Blog
Managing agent skills, in depth
Practical writing about agent skill packages: what a SKILL.md is, keeping skills in sync across harnesses, lockfiles that make installs reproducible, and scanning bundles before you trust them.
These articles cover the mechanics behind skillporter: the file format the harnesses read, the drift that appears when the same skill is copied into five directories, the lockfile that makes an install reproducible, and the static scanning that runs before a skill lands in your workspace.
- Scanning agent skills before you install them
What a static security scan reads in a skill, how the 0 to 100 risk score becomes APPROVE, CAUTION or REJECT, and where the scan stops.
- Skill lockfiles: what they pin and what they do not
A git ref is not a pin. What skillporter.lock records, how file hashes catch an edited copy, and how lock --check fails a build.
- Keeping agent skills in sync across harnesses
Harnesses read different directories, so one skill turns into five copies that quietly diverge. Sync and drift detection keep the copies honest.
- What is an agent skill, and why it needs a manager
An agent skill is a directory with a SKILL.md file. Here is the format, the directory each harness reads, and where copying skills by hand breaks down.