Agentic Skills Lab — Version Control for AI Capabilities
AI coding agents are only as good as the instructions they load — and most people's live in unversioned dotfiles. Mine are a git-tracked library: 33 skills with history, security gates, and a publish pipeline.
Active developer tooling
Versioned personal agent skills and workflow maintenance. Runtime compatibility and review matter more than the number of installed skills.
Status documented
Overview
The Agentic Skills Lab is the system behind every AI-assisted project in this portfolio: a version-controlled library of 33 personally-authored Claude Code skills — session-continuity handoff trees, repo scaffolding, video comprehension, second-brain search, resume scoring — whose live copies deploy to four different agent harnesses. Around it sits real supply-chain discipline: every external skill is statically scanned before install, flagged ones get clean-room rewrites instead of copies, and a confirm-gated sync pipeline separates editing from deploying. Two skills are published open source so far (project-scaffold and handoff-to-issues), with more graduating as they're sanitized.
The Problem
Agent skills are executable instructions with real privileges — and the ecosystem treats them like wallpaper: unversioned home-directory files, installed from strangers' repos unreviewed. Two problems compound: your own skills evolve with zero history (an edit that degrades a skill is silently permanent), and third-party skills are a supply-chain risk (several popular ones fail static analysis with HIGH findings). The lab treats both as engineering problems.
Questions Addressed
- 01
What does version control look like for AI capabilities that live outside any repo by design?
- 02
How do you consume the ecosystem's good ideas without inheriting its supply-chain risk?
- 03
Can skill quality be compared empirically instead of by feel?
Methodology
A Git-Tracked Mirror with Deliberate Deploys
Every skill's source of truth lives in a git repo; live copies at the agent-harness locations are deploy targets, not editing surfaces. A dual sync pipeline (PowerShell + bash) pulls live drift in and pushes edits out behind an explicit confirmation — deploying a skill overwrites what four different AI tools load, so it's a decision, not a save.
Scan-Before-Install, Clean-Room on Failure
Every external skill, plugin or MCP server gets a static security scan before it's enabled; HIGH/CRITICAL findings are a hard stop. Flagged-but-good ideas get clean-room rewrites — re-implemented from scratch with the flagged behavior excluded, provenance and scan verdicts recorded per skill. Seven current skills exist this way, including a five-skill second-brain family rewritten from a scanned repo rather than installed from it.
Battle Tests & Publishing
Competing skills are compared on identical tasks against a scored rubric — graft what wins back in. Skills graduate to open source once generalized and scrubbed of personal context: the public claude-skills repo currently ships project-scaffold (an idempotent AI-native repo bootstrapper: README, agent rulebooks, guardrails, handoff tree, CI in one pass) and handoff-to-issues (turns session handoff trees into deduped GitHub issues).
Key Results
Key Findings
Skills are code and deserve code's discipline: history, review, deliberate deploys — an unversioned live skill is a production system with no rollback.
The scan-before-install gate pays for itself: multiple popular community skills failed static analysis, and the clean-room pattern captures their ideas without their risk.
Editing where you version and deploying on purpose (confirm-gated push) is the difference between a library and a pile of dotfiles.
Conclusion
This is infrastructure for a way of working: every other project on this page was built with these skills loaded — the handoff trees that survive context loss, the scaffolds that make a repo agent-readable, the audits that keep claims honest. The library itself stays private (it encodes personal context by design); what generalizes gets published, two skills at a time.