Chapter 24 · Skills Ecosystem and Team Governance

Chapter goals: Learn about Anthropic's官方技能仓库, the compatibility status of mainstream tools, andmaster the team-shared skill security review checklist.

24.1 Official and Community Skills Repositories

Anthropic Skills Repository

Anthropic maintains an official skill collection: anthropics/skills. It includes:

• Document processing skills: PDF extraction, Word conversion, PPT parsing;
• Web development skills: frontend builds, API design, deployment pipelines;
• Code quality skills: security scanning, performance analysis, refactoring suggestions.

These skills遵循 the Agent Skills standard and can be directly loaded by any compatible tool.

Other Notable Skill Sources

Source	Characteristics
mattpocock/skills	TypeScript ecosystem精选 skills; emphasizes "small and改-able"
obra/superpowers	Complete development methodology; skills auto-trigger
Fission-AI/OpenSpec	Spec-driven development;变更即工件

24.2 Cross-Tool Compatibility

One of the design goals of the Agent Skills standard is cross-tool compatibility. Mainstream tools已 support it:

// ~/.pi/agent/settings.json
{
  "skills": [
    "~/.claude/skills",       // Claude Code skills directory
    "~/.codex/skills",        // OpenAI Codex skills directory
    "~/.pi/agent/skills",     // Pi global skills
    "./.pi/skills"            // Project-level skills (requires trusted project)
  ]
}

Compatibilitytool清单 (as of mid-2025):

• Claude Code (Anthropic)
• Codex (OpenAI)
• Cursor / Windsurf / VS Code Copilot
• Gemini CLI (Google)
• Pi (this tutorial platform)
• Devin, Aider, Opencode, etc.

Note

不同 tools may have略有差异 in their implementation程度 of the standard; consulting thespecific tool's docs is recommended to confirm.

24.3 Team Sharing Methods

Method 1: Git Repo + settings Reference

{
  "skills": ["https://github.com/myteam/project-skills"]
}

Method 2: Internal npm Package

Package the skills as an npm包; team members npm install then reference:

{
  "skills": ["@myorg/team-skills"]
}

Method 3: shared/skills Directory in a Monorepo

monorepo/
├── packages/
│   ├── frontend/
│   └── backend/
└── skills/                    # Shared skills
    ├── code-review/
    │   └── SKILL.md
    └── deploy-check/
        └── SKILL.md

Reference in the root settings.json:

{
  "skills": ["./skills"]
}

24.4 Security Review Checklist

Before introducing a third-party skill,务必完成以下检查:

Item	Description
Source可读	Can理解 the full content of SKILL.md
No malicious commands	Check whether steps contain dangerous shell commands
Resource isolation	Confirm the referenced scripts/references are within可控范围
Least privilege	Does the skill请求工具 permissions beyond what's needed?
Update mechanism	Is the subscription source可信? Are updates auto androllable-back?

Security Warning

Skills can instruct the model to execute任意 operations and may携带 executable code.务必阅读 the content before installing community skills.

24.5 Team Governance Suggestions

1. 建立技能审核流程: new skills需经 tech lead review;
2. Version管理: use git tags to标记 skill versions; avoid静默 updates;
3. Disable auto-trigger for sensitive skills: set disable-model-invocation: true for skills involving生产 environment operations;
4. 定期清理: remove unused skills to减少 context noise.

Chapter Summary

• Anthropic's官方 repository provides精选 skills for document processing, web development, etc.;
• Mainstream tools (Claude Code/Codex/Pi/Cursor, etc.)均已兼容 the Agent Skills standard;
• Team sharing can实现 via git repos, npm packages, or monorepos;
• Security review必查: source readability, no malicious commands, least privilege.

🧪 随堂测验

点击你认为正确的选项。答错时会展示正确答案与原因解析。

1. Which of the following tools does NOT原生支持 the Agent Skills standard?

2. When sharing skills within a team, which method可以实现 "subscribe-to-update"?

3. Regarding third-party skill security review, which item is NOT必须的?

4. Which scenario is most适合 for using `disable-model-invocation: true`?

🛠️ Hands-on Practice

1. Clone the anthropics/skills repo; pick a document processing skill; read its SKILL.md;分析 its description design.
2. Create a skills/ directory in your team monorepo; add a custom skill and引入 it via settings.
3. Perform a security review on an introduced external skill; fill out the review checklist and记录 findings.

After completing the exercises, proceed to Next chapter: Three Skills Repositories Compared.