Evaluating Approaches in Sharing Agent Skills Across Teams by Ed Lyons

“Agent Library” by Ed Lyons via Midjourney

When it comes to using agents, it’s all about skills. Not only your abilities, but all of the recipe files you create that explain to agents how to do everything that matters in your organization.

Once people start creating agent skills and seeing their benefits, they will create a lot of them. You don’t get far before people want to share their skills with other teams doing the same things. 

Everyone agrees it would be useful to put all the skills somewhere everyone can access them.

But... where?

Unfortunately, how to responsibly share these clever little packages of text files and scripts across an organization is more challenging than you might expect. I will soon explain why.

So, software engineers usually run into the problem of distributing agent skills first. After success in storing them inside project repositories for small teams, they soon decide something needs to exist above the projects.

For them, the initial solution seems obvious: create a dedicated git repository for skills.

But problems with a raw git repo appear quickly, and will multiply as the creation and usage of agent skills spreads across teams.

Many issues are related to the strange nature of skills themselves, and how to evaluate them before they are distributed. If you create a library for your organization to distribute skills, these management and governance problems must be handled.

For example, many user-created skills are not executed reliably or they have unwanted side effects. Skills also can be designed to work together, as you see with planning frameworks like Superpowers. This is very powerful, but errors easily sneak into the chain. These skill combinations require separate testing.

Skills also can conflict with each other, due to overlapping keywords or functions. You will need to provide guidance on what skills cannot be installed together, and encourage those submitting skills to consider what is already available and make new ones as focused as possible.

Then there are real security problems. Skills leverage other tools and can even run their own application code. Sometimes, creators of skills are not software engineers and cannot evaluate the underlying script that their agent created. Even users of ChatGPT can create agent skills. How big a problem is skill security? According to security vendor Snyk, more than one-third of publicly-available skills have security flaws.

Here is a list of other issues for managing an organization-wide agent skills library:

• How will technical and non-technical users access agent skills?

• How will users know what skills are available and relevant to them?

• How will users know what permissions and dependencies are required to use a skill? 

• How will users submit skills to the repository?

• What will be the review process for a new skill to be added to the library? How will security be addressed?

• What if some skills should not be accessible to all users?

• How will provisioning work? Will there be “recommended” skills or packages of skills that go together?

• Will a new version automatically replace the existing skill for all users? What if they do not want the new version? 

You do not need to worry about all of these things to get started, but I have listed them so that you know that eventually, these questions will need answers.

I will return in a little while to starting a skill library with a git repository, but first, let’s survey the entire product space to show useful approaches and tools for creating and managing skill libraries. 

I will break the landscape down into four categories.

• Vendor-Provided Skill Sharing

• Public Marketplaces

• SaaS Offerings

• Open Source Skill Management Tools 

Vendor-Provided Skill Sharing

The companies that provide models and harnesses have done some work in this space. Claude Code’s team plans come with an organization skills feature where you can share skills with others. It works with technical and non-technical users nicely, and your organization’s skills are also available in the Claude plugins for Microsoft 365 tools, such as Word and Excel.

OpenAI has a workspace skills feature where you can let other users of Codex or ChatGPT access your skills.

Microsoft has a new beta offering where skills can be shared via MCP. 

These offerings are simple. They do not offer workflow or fine-grained access controls. They also only work inside the vendor’s proprietary stack. 

Public Marketplaces

There are lots of public marketplaces for general skills. You can find thousands of skills in GitHub repositories that you can install quickly and easily. But these skills are not specific to your organization, even though your people will need many of them.

One of the most popular is skills.sh. It is hosted by Vercel, an agent infrastructure company. They have a solid process for evaluating and auditing public skills. Their leaderboard, determined by telemetry in all skills, is a great way to find the best choices.

In public marketplaces, there is generally no secure mechanism to add your private repository to their tooling.

One marketplace that does let you add yours is Agent Skills, which is another of the most popular online directories.

What you get from hooking your private repository to the tools in Agent Skills is a unified interface to get public and private skills, as well as some basic command-line management tools that let you diagnose problems with skills, validate them, and push out new versions.

SaaS Offerings

There are not yet a lot of SaaS offerings, but I expect more soon.

One is MCP Market Hub. Unlike command-line interfaces, it has nice web-based tools to manage skills and MCPs, such as the administration of users and groups, so you can make some skills only available to some users. It has plugins for all of the coding agent harnesses and can be accessed by other tools as well. It starts at $149 per month for 5 users, and $9 per month for all users beyond five.

A similar, but more focused offering is SkillRepo. For $8 per month per user, it also has solid management features. 

Open Source Skill-Management Tools 

There is a lot of action in this space, though most tools are aimed primarily at software developers.

Let’s look at a few examples.

MDM, written by a colleague of mine at EQ, is a command-line tool that allows you to pull agent-related markdown files (including skills) from a variety of public and private sources. It has some nice features such as a security scan, and the ability for teams to add a special manifest file that can be used in projects to prescribe what a developer needs to pull down automatically.

Skael is a nice lightweight skills repository that is a step up from using just a bare git repository. Aimed at software developers, it allows you to push out new versions (so people do not need to remember to do a git pull to get new versions), it scans for security problems, and even uses telemetry so you can see what skills are actually being used.

SkillHub is a large, enterprise-grade skill library system. It is impressive, and can handle all of the potential governance requirements I mentioned earlier in this piece. Unlike most open source tools, it has a significant number of users and contributors. It’s worth checking out to see what a full-featured organization skill library would look like. It is also a reminder that regardless of where you start, you won’t be creating your own enterprise library one day. You will either be using SkillHub or a commercial SaaS offering.

Getting Started

Having seen what is out there, I believe there are two good starting places for an organization at this time.

If you find that several groups have already developed a significant number of skills, I would start with SkillRepo. The per-seat license cost is worth it as the value of skills has already been established in your organization.

If you only have a small number of skills across a few teams of developers, I would begin with a bare git repository, where you set up management and governance features yourself.

Let’s briefly discuss how that might work.

You probably want to have more than one repository for different groups in your organization, as you won’t have an access control layer on top. As for versions, git provides that, and people who want to maintain older versions will need to use the tagging features in git. In this model, users will need to pull down newer versions if they want them.

For security checks and to test the quality of skills, you are going to have to handle those tasks manually in the pull request review process. Figuring out your governance processes is a valuable use of time, and those practices will be needed no matter what tools you use in the future.

Also, you should support multiple ways of consuming your repository’s skills, as not everyone is going to want to clone the repository locally or add it as a submodule to their existing project.

Create a marketplace plugin manifest file at the root of the repository so that developers can install the skills both from the command line and from tools like Visual Studio Code. Non-technical users of agent harnesses like ChatGPT will be able to read skills from the repo by pointing to it directly.  But note they will not be able to publish new skills to that repository directly unless you write a custom connector with a workflow tool like n8n or something else you hook up yourself.

Some organizations have gone further and added their internal repository to the Agent Skills tooling I described above.

You might also use the open source MDM tool to pull prescribed lists of skills into projects from your repository if you also need to distribute non-skill agent files as well.

Eventually, as skill usage spreads throughout your organization, you will want  to move to a private SaaS offering like SkillRepo (mentioned above), or even the open source SkillHub to enable sophisticated enterprise management.

But for now, it is better to choose a smaller solution, to develop the right reviews and governance processes for skills, and to start promoting the importance of skill development across teams.

When the value your teams are getting out of agent skills goes up, it will be easier to justify investment in a more sophisticated solution.