The moment I noticed the problem
Somewhere around late May 2026, I had a folder full of SKILL.md files. Some were mine, some were pulled from a corporate library, some were written half-tired at 11pm to unblock a task. They all worked, in the sense that the agent picked them up and did something. But I couldn't have told you, with a straight face, which ones were safe to hand to a teammate, which ones would silently break the moment someone tried them in Cursor instead of Claude Code, and which ones had a curl | bash sitting quietly in a code block that nobody had ever read past the first two lines.
That's the actual origin story. Not a grand vision — a folder of skills I didn't trust.
Two open standards had recently landed, within months of each other: AGENTS.md (the Linux Foundation AAIF format for repo-wide agent instructions) and SKILL.md (Anthropic's Agent Skills spec for packaged, on-demand procedures). Both are refreshingly simple — frontmatter plus Markdown, no build step, no SDK lock-in. That simplicity is exactly why they were spreading fast, and exactly why nobody had built the boring, unglamorous layer every fast-spreading format eventually needs: governance. Something that scores a skill, audits a library of them, checks whether a "portable" skill is actually portable, and catches the security issues a human reviewer skims past on the fifth PR of the day.
