Today's GitHub Trending list tells a fascinating story about the state of AI agent skills. Three repositories, each approaching the same problem from a different angle, collectively reveal a critical gap in the ecosystem.
The Wild West of Skill Extraction
asgeirtj/system_prompts_leaks has amassed over 65k stars by doing exactly what the name suggests: extracting system prompts from Claude Fable 5.1, GPT-6-Astra, Gemini 3.8 Flash, and more.
The community is hungry for「how the big labs tune their agents.」 But treating leaked prompts as a skill library is like treating a stack of sticky notes as an engineering spec. There's no version control. No permissions. No audit trail. No governance.
Structured Skills, But No Governance
SnailSploit/Claude-Red takes a more structured approach. It packages offensive security methodologies into SKILL.md files that prime Claude with expert-level knowledge for specific attack surfaces.
This is a step in the right direction—domain expertise structured as reusable modules. But it's a single-domain, single-machine solution. There's no central registry, no way to manage who gets access to which skill, and no way to roll back to a previous version if something breaks.
The Awesome List Problem
Shubhamsaboo/awesome-llm-apps, with 137k+ stars, lists 100+ AI Agents, Agent Skills, and RAG Apps. It's an incredible resource for discovery.
But a README is not a registry. When your enterprise needs to distribute a custom skill to 50 developers, control who can modify it, audit who used it last week, and ensure everyone is on version 2.1.3—not 2.1.2 or a forked variant—a markdown list simply won't cut it.
The Missing Piece: A Skill Registry
The pattern across all three trending repos is clear: the community knows that AI agent capabilities should be modular, structured, and reusable. But every solution addresses either discovery or packaging—never governance.
What enterprises actually need:
- Publishing & Version Management: Roll out v2.1.3, roll back to v2.1.2 if needed.
- RBAC Permissions: The intern shouldn't have the same skill access as the lead architect.
- Audit Logs: Who triggered which skill, when, and with what result?
- Self-hosted: Your proprietary skills should never leave your infrastructure.
This is exactly the gap that iflytek/skillhub fills. It's a self-hosted, open-source skill registry for AI agents that supports skill package publishing, version management, RBAC permissions, and audit logging.
And you don't have to start from an empty registry. iflytek/iFly-Skills provides official skill packages covering speech recognition, OCR, translation, proofreading, and multimodal capabilities—ready to be registered and distributed through skillhub.
The evolution from leaked prompt dumps to enterprise-grade skill governance is happening. The question is whether your team is still managing skills in a shared folder.
Top comments (0)