Ross Peili for ARPA Hellenic Logical Systems

Posted on Sep 2

Skillware 0.5.3 is out — installable agent skills, from Gmail to KPI gates

#python #ai #opensource #agents

Skillware 0.5.3 is on PyPI and GitHub. If you last looked at 0.4.8, a lot happened: new registry skills, a full office/mail stack, CLI config and doctor tooling, catalog version history, refreshed docs under Skill anatomy, example smoke tests in CI, and a deterministic business-KPI gate skill. This post catches you up and shows how to install and try it today.

What's new in 0.5.3

Headline additions

monitoring/kpi_gate v0.1.0 — evaluate a metrics snapshot against an operator-maintained policy charter; return error / warning findings or honest insufficient_data refusals. Stdlib-only, no network, fail-closed contract errors (#317, @mrmasa88).
Example smoke tests — CI runs offline demos under examples/ without live API keys (#237).
README & introduction refresh — tighter Quick Start, shorter Gemini hero (token_limiter), Skill anatomy vocabulary, cleaner Mermaid (#326).

Headline fixes & policy

Pytest isolated from operator global config.yaml (#302).
Security support windows: >= 0.5.3 patched, 0.4.6–0.5.2 silent, < 0.4.6 unsupported with a CLI advisory.

Since 0.4.8 — the full arc (0.4.9 → 0.5.3)

New & upgraded skills

Release	Skill	What it adds
0.4.8	`security/prompt_injection_firewall`	Offline scan of untrusted text before LLM context — hidden channels, Unicode smuggling, instruction overrides
0.4.8	`dev_tools/issue_resolver` (profiles)	Caller-fetched `ISSUE_RESOLVER.md` repo profiles for agent issue workflows
0.4.8	`creative/bg_remover` v0.2	Hardened local background removal
0.5.0	`office/gmail_handler`	Gmail IMAP/SMTP — address book, preview/confirm send & reply, search, scan cursor
0.5.1	`office/gmail_handler` v0.2	Attachments, multi-profile signatures, `skillware mail` CLI
0.5.2	`security/deceptive_ui_guard`	Pre-click deceptive UI scan — DOM vs visible surface, trust score
0.5.2	`finance/uk_companies_house_handler` v1.2	Pipeline orchestration, composite actions, partial previews, session context
0.5.3	`monitoring/kpi_gate`	Business-metric policy gate for agent loops

Framework & CLI

Release	Highlight
0.4.9	Persistent `.skillware.yaml` / global config; interactive paths editor; `skillware doctor` (DEPS/LOAD); inspect-only `load_skill(..., execute_module=False)`; requirement pin validation at load time
0.5.0	Registry identity CI guard (`manifest.name` must match folder path)
0.5.1	`skillware mail` submenu; merged `mail.*` config; richer PyPI metadata
0.5.2	Catalog Version + Skill history on every skill page; contributor instruction guidance refresh
0.5.3	Example smoke layer; doc narrative pass; security floor bump

Documentation & meta

Skill anatomy vocabulary everywhere: Contract, Effect, Directive, Assurance, Presentation, Interface (#319, refined in #326).
issuer.org policy documented; ARPA-driven skills aligned (#295).
Issue templates, category labels (cat: finance, etc.), and skillware.site as PyPI homepage.

What is Skillware, in a nutshell?

Skillware is an open-source framework and registry for modular agent capabilities. It installs know-how for AI agents — modular Skills (code, contract, and host guidance) that decouple capability from the model.

Don't prompt your agents — equip them.

Each skill is a folder on disk:

manifest.yaml — Contract (schema, constitution, issuer)
skill.py — Effect (deterministic Python)
instructions.md — Directive (how the host should use the tool)
test_skill.py — Assurance (offline bundle tests)
card.json — Presentation (catalog / UI metadata)

The loader adapts Contract to Gemini, Claude, OpenAI, Ollama, and other OpenAI-compatible hosts. You run the agent loop; Skillware supplies the tools and the playbook.

