Skill packLesson

Skill packs

You don't have to write every your agents use. A Skill pack is a set of Skills someone else wrote and published, which you install into your project. The catch is that the files are then in your repo, where anyone can edit them, and the next install would undo that edit without a word.

Know Skill packs already? Skip to In Terrarium.

Outside the box · General

The concept

A Skill is a folder with a SKILL.md file of instructions for one kind of job. A pack publishes many of them in one GitHub repository. The pack Terrarium uses, Matt Pocock's Skills For Real Engineers (mattpocock/skills), holds Skills such as tdd, diagnosing-bugs and grill-me. It can be installed as a plugin, which updates itself, or with the skills command-line tool, which copies the Skills into your project as ordinary files that you update by hand:

npx skills@latest add mattpocock/skills

The command-line tool installs into the project by default, so the Skills are committed with your code and every clone has them. When one install serves several agents, it can link each agent's Skill folder to a single copy. npx skills update brings the copies up to date with the pack.

Some packs also ship a setup Skill that writes a project's own configuration from templates. This pack's setup-matt-pocock-skills asks which issue tracker the project uses and, if the pack's triage Skill is installed, whether to keep its default triage labels. It picks the layout of the domain docs without asking unless the repo looks like a monorepo, then writes docs that the other Skills read.

Full referencemattpocock/skills on GitHub

Looking inside

In Terrarium

The pack's Skills sit in .agents/skills/ beside Terrarium's own, and .claude/skills/ holds a link to each folder so Claude Code finds it. The installer's skills-lock.json records each pack Skill: its source repository, its path there, and a hash of that upstream file.

skills-lock.json ↗112–117as of 1 Nov 2026

112    "tdd": {
113      "source": "mattpocock/skills",
114      "sourceType": "github",
115      "skillPath": "skills/engineering/tdd/SKILL.md",
116      "computedHash": "daf55026f456af104a72fa43247f7bcec89e5127316dc5b1b8d675d6a9d8ce94"
117    },

Being listed there is what makes a Skill a pack Skill, and nobody in Terrarium edits a pack Skill's files. Each pack Skill's entry carries an installedSha256, the sha256 of its installed SKILL.md:

layers/journal/content/current/skills/tdd.yml ↗1–4as of 1 Nov 2026

1name: tdd
2category: general-engineering
3importance: supporting
4installedSha256: 5505d25bbaa8fc14a79e4d20163936958992a2995b7f1dd1d6197edc9ed722e0

scripts/gate/validate-skills-lock.ts is a step of the 's . It reads the lock only to learn which Skills are the pack's and hashes each one's installed SKILL.md, no other file in its folder. It fails when that file is missing, and, for a Skill with an Inventory entry, when the entry has no pin or the hash differs from it. pnpm verify:skills-lock --write rewrites each entry's pin from the file on disk.

The setup Skill seeded three docs: docs/agents/issue-tracker.md, docs/agents/triage-labels.md and docs/agents/domain.md. Those are Terrarium's own now. Each opens with a note not to re-sync it against the template it came from.

Why it's built this way

Pack Skills untouched. Reinstalling the outside Skill pack would silently overwrite a local edit, so pack Skills are never edited. The Gate keeps a fingerprint (a hash) of each pack Skill's SKILL.md in its entry and fails on a mismatch. Notes on fit go in that entry, not the files. The cost: a pack Skill's wrong line can't be corrected in Terrarium. ADR-0015 (docs/adr/0015-audit-skills-and-conditional-importance.md).
Our own pin, not the lock's. The lock's computedHash is the installer's hash of the upstream source, which doesn't match the installed file and can't be checked offline, and the lock belongs to the installer. Terrarium keeps its own installedSha256 in the Inventory instead. The cost: every real update from the pack re-pins in the same PR, or the Gate fails. ADR-0015 (docs/adr/0015-audit-skills-and-conditional-importance.md).
Seeded docs become ours. A setup Skill writes generic docs from templates, and a project then fills them with its own facts, which a re-sync would wipe. A doc copied from a pack template is Terrarium's to edit and is never re-synced. The cost: a later improvement to the template reaches the doc only if someone carries it over by hand. ADR-0005 (docs/adr/0005-skill-model.md).

What to watch for

Check the lock before you edit a Skill. A pack Skill not yet in use has no pin, so the Gate won't catch an edit to it; only skills-lock.json tells you it is the pack's. ADR-0015 (docs/adr/0015-audit-skills-and-conditional-importance.md).
Re-pin only after a real install. --write makes any edited file pass, so run it only when the new content came from the pack.

Try it in your project

Pick one Skill you installed from a pack, record the sha256 of its SKILL.md in a file you own, and add a CI step that fails when the installed file's hash differs.

Where next

Last updated 1 Nov 2026 · Latest source on GitHub ↗