skill-provenance

Skill Provenance

Portable provenance, integrity, and drift control for Agent Skills across local folders, registries, platform uploads, and multi-agent sessions.

Who this is for

Teams that build, distribute, or run Agent Skills across multiple surfaces and need to know a bundle is the version they trust and hasn't silently drifted.

What problem it solves

Agent Skills move across local folders, registries, and platform uploads with no portable way to verify version, integrity, or drift. Skill Provenance makes a bundle's identity and integrity travel with it.

Canonical URL

https://skillprovenance.dev/

Before                              After
------                              -----
SKILL_v4.md                         SKILL.md          (version lives inside)
SKILL_v5.md                         MANIFEST.yaml     (what's in the bundle)
evals_old.json                      CHANGELOG.md      (what changed and why)
evals.json
"which one is current?"             "bundle is at 4.8.0, evals are stale"

Agent Skills move between sessions, surfaces, and platforms. Every boundary crossing is a chance for version confusion, silent drift, or modified bundle contents that no one can verify. Skill Provenance keeps version identity, staleness detection, and hash-based integrity verification inside the bundle so it survives every transition.

For authors: Know what version you're working on, what's stale, and what changed — across Chat, Code, Cowork, API, and non-Claude platforms.

For teams: Know which copy is current when the same skill is installed in five places across three platforms.

For trust: Verify that a downloaded or shared bundle matches its recorded state before installing it. SHA-256 hashes in the manifest catch tampering and accidental drift alike.

Why this still exists

Most ecosystem tools track source, registry, install, or deployment state. Skill Provenance tracks the actual multi-file bundle an agent is editing. That matters when SKILL.md, evals, scripts, packages, and deployed copies can drift independently.

It is the author-side layer that complements package managers, registries, and platform APIs:

Approach	Tracks versions	Detects staleness	Cross-session	Cross-platform	Integrity
GitHub gh skill	Source/ref/tree	No	Repo-bound	Partial	Source pinning
ClawHub / registries	Registry versions	No	Consumer package	Partial	Install trust
Claude Skills API (/v1/skills)	Platform versions	No	Single surface	No	Deployment record
Filename suffixes (_v5)	Poorly	No	No	No	No
Skillman	Pins versions	No	Consumer-side only	No	No
Skill Provenance	Yes (semver)	Yes	Yes (manifest travels)	Yes	Yes (SHA-256)

Quick install

Before installing from a public source, use the GuideCheck assistant guide to verify the bundle fetch and manifest integrity: https://skillprovenance.dev/.well-known/assistant-guide.txt. The guide is a bounded, human-verifiable instruction surface; it checks the bundle before install, but does not install anything for you.

Claude Code (Plugin):

/plugin marketplace add snapsynapse/skill-provenance
/plugin install skill-provenance@snapsynapse-skill-provenance

After install, five commands are available:

• /skill-provenance:open — verify bundle integrity at session start
• /skill-provenance:validate — run the hash/inventory check only
• /skill-provenance:close — update versions, hashes, changelog when done
• /skill-provenance:handoff — generate a handoff note for the next session
• /skill-provenance:bootstrap — add version tracking to an unversioned bundle