Deep dive: Introduction · Vision

How it works

Registry  →  SkillLoader  →  Host tool schema  →  your agent loop

SkillLoader.load_skill("category/skill_name") resolves the bundle (bundled PyPI copy, project skills/, or configured paths).
Interface adapters (to_gemini_tool, to_claude_tool, to_openai_tool, …) expose the manifest to your model API.
instructions.md goes into the system prompt so the model knows when and how to call the tool.
On tool call, skill.execute(args) runs deterministic Effect and returns JSON.

Pattern reference: Agent loops

Install and test it now

Requires Python 3.10+.

pip install skillware
skillware list
skillware paths

Per-skill runtime deps (optional):

pip install "skillware[monitoring_kpi_gate]"
pip install "skillware[office_gmail_handler]"
pip install "skillware[security_prompt_injection_firewall]"

Full registry + dev tooling:

git clone https://github.com/ARPAHLS/skillware.git
cd skillware
pip install -e ".[dev,all]"
pytest tests/
skillware test

Minimal Gemini loop (needs pip install "skillware[gemini]" and GOOGLE_API_KEY):

import google.genai as genai
from google.genai import types
from skillware.core.loader import SkillLoader

bundle = SkillLoader.load_skill("monitoring/token_limiter")
skill = bundle["class"]()
tool = SkillLoader.to_gemini_tool(bundle)

client = genai.Client()
response = client.models.generate_content(
    model="gemini-2.5-flash",
    contents="Check token budget: task_id demo, current 95000, max 100000.",
    config=types.GenerateContentConfig(
        tools=[tool],
        system_instruction=bundle["instructions"],
    ),
)
for part in response.candidates[0].content.parts:
    if part.function_call:
        print(skill.execute(dict(part.function_call.args)))

Browse runnable demos: skillware examples · examples index

What skills are in the registry?

18 bundled skills across 11 categories — browse the Skill Library or skillware.site/skills.

Category	Examples
Office	PDF form filler, Gmail handler
Finance	Wallet screening, UK Companies House
DeFi	EVM transaction handler (quote, preview, execute)
Security	Prompt injection firewall, deceptive UI guard
Compliance	PII masker, ToS evaluator, MiCA module
Monitoring	Token limiter, KPI gate (new in 0.5.3)
Dev tools	Issue resolver (GitHub issue workflows)
Data engineering	Synthetic generator, novelty extractor
Creative	Background remover
Optimization	Prompt token rewriter
Wellness	Mental coach (crisis triage, scope limits)

Skills are model-agnostic: same bundle, different adapters. Most ship offline or local-first paths for tests; live API skills document env vars on their catalog page.

Contributing — humans and agents welcome

Skillware is MIT-licensed and built in the open. Contributions we merge regularly:

New skills — copy templates/python_skill/, add docs/skills/<name>.md, row in the catalog
Skill upgrades — bump manifest version when behavior changes; update Assurance + Presentation together
Docs & examples — usage guides per provider, runnable scripts under examples/
Framework & CLI — loader, adapters, skillware CLI

Humans: start with CONTRIBUTING.md and the Agent Code of Conduct.

Agents: follow the Agent Native Workflow — scoped PRs, deterministic skills, real issuer attribution, CHANGELOG under [Unreleased] for user-visible changes. Many maintainers use dev_tools/issue_resolver with optional .github/ISSUE_RESOLVER.md profiles for repo-specific context.

Pick a good first issue or propose a skill via the GitHub Skill Proposal template.

Upgrade notes

pip install -U skillware

From 0.4.x: bundled skills work without a local skills/ tree; try skillware paths if you use custom roots.
UK Companies House v1.2: get_officers defaults to active_only: true — pass false for resigned officers.
Security: plan to run >= 0.5.3 for patched releases; older wheels get a CLI nudge below 0.4.6.

Full changelog: CHANGELOG.md — 0.4.8…0.5.3

DEV Community