Agent Skill Creator

Build trusted agent skills. Govern their marketplace. Improve what your organization knows.

Website · Installation · Governed team marketplace · Organizational acceptance · GitLab team registry · Changelog

Agent Skill Creator turns human expertise into tested, installable agent skills and provides the operating system for managing those skills through a user-defined marketplace.

Give it a sentence, spreadsheet, PDF, link, screenshot, transcript, or half-working script. It reconstructs the judgment behind the work: the important question, when to ask it, which decision the answer supports, what evidence makes the answer credible, and how success will be measured. It then builds the skill, evaluates it, installs it, and safely tries it on representative input.

For teams, the same system governs the complete lifecycle:

create → attest → admit → approve → publish → discover → install
       → use → update → rollback → quarantine → retire

The result is more than a collection of prompts. It is a maintained map of which questions an organization knows how to answer, which decisions it can support, and whether those capabilities still work.

Who it is for

What makes a skill valuable

Answers are becoming inexpensive. The scarce asset is knowing which question matters and what action should follow. Every generated skill therefore carries a required decision contract:

{
  "question": "Why did monthly revenue deviate from plan?",
  "trigger": ["Monthly close data is available"],
  "decision": ["Escalate a material variance", "Accept the reported result"],
  "evidence": ["Revenue ledger", "Approved operating plan"],
  "success_measure": "Every material variance has an evidence-backed owner and action"
}

Creation and marketplace admission fail when any of these fields is missing.

The product in one view

The decisive product test is automated: create three skills, publish a remote tag, discover from a clean consumer, install, invoke twice, update, roll back, quarantine, and confirm installation is blocked. The repository's tests exercise the underlying contracts for that lifecycle; the remaining standard is whether an unfamiliar team can complete it without assistance.

The stronger organizational gate uses four blind, isolated roles: an administrator, workflow expert, marketplace operator, and cross-department consumer. Follow the organizational acceptance protocol; undocumented assistance counts as failure, not success.

Create your first skill

1. Choose your AI tool

The installer detects the AI tools already on your computer and installs the creator in their native locations. For a single-tool install or the complete 17-platform list, use the installation guide.

Success check: reopen your AI tool and ask What can agent-skill-creator do? It should describe turning a workflow into a reusable skill.

2. Give it work you already have

Paste this in your AI tool—not in Terminal:

/agent-skill-creator Every Friday I clean the CRM export, calculate regional
totals, and email a PDF sales report.

You can attach the CRM export, an old report, or the script you currently use. The creator first gives you a short decision contract to confirm:

Question: Which region needs attention this week?
Trigger: the Friday CRM export is available
Decision: investigate a variance or accept the reported totals
Evidence: the CRM export and reconciliation output
Success: every material variance has an owner and next action

Reply “yes” or correct the part I got wrong.

3. Judge the first result

The creator owns the technical work and reports four visible stages:

Understand  ✓ workflow and success criteria confirmed
Build       ✓ reusable skill created
Check       ✓ structure, code, security patterns, and examples checked
Try         ✓ installed and run once on representative input

A successful handoff leads with the result:

The weekly sales report now works from a CRM export.

Result: ./output/weekly-sales-report.pdf
Use it: /weekly-crm-report-skill data/crm-export.csv

Checks: structural requirements passed · 4 parallel checks passed · representative run passed

If a safe test needs credentials, data, or permission, the creator says verification-blocked and gives one exact setup action. It does not send a real email, publish, purchase, or write production data merely to prove the skill works.

If the result is wrong, describe the correction once:

python3 ./weekly-crm-report-skill/scripts/evolve.py --correct "UK sales arrive one day late"

The correction becomes part of the skill's maintained knowledge.

What happens behind the four stages

You do not need this section to create a skill. It explains what the creator is doing when you want to inspect the process.

Every skill is checked as one connected system. The skill graph links its instructions, scripts, evaluations, and expected outputs. Two structural requirements confirm that every expected result is tested and every predictable multi-step workflow has one reliable entry point. Four checks—specification, pipeline, security, and evaluation schema—run in parallel. Finally, a representative run proves that the skill produces a useful result.

Internally, Build covers the five engineering phases: discovery, design, architecture, detection, and implementation. Details live in the pipeline reference.

The graph is the release gate behind Check:

python3 scripts/skill_graph.py run ./the-skill/ --jobs 4

The two requirements have technical identifiers for automation. every_expected_is_reachable prevents an expected output from sitting in the package without participating in an evaluation. deterministic_multistep_has_orchestrator requires a predictable multi-step skill to expose one reliable scripts/run_pipeline.py entry point. Unchanged check results are reused by content hash.

