/agent-skills-1rcu2i7  
Published: Unknown  
Trust: Needs Review (needs_review)

## Why Included

A cross-agent skill registry adds scanning, integrity checks, and auditable installs for teams that want reusable coding-agent workflows without blindly trusting marketplace packages.

## Source Summary

Agent Skills packages workflows for Cursor, Claude Code, Copilot, and other agents behind a CLI and MCP server. The repository says marketplace research found **13.4%** of skills had critical issues; its catalog is **100% open source**, contains no binaries, and is scanned before publishing.

## Practical Implication

Treat agent skills as executable supply-chain inputs. Pin them through lockfiles and **content hashing**, prefer project-local copies when appropriate, inspect prompts and references, and use the audit log when updating or removing installed capabilities.

## Agent-Ready Context

Agent Skills packages workflows for Cursor, Claude Code, Copilot, and other agents behind a CLI and MCP server. The repository says marketplace research found **13.4%** of skills had critical issues; its catalog is **100% open source**, contains no binaries, and is scanned before publishing.

Treat agent skills as executable supply-chain inputs. Pin them through lockfiles and **content hashing**, prefer project-local copies when appropriate, inspect prompts and references, and use the audit log when updating or removing installed capabilities.

The security posture is described by the maintainers, and the marketplace comparison is not substantiated in the supplied material. Human curation and **Snyk Agent Scan** reduce known risks but do not prove that a skill's instructions are safe or suitable for your repository.

## Connected Context

Feed7 judgment across 758 accumulated Signals:

This makes skill governance operational at installation and update time: provenance, pinned content, hashes, inspection, and audit history become part of the agent harness. It reinforces prior warnings that reusable skills are supply-chain dependencies, while narrowing the repository’s own safety claims: scanning and curation reduce exposure but cannot establish behavioral suitability for a specific codebase.

- [We Vetted 2000 AI Skills Before They Reached Developers — Lucas Palma, Nubank](https://feed7.dev/p/we-vetted-2000-ai-skills-before-they-reached-developers-lucas-palma-nuba-0k4ehkz) — Nubank independently reinforces pre-distribution scanning and governance; this repository adds reproducible installation controls such as lockfiles, content hashes, and update logs.
- [affaan-m/ECC](https://feed7.dev/p/ecc-0438yju) — ECC’s broad cross-harness catalog creates exactly the selective-installation and upgrade-audit problem that pinned, inspectable skill dependencies are meant to control.
- [zhaoxuya520/reverse-skill](https://feed7.dev/p/reverse-skill-1e4jlfw) — The security router shows why capability-specific skill packs need independent review: structured authorization instructions help workflow consistency but are not a security boundary or proof of safe content.

## Context Map

- Layer: agent
- Domains: coding, security
- Topics: skills, harness-engineering, agent-reliability

## Uncertainty

- The security posture is described by the maintainers, and the marketplace comparison is not substantiated in the supplied material. Human curation and **Snyk Agent Scan** reduce known risks but do not prove that a skill's instructions are safe or suitable for your repository.

## Agent Instruction

Use this item as source-backed context. Do not invent claims beyond the linked source. If this item conflicts with another source, call out the conflict.