Goal
Keep a public Agent Skills repository coherent, installable, safe, and ready for users who install skills through npx skills.
When to use
- The user asks to maintain or release a skills repository.
- The README catalog may not match the
skills/tree. - Validation, deprecation, publishing, or install commands need review.
When not to use
- The user wants to write a single skill; use
skill-authoring-review. - The user wants install help only; use
skill-installation-support. - The repository is not a skills repository and needs a general audit; use
repo-health-audit.
Inputs
skills/**/SKILL.mdREADME.md,CHANGELOG.md,CONTRIBUTING.md,SECURITY.md, andLICENSEpackage.json, validation scripts, and CI workflows- Output from
npm run validate,npm run list, and the localnpx skillsdiscovery command.
Inputs to inspect
- Inspect the skill tree, catalog docs, validation scripts, ignored local helper installs, and install smoke-test output.
- Check that upstream helper skills are installed project-locally rather than vendored into the public catalog.
Process
- Inspect the skill tree and top-level repository files.
- Run the local validation and listing commands when possible.
- Compare README catalog entries against discovered skills.
- Check install commands for
<github-owner>/<repo>placeholders or final repository coordinates. - Review changelog and release checklist when preparing a release.
- Apply deprecation policy before removing or replacing a skill.
- Report the exact validation status, drift, and next action.
Workflow
Follow the process above, fix structural drift first, then update catalog, changelog, and release notes.
Decision points
- If a skill is obsolete, prefer deprecation over deletion.
- If README and skill tree disagree, update the catalog or explain why the skill is intentionally hidden.
- If validation fails, fix structural errors before content polish.
- If project-local helper skills exist under
.agents/skills/, usenpx skills@latest add ./skills --listfor local discovery so helper skills do not mask the publishable catalog.
Safety rules
- Do not publish, push, tag, install globally, or change remote settings without explicit approval.
- Do not add private paths, secrets, internal hostnames, or copied proprietary skill text.
- Do not vendor already-published upstream skills into
skills/orincubator/skills/; use ignored project-localnpx skillsinstalls. - Prefer read-only checks unless the user asks for repository edits.
References
Read only when needed:
references/agent-skills-release.mdwhen preparing a release for this repository.references/repo-release-checklist.mdbefore a release.references/deprecation-policy.mdbefore replacing or removing a skill.
Scripts
No bundled scripts.
Output format
Return:
- Repository status
- Catalog drift
- Validation result
- Release or deprecation notes
- Blocking issues
- Recommended next action
Failure modes
- If the
skillsCLI cannot discover local skills, report the exact command output. - If upstream helper skills are vendored into
skills/, block public release until they are removed or intentionally licensed for redistribution. - If validation scripts disagree, treat the stricter failure as release-blocking.
Completion criteria
- The repo validates.
- The README catalog matches the skill tree or intentional differences are documented.
- Install commands are correct for local and public use.
- Any release or deprecation path is explicit.