Skill Lock adds a decode scan for cipher-hidden instructions in agent skills

The lockfile part of the idea is already taken. Vercel's skills CLI plus at least five open-source projects already hash skills, pin commits and check for upstream changes, and two of them use almost the same name (skilllock and skill-lock). So a plain skill-lock CLI would arrive late and would need a new name. The opening is with copies that no installer ever recorded. These are skills pasted into a repo by hand, vendored into a project or edited in place. Vercel's tool and Renovate can't see them because they only track skills listed in a manifest. The research shows a few source repos account for almost all of the 2.19M copies on GitHub, so most copies probably fall into this untracked group. A product could win by doing three things for those copies. First, take a public copy-network index like GitSkills or Skill Constellations and keep it fresh as a hosted service. Second, use fuzzy fingerprints that still match edited copies, which SkillLineage and the per-component fingerprinting paper are working toward, so it can tell a user that a copy is an old version of a specific source. Third, link security fixes to the copies that still lack them and open PRs, the way Dependabot does for packages. Nobody I found ties those three together, and no GitHub App opens fix PRs for untracked skill copies. The risks are real. The research groups could release their index. Snyk, JFrog or Socket could add copy tracking to the scanners they already sell. GitHub itself could add skills to Dependabot. Vercel could also extend skills check to local copies. Each of those would squeeze a standalone paid tool. The best angle is probably the fix-propagation GitHub App, sold to teams with many repos and attached to a security advisory feed for skills. That is a cleaner thing to pay for than a lockfile. The search site would mainly be a free way to bring in users.

• Vercel skills CLI (skills-lock.json, skills check/update)

  The most widely used skills installer. It writes skills-lock.json with folder hashes and uses the GitHub Trees API to check whether a skill has changed upstream. According to its docs, it can only track skills that were installed globally from GitHub. It cannot follow local copies, hand-pasted copies or skills added before lock v3.

• skilllock (MHK-ctrl)

  An open-source lockfile manager that writes a skills.lock file with a sha256 digest for every file. That is essentially the lockfile part of this idea, under almost the same name.

• skill-lock (vhsgreed)

  A vendor-neutral skills-lock.json spec with hash pinning, verify statuses and per-skill updates. It uses the name Skill Lock directly.

• skills-lock (luisalima)

  A lock layer that keeps the skill list in package.json and pins commits and content hashes in skills-lock.json, so upstream edits don't change agent behavior silently.

• skiletto

  A version manager for agent skills with its own lock file that pins commit SHAs and content hashes. It can import Vercel's skills-lock.json.

• mdr

  A package manager for SKILL.md, AGENTS.md, CLAUDE.md and llms.txt files, pinned by content hash in mdr.lock.

• skillfortify skill-lock.json

  A security-focused skills project with its own skill-lock.json format.

• SkillLineage

  An experimental open-source CLI that traces the origin, copies and variants of skills. It fingerprints raw bytes, git blob SHA, the normalized instruction text and the whole bundle. Its README says it does not yet claim which repo is the original. This is very close to the Skill Origin site idea.

• Skill Constellations / GitSkills dataset

  Research that builds a dated copy network of 2.19M skill adoptions across GitHub from git history. It finds that a few repos are the source of almost all copies. The companion GitSkills dataset (https://www.alphaxiv.org/abs/2608.10906) indexes every copy with its repo, path and hash. In effect, the public index this idea needs already exists in academic form.

• Renovate (agent skill digest bumps)

  Renovate is already used in practice to open PRs that bump agent skill repos to new upstream commits, including security scan results for each SKILL.md. It only covers skills listed as dependencies, not untracked copies.

• NVIDIA SkillSpector

  An open-source scanner that checks skills for vulnerabilities, prompt injection and supply-chain risk before install. It feeds NVIDIA's Verified Skills catalog, where skills are signed.

• JFrog Agent Skills Registry

  An enterprise registry where skills are versioned, scanned, signed and access-controlled. It covers provenance for teams that publish through it.

• Snyk + Tessl Registry

  Snyk security scanning built into every skill in the Tessl Registry. It is the security vendor most likely to add copy tracking and fix alerts later.

• Sentry skill-scanner

  A Claude Code skill that combines static analysis with an agent-run review of SKILL.md instructions.

Checked 2026-10-10