AgentStack
Browse Sign in
Browse Why AgentStack Sell Docs
Sign in
SKILL verified MIT Self-run

Vendoring Skills

skill-ghostlygawd-recursive-harness-vendoring-skills · by GhostlyGawd

Procedure for importing a THIRD-PARTY Claude Code skill (a SKILL.md pack from GitHub etc.) into this harness. Use when the user asks to "install/add/vendor a skill", points at an external skill repo, or wants a skill pack available across the fleet. Covers trunk-vs-account placement, slimming heavy media, provenance for re-vendoring, and the lint B3 allowlist when the skill exceeds the body cap.…

↗ Repository
— No reviews yet
0 installs
40 views
0.0% view→install

Install

$ agentstack add skill-ghostlygawd-recursive-harness-vendoring-skills

✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • ✓ Prompt-injection patterns
  • ✓ Secret / credential exfiltration
  • ✓ Dangerous shell & filesystem operations
  • ✓ Untrusted network calls
  • ✓ Known-malicious package signatures

What it can access

  • ✓ Network access No
  • ✓ Filesystem access No
  • ✓ Shell / process execution No
  • ✓ Environment & secrets No
  • ✓ Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

View the full security report →

Verified badge

Passed review? Show it. Paste this badge into your README, it links to the public security report.

AgentStack Verified badge Links to your public security report.
[![AgentStack Verified](https://agentstack.voostack.com/badges/verified.svg)](https://agentstack.voostack.com/security/report/skill-ghostlygawd-recursive-harness-vendoring-skills)

Reliability & compatibility

✓ Security review passed
0 installs to date
— no reviews yet
● 2mo ago

Declared compatibility

Claude CodeClaude Desktop

Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.

Preview Execution monitoring

We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.

How agent discovery & health will work →
Are you the author of Vendoring Skills? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

Vendoring a third-party skill

Importing an external skill is NOT authoring a harness learning — it is adding a vendored dependency. Keep it traceable and lean.

Placement

Default to the shared trunk skills/ (kernel prime directive 6, ONE TRUNK): one brain, every account sees it via the config-dir symlink (on Windows that link must be a REAL symlink, not an MSYS ln -s copy, or the account forks the trunk — see ADR 0004). Raise account-local isolation only if the user needs real credential/scope separation — don't over-argue it when they said "to my account"; the trunk is the default.

Install — do NOT use npx skills add for trunk vendoring

npx skills add pulls the WHOLE repo and symlinks it into an agent skills dir — wrong for a slimmed, committed trunk artifact. Instead:

  1. git clone --depth 1 into a gitignored scratch dir (e.g. under

.claude-private/.../_staging); clean it up after.

  1. Copy only the functional skill into skills//: SKILL.md +

references/ + scripts/ + small functional assets (.jsx/.html/.js/.svg/.json).

  1. DROP heavy / non-functional media: audio/BGM (.mp3), showcases/, sfx/,

demos/, sample dirs. (huashu-design went 32 MB → 814 KB this way.) State plainly what you dropped.

Provenance & updates

Add a provenance: line to the vendored SKILL.md: upstream URL + commit sha + date. Updates = re-vendor (re-clone, re-slim), never hand-edit the body — or you lose the ability to track upstream.

When SKILL.md exceeds the B3 body cap (200 lines)

Do NOT gut the upstream file to fit. Add the skill PATH to the human-gated VENDORED_SKILLS allowlist (the B3 waiver) in lint/lint_harness.py — create it if it does not exist yet. That is an enforcement-layer edit, so go via /harness-pr (HUMAN_APPROVED marker → harness-auditor → /run-evals → human merge). The allowlist is path-gated; never a self-asserted frontmatter flag (see skill harness-authoring).

Flag the gaps, don't recite them

Bundled scripts usually need external runtime deps (node/ffmpeg/puppeteer/API keys) and the dropped media. Capture each as a follow-up (harness followup add); end with a count line, surface on pull (skill follow-up-handling).

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet, be the first.

Write a review

Versions

  • v0.1.0 Imported from the upstream source.

More in Developer Tools