← Home
How skills spread today

A teammate drops a link:
“install this, it’s amazing.”

A moment later, a skill you have not reviewed is running inside your agent.

# dev-tools · Slack
R
Riya
found a skill that turns our git log into release notes. just grab it here 👇
random-gist.example/notes-skill · unsigned, unreviewed
Y
You
…what does it actually do before we run it?
What we're really talking about

A skill is a set of instructions your agent follows.

It gives the agent a consistent way of working: review code the way your team does, write commit messages in your format, or draft your release notes. Define it once, and the agent does it that way every time.

Anthropic describes skills as a practical way to equip agents for real work. As they spread, one question matters more: what exactly are you installing?

The problem

Skills are shared everywhere, but trusted nowhere.

A link in chat. A folder in a repository. A wiki page that may already be stale. Teams can store skills today, but there is no consistent way to inspect their behavior, understand required access, compare versions, or learn how they perform for other users.

A shared folder or repo is fine for storing skills—not for trusting them. It keeps history and versions, but it can’t tell you whether a skill is safe, what it’s allowed to touch, which version you’re really on, or how it worked out for anyone else.

A shared folder or repo

  • No safety review before you run it
  • No summary of what it can access
  • No versions you can trust
  • No sign it works for anyone else

With SkillPatch

  • Exact versions you can pin to
  • Every skill safety-checked before it’s public
  • A plain-language summary of what it does
  • Real feedback from people who use it
So we built it

A trusted home for the skills your agents run.

Browse a public catalog, see exactly what a skill does before you run it, install an exact version in one line, and publish your own — to everyone, or privately to your team.

A folder can store a skill. SkillPatch can vouch for it — every skill is checked for safety before you ever run it. And that’s only the start: save what works into new skills you can reuse, and improve the ones you depend on when they fall short.

Trust · The foundation

Every public release is reviewed before installation.

Each submitted release runs through automated checks across six areas—prompt injection, data exfiltration, code execution, secret access, supply-chain integrity, and network behavior. Releases that do not meet the required threshold are blocked from public installation until the issues are resolved.

96
code-review
✓ Automated checks passed
Prompt injection93
Data exfiltration97
Code execution92
Auth & secrets100
Supply chain95
Network safety98
Reviewed by SkillPatch Security Agent
41
dep-helper
✕ Required checks failed
Prompt injection88
Data exfiltration34
Code execution55
Auth & secrets18
Supply chain47
Network safety22
Reads secrets it doesn't need, then calls an unknown endpoint.
What “verified” means: this release passed SkillPatch’s required automated checks. Users should still review requested access, source, maintainer history, and version changes before installation.
The payoff

See exactly what it does. Then install it.

Once the review, the access it needs, the maker, and the version all look right, install that exact version straight into your agent—no copy-pasting a random folder, no hoping “latest” is the one you actually checked.

your agent · session
/skillpatch install code-review@1.4.0
# fetching reviewed release v1.4.0 …
installed. ask your agent to “review my changes”
Capture what worked

Keep what worked. Use it again tomorrow.

You and your agent figure out a really good way to handle something tricky — an approach worth reusing. But there’s nowhere to keep it. When the session ends, that know-how is gone, and next time you’re solving it all over again.

/skillpatch save reads back through the session, spots the method you landed on, and drafts a skill from it — stripping out anything that should stay private, like repository names, file paths, and ticket numbers.

your agent · session
# the same debugging path worked a third time
/skillpatch save
# reading this session…
# stripping out anything private…
 
─── draft · bug-repro ───
summary: Turn a hard-to-pin-down bug into clear, repeatable steps.
when to use: a bug shows up sometimes, but not every time
 
saved to your library

Review the draft and decide where it belongs: keep it private, share it with your team, or submit it publicly. Public releases go through the same required review process before installation is enabled.

A one-off fix on a Tuesday becomes something your whole team runs in one command.

Skills that keep improving

Improve a skill the moment it lets you down.

Even the skills you rely on will hit their limits — and normally, that gap just stays there. SkillPatch lets you turn a real miss into a fix its maker can review and ship to everyone.

When your agent hits something a skill doesn’t handle, /skillpatch suggest drafts a fix from what just happened — and you see exactly what gets shared before anything is sent.

your agent · session
# the changelog-writer skill missed a scoped monorepo tag
/skillpatch suggest changelog-writer
# agent drafts the fix from this session's context…
─── proposed change ───
+ detect scoped tags in monorepos (e.g. @app/web@1.2.0)
sent to the maintainer, with the trace that prompted it

Every suggestion is reviewed before the maker approves a new version — so the skills you rely on keep getting better, and nothing an AI drafts is ever trusted blindly.

A place to store skills is common. A place that maintains them is not.

For teams

Your team, one standard.

Every team has its own way of working — how you review code, how you ship, the standards you don’t bend on. Usually that knowledge sits with a few senior people and takes newcomers months to pick up. SkillPatch lets you package it into private team skills, so every teammate’s agent can work that way — a new hire installs them and works like a veteran on day one.

skillpatch.dev / teams · product preview
Private workspace · access limited to members
our-api-conventions
v2.1 · used in 4 repos
AVJ
our-pr-template
v1.0 · 2 open suggestions
VK

Same one-line install, same safety checks — just kept inside your team.

The community

Ask the people who actually run it.

Every skill carries its community with it — questions, bug reports, and answers from the people who actually run it. Ask how a skill works, or how to make it fit what you’re doing — and the people already using it answer.

skillpatch.dev / changelog-writer · discussions · product preview
QuestionsBug reports
J
@jsmithquestion2d ago
Does this work with two Python repos in one workspace?
V
@venkatsai✓ maintainer1d ago
Yes. It detects each repo's root and scopes the notes per package. Added an example to the docs, thanks for the nudge.

Anyone who’s run it can weigh in — maintainers included.

The best skills shouldn’t be buried under a search box. Your feed brings them to you — what’s trending, what the makers you follow just shipped, and what fits the kind of work you do.

skillpatch.dev / home · product preview
For YouFollowingTrending
C
changelog-writer▲ trending✓ verified
Frequently installed this week. Turns a messy git log into clean, categorized release notes.
V
pr-review-buddynew✓ verified
Published by @venkatsai, a maintainer you follow.
A
api-mock-gen✓ verified
Relevant to Frontend, an area you browse often.
Start here

Set up once. Then it lives in your agent.

1

Connect your agent. Copy your setup command from Settings and run it once.

macOS / Linux

# from Settings, your personal setup command
curl -sSL https://skillpatch.dev/setup/<your-key> | bash

Windows · PowerShell

irm https://skillpatch.dev/setup/<your-key> | iex
2

Then work from anywhere in your session.

/skillpatch browse code
/skillpatch install code-review
/skillpatch save
Get started at skillpatch.dev

Browsing is open to everyone. Connecting unlocks installs, publishing, teams, and GitHub sync.

Your agent will run whatever you give it.
SkillPatch is how you know it's worth running.