Skill Ledger: provenance and fix tracking for agent skills in your repos

The two ideas are in different positions. The Skill Ledger angle is fairly open, while the registry angle is already contested. Scanning skills for malicious content is already crowded. Snyk, Cisco, NVIDIA, Sentry and several free open-source tools all do it, and Snyk already sells an endpoint inventory of skills. Tracing a copy back to its origin and flagging upstream fixes it missed is much thinner. The only products I found are a single-user open-source tool (skill-drift) and a handful of one-off GitHub Actions in individual repos that rely on authors writing source pins into frontmatter. I found nobody offering an org-wide GitHub app that recognises copies whose provenance metadata was stripped, matched against a crawled public corpus of skills. Research supports the problem: one cited study found that 53% of reused skills were never updated after adoption, and OWASP lists missing provenance as a top risk. So the opening is real but small. The defensible asset would be the corpus plus the fingerprinting itself, meaning fuzzy, directory-level matching that survives edits, together with a feed of upstream security fixes. That is essentially Dependabot or a CVE feed for skills. The risk is that this becomes a feature, not a company. Snyk already has the inventory and the AppSec buyer. Mend, Socket or Endor could add lineage the same way they handle package provenance, and GitHub itself could ship it. The signed internal registry faces SkillReg, localskills.sh, TrueFoundry, Tessl and Anthropic's own org sharing. A new entrant would only stand out by being narrowly focused on compliance: CI policies that block unreviewed skills in PCI-scoped repos, and audit evidence formatted for SOC 2 and PCI auditors. That works better as an add-on to the provenance app than as a standalone product. The strongest position is to lead with provenance and missed-fix alerts, which nobody does well yet, and sell compliance reporting on top. Expect a window of 12 to 18 months before the SCA incumbents close it.

• Snyk Agent Scan

  Snyk's tool keeps an inventory of installed agent components, including skills, MCP servers and harnesses, and scans them for prompt injection, malware, secrets and credential handling. It has a CI mode, and a third-party source says Snyk Evo adds background inventory across developer machines. It works from the endpoint and looks for threats. It does not trace where a skill was copied from or flag fixes the copy missed.

• Cisco AI Defense skill-scanner

  Open-source scanner that combines YARA and pattern rules, dataflow analysis and an optional LLM judge. It ships a pre-commit hook and SARIF output. A fork (marekx) adds detection of overlap between skills. It checks content for risk and does not track lineage.

• NVIDIA SkillSpector

  Open-source scanner with 71 vulnerability patterns. It accepts repos, URLs and zip files, and feeds NVIDIA's Verified Skills pipeline. Like the others, it scans content and does not trace provenance.

• SkillGuard and other OSS scanners

  Offline scanners that can fail a CI build when they find a risky SKILL.md, AGENTS.md or CLAUDE.md anywhere in a repo. syedabbast/skill-scanner and Sentry's skill-scanner skill are similar. There are many free tools in this category.

• skill-drift (zhiganov)

  The closest match to the core idea. It is a read-only report on installed skills: where each came from, whether upstream has moved, and whether the copy on disk still matches what it claims to be. It compares whole skill directories, not just SKILL.md. It is a single-user open-source tool, not an org-wide GitHub app, and it has no public corpus to fingerprint against.

• DIY upstream drift workflows

  Several repos pin each skill to an upstream commit in its frontmatter and run a weekly job that opens an issue when upstream moves. Others are proposing the same workflow (kristofdegrave, anntnzrb/agents, faviann/skillset). This shows the need is real, but teams currently solve it by hand inside individual repos.

• SkillReg

  Private registry for agent skills. It advertises versioning, approval workflows and security scanning as enterprise features. That puts it directly against the signed internal registry idea.

• localskills.sh

  Another private skill registry with immutable versions, rollback and team-scoped permissions.

• TrueFoundry

  Lets teams govern skills inside its AI gateway platform, including pinning a specific skill version per agent.

• Anthropic Claude Team/Enterprise skill sharing

  Anthropic's enterprise guidance covers security review checklists, separating authors from reviewers, and keeping an internal registry with owner and version. A third-party source (Agentman) says Team and Enterprise plans have had native org sharing and an internal directory since December 2025. This is the platform owner moving into the registry idea.

• Mend / OWASP Agentic Skills Top 10

  OWASP's skills Top 10 lists supply chain compromise and missing provenance as a named risk. Mend argues in its blog that teams need provenance, pinning and an inventory security can query. This suggests established software composition analysis (SCA) vendors are likely to add the feature soon.

• Tessl

  Argues that skills are supply chain components that need inventory and versioning. Tessl runs its own skills registry, so it is a nearby competitor.

Checked 2026-10-10