What you receive

Every generated skill includes:

• A required question, trigger, supported decision, evidence contract, and measurable success condition in discovery.json.
• A focused SKILL.md and companion AGENTS.md.
• Functional scripts with one pipeline entry point when the workflow is sequential.
• Golden examples and regression checks, unless explicitly disabled with --no-eval.
• Validation, dependency, staleness, and correction tooling.
• A private local success ledger that measures verified creation, reuse, recovery, and durable activity without storing skill names or workflow content.
• Native installation support across 17 agent tools.

Generated skills use the Agent Skills Open Standard and invoke as /skill-name on tools that support slash commands.

Inspect product success locally:

python3 scripts/success_ledger.py summary

The ledger has no network transport. Read the event schema, privacy boundary, and metric formulas, or set ASC_SUCCESS_LEDGER=off to disable recording.

Why the checks matter

The creator blocks delivery when required structure, pipeline compilation, declared dependencies, or security checks fail. It scans for hardcoded secrets, dangerous code patterns, prompt-injection indicators, hidden Unicode, encoded blobs, and undeclared network endpoints.

A clean scan is not proof of safety. It means no known scanner pattern matched. Skills execute with your filesystem access and available credentials, so imported skills still require ordinary software-dependency judgment.

Audit a skill you did not create:

/agent-skill-creator --audit ./downloaded-skill/

The audit reports what the skill reads, writes, and reaches; instruction-body risks; and whether the code matches its description. A high-severity finding blocks install. See the skill-audit reference.

Runnable examples

Try the smallest example without installing the creator:

git clone https://github.com/FrancyJGLisboa/agent-skill-creator
cd agent-skill-creator/references/examples/weekly-crm-report
python3 scripts/run_pipeline.py --input evals/golden/case-1/input.csv --output /tmp/summary.json
python3 scripts/run_evals.py --rollout

The marketplace operating system

Users define the marketplace: its departments, owners, approval rules, supported platforms, decision contracts, and success measures. Agent Skill Creator supplies the control plane that makes those definitions executable.

Follow the complete marketplace timeline for every command in operational order: prerequisites, initialization, GitHub protection, skill intake, review, release, discovery, installation, update, rollback, quarantine, and correction.

Create a central GitHub or GitLab repository for department-owned skills, reviewed bundles, and version-pinned installs in VS Code Copilot Agent Mode:

python3 scripts/team_marketplace.py init \
  --name "ACME Skills" \
  --repository ACME/acme-skills \
  --department finance=finance-owner \
  --approver acme-platform \
  --supported-platform github-copilot \
  --starter-bundle analyst-starter \
  --marketplace ./acme-skills

python3 scripts/team_marketplace.py add ./report-skill \
  --department finance \
  --bundle analyst-starter \
  --marketplace ./acme-skills

The generated repository includes registry.json schema v2, question-first search, structured skill pages, departmental paths, bundle manifests, CATALOG.md, CODEOWNERS, governance instructions, scheduled health checks, and provider-native CI. Add --provider gitlab and, for self-managed instances, --host gitlab.acme.test during init. Admission blocks incomplete decision contracts and failed validation, security, pipeline, eval, or attestation gates. It also rejects path traversal, duplicate identities, undeclared network endpoints, embedded secrets, instruction injection, and pre-approved shell or bash access.

Install an approved bundle at an immutable release:

python3 scripts/team_marketplace.py install \
  --bundle analyst-starter \
  --scope user \
  --pin v1.2.0 \
  --marketplace ./acme-skills

Use team_marketplace.py update to re-gate a strictly newer semantic version. Use --scope project for a repository-local install. Roll back by reinstalling an exact previous tag with --force; quarantine immediately removes a skill from installable states. GitHub installs into the consumer project. GitLab clones the exact protected tag and copies the bundle into Copilot's user or project skill directory.

The complete marketplace timeline is the canonical operator page. The distribution reference contains the factory's internal routing and fallback behavior.

Use the blind organizational acceptance protocol to test the complete cross-team handoff in isolated sessions. It includes exact-tag local testing, immutable release rules, an empty starter-bundle shape, and the retire-and-recreate generation contract.

GitLab teams use the first-class GitLab marketplace backend, including generated GitLab CI, glab releases, schema-v2 bundles, nested groups, self-managed hosts, and pinned copy-based Copilot installation.

Advanced capabilities

• MCP capability audit: map a vendor MCP server into buildable and missing skill opportunities.
• Cross-platform export: adapt an existing skill for supported tools.
• Multi-agent suites: create coordinated skills for genuinely distinct workflows.
• Team distribution: choose the governed Copilot marketplace or lightweight cross-Git registry.
• Eval and evolution: inspect golden cases, rollouts, holdouts, judges, and model comparisons.

Contributing

Read CONTRIBUTING.md, then run:

uv run pytest scripts/tests/ -q
uv run ruff check --target-version py310

Changes to installation scripts must preserve Bash/PowerShell parity. Changes to the factory contract must keep SKILL.md, the pipeline, interactive guidance, distribution guidance, README, and website aligned.

License

MIT — see LICENSE.