You've Got Agent Skills. Now Who Governs Them?

The Agent skill ecosystem is booming.

Today on GitHub Trending, three repos highlight how far we've come:

• mattpocock/skills — "Skills for Real Engineers. Straight from my .agents directory." One engineer just open-sourced his entire agent config.
• anthropics/skills — "Public repository for Agent Skills." The official skill repo from Anthropic.
• affaan-m/ECC — "The agent harness performance optimization system. Skills, instincts, memory, security..." A full harness for agent execution.

Skills are no longer scarce. They're everywhere. You can copy them from a stranger's directory, pull them from an official repo, or bundle them into a harness.

But here's the gap nobody's talking about:

When your team grows beyond one developer, questions that personal directories can't answer start to matter:

• Who has permission to call which skill? Not every agent should access every skill. Payment processing skills shouldn't be callable by your content-writing agent.
• When someone updates a skill, who approves it? If Alice changes a skill's logic and Bob's agent breaks the next day, how do you trace it?
• When an agent does something wrong, how do you audit? Compliance teams need to know who called what, when, and with what result.

The missing layer: a self-hosted skill registry

This is where iflytek/skillhub comes in.

It's a self-hosted, open-source agent skill registry built for exactly these problems:

• Skill package publishing & version management — Every skill has a version history. Updates are deliberate, not accidental.
• RBAC permissions — Control who can publish, who can call, and who can admin. Different roles for different team members.
• Audit logs — Every skill call is logged. When something goes wrong, you know exactly what happened, when, and who triggered it.

Think of it as the difference between a shared Google Doc (everyone has edit access, changes are untracked) and a proper CI/CD pipeline (versioned, reviewed, audited).

How it fits together

Imagine this workflow:

1. You grab skills from mattpocock/skills or anthropics/skills
2. You add domain-specific skills from iflytek/iFly-Skills — official voice, OCR, translation, proofreading, and multimodal skill packs
3. You register all of them into iflytek/skillhub
4. You assign RBAC permissions — Agent A can call voice + OCR skills, Agent B can call translation + proofreading
5. Every call is audited. Every version is tracked. Every change is logged.

Now your team isn't just "sharing skills" — it's governing them.

Why self-hosted matters

Public skill repos are great for discovery. But enterprise skills — internal business logic, proprietary workflows, compliance-sensitive operations — can't live on a public repo.

iflytek/skillhub is self-hosted. Your skills stay on your infrastructure. Your permissions are yours. Your audit logs are yours.

The bottom line

The Agent skill ecosystem has solved the "where do skills come from?" problem.

The next problem is: who controls them?

iflytek/skillhub is one answer. Check it out: https://github.com/iflytek/skillhub

And if you need domain-specific skills (voice, OCR, translation, multimodal), iflytek/iFly-Skills has you covered: https://github.com/iflytek/iFly-Skills