Skill dependency management is stuck in the pre-package-manager era
A skill (the packaged unit of instructions and scripts) determines agent behavior. AGENTS.md tells an agent how to behave; SKILL.mod declares which capabilities it needs. skillmod brings the Go-modules playbook to skills: SKILL.mod declares, SKILL.lock pins content with a dirhash, skillmod sync reconciles byte-identically; share hands the same install to any agent, and verify fails the build on drift.
- ✗ Manual copies, git submodules, platform marketplaces — the same team gets inconsistent agent behavior across machines
- ✗ When something breaks, "which version were we on?" has no answer
- ✓ SKILL.lock is content-addressed — any tampering shows up at verify
Three scenarios — take your seat
skillmod is not built for "one machine, one skill." When any of the following holds, declaring and locking pays for itself.
01
A global base, per-project picks
Personal, machine-wide skills are declared in the global manifest and available everywhere; a project's dependencies are declared in the project's own SKILL.mod / SKILL.lock and committed with the repo. A project installs only what it needs. The two manifests never merge — a command touches the global scope only when it carries --global.
02
Project distribution, one sync away
Commit SKILL.mod and SKILL.lock; add .agents/skills/ to .gitignore. A teammate's fresh clone, your new laptop, and the CI job all run the same skillmod sync: a byte-identical set of skills, with the agent links that share recorded rebuilt on every machine.
03
Update, or pin the version
skillmod update moves every remote skill to the newest immutable version — the highest tag wins, and only a tagless repository tracks HEAD. To pin, write the tag or commit into the version field of SKILL.mod; branch names are refused. SKILL.lock records version, commit, and dirhash, so "which version was in use" always has an answer.
Full walkthroughs for each scenario, plus adopting what already exists and clean removal, live in the scenario guide.
What you get, once it is running
Not another install script — a skill declaration you can commit, reproduce, and verify.
Byte-identical on every machine
Clone, new laptop, CI build — the same skillmod sync installs the same set of skills.
Version questions have answers
SKILL.lock records version, commit, and dirhash, so "which version was in use" is one lookup away.
Tampering and drift surface
Content-addressed locking; skillmod verify exits 2 on drift — usable directly as a build gate.
Local edits are never overwritten
Conflicting targets are kept and reported; exit 3 hands the decision back to a person.
Eleven commands, address and version rules, storage and configuration — the full reference lives in the skillmod docs.
Two paths to get started
After installing, use skillmod upgrade to replace the binary in place: the download is verified against release checksums before it swaps.
Not sure what to do next? Five-minute start →
Agent-guided installRecommended
npx skills add huija/skillmod --skill skillmod --global
This command only installs the guiding skill into your agent. Then tell it: "Install skillmod, and make sure it is callable from PATH." Platform detection, checksum verification, and PATH setup are all done by the agent.
Manual · one command
go install github.com/huija/skillmod@v0.0.5
Requires Go 1.26.6+. Without Go, grab the archive from Releases, verify it against checksums.txt, and put the binary on PATH.