Agent Skills Need Governance Before They Need a Marketplace#

Skills are going to spread fast.

They are easy to copy, easy to remix, and easy to underestimate.

That is the exact combination that creates a new kind of software supply chain problem.

An agent Skill might look like a few instructions and helper scripts. But if the agent can call tools, touch repos, read customer data, create tickets, deploy code, or post in Slack, the Skill is part of production behavior.

Treat it that way.

What a Skill really is#

A useful Skill is not just a prompt.

It can include:

• Instructions.
• Activation rules.
• Examples.
• Scripts.
• Templates.
• Tool assumptions.
• Safety policies.
• Evaluation cases.

That makes it closer to an operational module than a doc file.

If you would review a runbook before letting it guide an incident, you should review a Skill before letting an agent use it during work.

The minimum governance model#

Start with six fields:

• Owner.
• Purpose.
• Allowed tools.
• Data classification.
• Required approvals.
• Eval coverage.

This sounds dull. Good. Dull is how production systems stay understandable.

Version Skills like code#

Do not overwrite Skills silently.

Give each important Skill a version and changelog:

• What changed?
• Why did it change?
• Which workflows use it?
• What evals passed?
• How do we roll back?

An agent changing behavior because somebody edited a shared Skill is the kind of bug that will waste a week.

Separate read Skills from write Skills#

Most Skills should start read-only.

A deployment Skill, refund Skill, customer messaging Skill, or incident declaration Skill is different from a research Skill.

Separate them:

• Read Skills gather context.
• Draft Skills prepare output.
• Write Skills perform actions.
• Approval Skills decide when to pause.

That separation makes the workflow easier to test and much easier to explain.

The review checklist#

Before a Skill is used in production, ask:

• Can it access sensitive data?
• Can it trigger a write action?
• Can it affect customers?
• Does it include examples of correct and incorrect behavior?
• Does it define when the agent should stop?
• Does it cite sources or produce evidence?
• Does it have replay tests?
• Does it have a rollback path?

If the answer is vague, the Skill is not ready.

Skills and MCP belong together#

Skills describe how work should happen.

MCP exposes what work can touch.

The clean design maps them explicitly:

• Skill: "Support refund triage"
• MCP server: billing-mcp
• Tool: stripe.refund.preview
• Approval: required for execution
• Eval: refund policy edge cases
• Audit: all customer account reads and previewed actions

That is a workflow the team can reason about.

Build it in Codelit#

Try this:

Design an agent Skills governance system for a SaaS company. Include Skill owners, versions, allowed tools, MCP servers, data risk, approval rules, eval coverage, rollout, rollback, and audit logs.

Design the Skills governance workflow

Skills are how agent behavior becomes reusable. Governance is how reusable behavior stays safe.