The shop manual learned how to install itself.
The Agent Skills specification describes a folder with a required SKILL.md plus optional scripts, references, and assets. Its best-practices guide recommends progressive disclosure: keep the main file focused and move detail into linked material. That is clean packaging. It is also enough surface area to deserve the same suspicion as any other dependency—especially when scripts can turn prose into execution.
The ecosystem is moving fast around that package shape. Matt Pocock’s current collection explicitly offers two ownership models: a managed, read-only plugin that updates from the publisher, or ordinary files copied into your repository and updated when you choose. The README warns that installing both duplicates every skill. That tiny warning is the whole dependency-management argument in miniature: acquisition mode changes behavior.
Prompt files stopped being stationery when they acquired installers, scripts, and automatic invocation.
A marketplace migration is not a footnote.
OpenAI’s skills catalog now marks itself deprecated and directs users to a plugins repository. The replacement manifest can bundle skills with MCP configuration, agents, commands, hooks, apps, and assets. That is not merely a renamed folder. It is a larger callable surface with more places for policy, credentials, network reach, and updates to hide.
This is normal ecosystem growth, not evidence of wrongdoing. But “deprecated” is operational information. If a team cannot answer which repository, revision, installer, update channel, and fallback produced the behavior in today’s session, it cannot reproduce the session—it can only remember the vibe.
Test the trigger, not the typography.
The Agent Skills evaluation guide separates triggering tests from functional tests. That distinction is excellent. A beautifully written skill that never activates is broken; a skill that activates for everything is also broken. Then the body still has to do useful work under realistic prompts.
Keep a tiny fixture deck beside every important skill: prompts that must trigger, prompts that must not, and one or two outputs whose invariants can be checked. Record the model and client used, because invocation behavior sits partly outside the folder. Do not chase exact prose. Test boundaries, required evidence, dangerous actions, and the promised artifact.
The garage service schedule.
- Choose ownership. Managed means you accept upstream motion; vendored means you own merges and drift.
- Pin the installed state. Record source URL, revision, acquisition command, client, and date.
- Diff before lift. Review instructions, scripts, hooks, external references, permissions, and invocation metadata.
- Run the fixture deck. Positive triggers, negative triggers, functional invariants, and one hostile edge case.
- Keep rollback boring. One documented move should restore the last known-good bundle without depending on the marketplace still existing.