$ go mod for Agent Skills v0.0.5

skillmod

Declare, pin, sync. Every machine gets the exact same set of skills.

View source Releases
zsh
$ skillmod get github.com/openai/skills//gh-fix-ci
✓ gh-fix-ci installed · SKILL.mod and SKILL.lock updated
$ skillmod sync
✓ byte-identical with SKILL.lock, idempotent
$ skillmod share --all --agent claude --agent workbuddy
✓ links ready: claude · workbuddy
$ skillmod verify
✓ no drift (exit 0)

Skill dependency management is stuck in the pre-package-manager era

A skill (the packaged unit of instructions and scripts) determines agent behavior. AGENTS.md tells an agent how to behave; SKILL.mod declares which capabilities it needs. skillmod brings the Go-modules playbook to skills: SKILL.mod declares, SKILL.lock pins content with a dirhash, skillmod sync reconciles byte-identically; share hands the same install to any agent, and verify fails the build on drift.

  • ✗ Manual copies, git submodules, platform marketplaces — the same team gets inconsistent agent behavior across machines
  • ✗ When something breaks, "which version were we on?" has no answer
  • ✓ SKILL.lock is content-addressed — any tampering shows up at verify

Capabilities

Eleven commands

  • init register existing skills
  • get add from any Git repository
  • sync reconcile against the lock, idempotently
  • share link into .claude/.codex and any agent
  • list show declarations, versions, install status
  • why explain one entry: origin and state
  • update move to the newest immutable version
  • verify check for drift; the CI gate
  • remove exit cleanly, or just unshare
  • prune clean up stale installs and lock records
  • upgrade replace in place, checksum-verified

Sources straight from Git

The direct mode of Go modules: a skill is a tagged repository, or a monorepo subdirectory (<repo>//<subdir>). A bare skill name after // works too — exact subdirectory first, then a unique name anywhere under skills/. Publishing is tagging. No server, no registry.

Three immutable versions

Semver tags (including subdirectory tags like code-review/v1.2.0), commit SHAs, and pseudo-versions. A pseudo-version takes the repository's highest tag as its base, and old locks migrate on the next update. Branch names are refused — a mutable reference cannot be locked.

Content-addressed lock

SKILL.lock pins content with a dirhash — pure-function generated, timestamp-free, hand-editing forbidden. It also records the resolved commit, so a pseudo-version stays resolvable on machines that never saw the tag.

Shared persistent storage

Read-only whole-repo snapshots live in ~/.agents/skillmod/pkg/mod; HTTPS and SSH variants share storage. A skill is fetched once, and the second project installs straight from disk.

Install as a link, shared machine-wide

Installs default to a symlink into the shared snapshot, falling back to byte-for-byte copies when links are unavailable (Windows included). To edit content, detach first with sync --relink --install-mode=copy.

Share with any agent

An agent is one directory segment: .claude, .codex, workbuddy — all equal. Destinations are recorded on the skill's SKILL.mod entry; sync rebuilds the links on every machine, and verify reports missing or drifted ones.

CI gate, machine-readable

verify exits 2 on drift — use it directly as a build gate; get/sync/update/remove keep modified installs instead of overwriting them and report exit 3, handing the decision back. Every command supports --json with a stable action vocabulary for scripts to branch on.

Flat 1:1 · zero telemetry

No transitive dependency resolution, no constraint solver (the requires field is reserved). Nothing is collected; the only external dependency is Git.

Two files say it all

SKILL.mod is maintained by people and committed; SKILL.lock is written by the tool, deterministically. Which agents a skill is shared with is declared on its entry, too.

SKILL.mod 
schemaversion = 1

[[skill]]
name = 'gh-fix-ci'
source = 'github.com/openai/skills//skills/.curated/gh-fix-ci'
version = 'v0.0.0-20260624023612-49f948faa925'
agents = ['claude', 'workbuddy']
SKILL.lock 
[[skill]]
name = 'gh-fix-ci'
source = 'github.com/openai/skills//skills/.curated/gh-fix-ci'
version = 'v0.0.0-20260624023612-49f948faa925'
commit = '49f948faa9258a0c61caceaf225e179651397431'
dirhash = 'h1:kiGlVBeTCF8Q9f0rPATnDn1jBn/obT3TTTL8D8gdCbM='

Two paths to get started

After installing, use skillmod upgrade to replace the binary in place: the download is verified against release checksums before it swaps.

Agent-guided installRecommended

$ npx skills add huija/skillmod --skill skillmod --global

This command only installs the guiding skill into your agent. Then tell it: "Install skillmod, and make sure it is callable from PATH." Platform detection, checksum verification, and PATH setup are all done by the agent.

Manual · one command

$ go install github.com/huija/skillmod@v0.0.5

Requires Go 1.26.6+. Without Go, grab the archive from Releases, verify it against checksums.txt, and put the binary on PATH.