Agentic Skills Lab — Version Control for AI Capabilities
AI coding agents are only as good as the instructions they load — and most people's live in unversioned dotfiles. Mine are a git-tracked library: 33 skills with history, security gates, and a publish pipeline.
Overview
The Agentic Skills Lab is the system behind every AI-assisted project in this portfolio: a version-controlled library of 33 personally-authored Claude Code skills — session-continuity handoff trees, repo scaffolding, video comprehension, second-brain search, resume scoring — whose live copies deploy to four different agent harnesses. Around it sits real supply-chain discipline: every external skill is statically scanned before install, flagged ones get clean-room rewrites instead of copies, and a confirm-gated sync pipeline separates editing from deploying. Two skills are published open source so far (project-scaffold and handoff-to-issues), with more graduating as they're sanitized.
The Problem
Agent skills are executable instructions with real privileges — and the ecosystem treats them like wallpaper: unversioned home-directory files, installed from strangers' repos unreviewed. Two problems compound: your own skills evolve with zero history (an edit that degrades a skill is silently permanent), and third-party skills are a supply-chain risk (several popular ones fail static analysis with HIGH findings). The lab treats both as engineering problems.
Questions Addressed
- 01
What does version control look like for AI capabilities that live outside any repo by design?
- 02
How do you consume the ecosystem's good ideas without inheriting its supply-chain risk?
- 03
Can skill quality be compared empirically instead of by feel?
Methodology
A Git-Tracked Mirror with Deliberate Deploys
Every skill's source of truth lives in a git repo; live copies at the agent-harness locations are deploy targets, not editing surfaces. A dual sync pipeline (PowerShell + bash) pulls live drift in and pushes edits out behind an explicit confirmation — deploying a skill overwrites what four different AI tools load, so it's a decision, not a save.
Scan-Before-Install, Clean-Room on Failure
Every external skill, plugin or MCP server gets a static security scan before it's enabled; HIGH/CRITICAL findings are a hard stop. Flagged-but-good ideas get clean-room rewrites — re-implemented from scratch with the flagged behavior excluded, provenance and scan verdicts recorded per skill. Seven current skills exist this way, including a five-skill second-brain family rewritten from a scanned repo rather than installed from it.
Battle Tests & Publishing
Competing skills are compared on identical tasks against a scored rubric — graft what wins back in. Skills graduate to open source once generalized and scrubbed of personal context: the public claude-skills repo currently ships project-scaffold (an idempotent AI-native repo bootstrapper: README, agent rulebooks, guardrails, handoff tree, CI in one pass) and handoff-to-issues (turns session handoff trees into deduped GitHub issues).
Key Results
Key Findings
Skills are code and deserve code's discipline: history, review, deliberate deploys — an unversioned live skill is a production system with no rollback.
The scan-before-install gate pays for itself: multiple popular community skills failed static analysis, and the clean-room pattern captures their ideas without their risk.
Editing where you version and deploying on purpose (confirm-gated push) is the difference between a library and a pile of dotfiles.
Conclusion
This is infrastructure for a way of working: every other project on this page was built with these skills loaded — the handoff trees that survive context loss, the scaffolds that make a repo agent-readable, the audits that keep claims honest. The library itself stays private (it encodes personal context by design); what generalizes gets published, two skills at a time.