Motivation
The recent surge in alirezarezvani/claude-skills (20k+ stars) highlights a critical shift in the Agent ecosystem: we are moving from single-skill usage to composite, multi-skill agent workflows. However, as claude-skills demonstrates, simply aggregating hundreds of skills creates a "dependency hell" for enterprise governance. When an Agent invokes Skill A (which depends on Tool X) and Skill B (which also depends on Tool X but requires a different version or permission scope), current registries lack the mechanism to resolve these conflicts or detect circular dependencies.
In enterprise settings (as seen with iflytek/skillhub's focus on RBAC and auditing), unmanaged skill dependencies lead to:
- Runtime Failures: Missing transitive dependencies or incompatible tool versions.
- Security Risks: Privilege escalation if a low-privileged skill pulls in a high-privileged dependency.
- Audit Blind Spots: Inability to trace which specific skill versions caused a workflow failure or security event.
Proposed feature
I propose implementing a Skill Dependency Graph and Conflict Detection module within skillhub. This should include:
- Declarative Dependency Manifest: Support a
dependencies.json or requirements.md in skill packages that declares:
- Internal Dependencies: Other skills within
skillhub (e.g., auth-skill requires logging-skill).
- External Tool Constraints: Required tool versions or API scopes (e.g.,
requires: ["github_api", "version>=2.0"]).
- Dependency Resolution Engine: A backend service that resolves the dependency graph upon
publish or install:
- Detect circular dependencies (A->B->A).
- Detect version conflicts (Skill A needs
lib@1.0, Skill B needs lib@2.0).
- Suggest a compatible set of skills for a given Agent workflow.
- Conflict Warning UI: In the
skillhub web interface, when a user attempts to publish a skill, show a warning if it conflicts with existing global or namespace-level skills. For installers, show a "Resolved Dependency List" before installation.
- Audit Trail Integration: Log dependency resolution decisions in the audit log (e.g., "Resolved conflict: downgraded
http-client from 2.1 to 1.5 for compatibility with web-scraping").
Why it fits this repo
iflytek/skillhub is already positioned as the centralized governance layer for skills (with RBAC, versioning, and audit logs). Adding dependency resolution completes the governance loop:
- Governance: Ensures only compatible, audited skill combinations are deployed.
- Enterprise Readiness: Matches the needs of large teams managing hundreds of skills (as highlighted by the
claude-skills trend), preventing "it works on my machine" issues in shared agent environments.
- Differentiation: Most skill registries (like
clawhub) are simple package managers; skillhub can become the smart registry that ensures semantic compatibility.
References
Motivation
The recent surge in
alirezarezvani/claude-skills(20k+ stars) highlights a critical shift in the Agent ecosystem: we are moving from single-skill usage to composite, multi-skill agent workflows. However, asclaude-skillsdemonstrates, simply aggregating hundreds of skills creates a "dependency hell" for enterprise governance. When an Agent invokes Skill A (which depends on Tool X) and Skill B (which also depends on Tool X but requires a different version or permission scope), current registries lack the mechanism to resolve these conflicts or detect circular dependencies.In enterprise settings (as seen with
iflytek/skillhub's focus on RBAC and auditing), unmanaged skill dependencies lead to:Proposed feature
I propose implementing a Skill Dependency Graph and Conflict Detection module within
skillhub. This should include:dependencies.jsonorrequirements.mdin skill packages that declares:skillhub(e.g.,auth-skillrequireslogging-skill).requires: ["github_api", "version>=2.0"]).publishorinstall:lib@1.0, Skill B needslib@2.0).skillhubweb interface, when a user attempts to publish a skill, show a warning if it conflicts with existing global or namespace-level skills. For installers, show a "Resolved Dependency List" before installation.http-clientfrom 2.1 to 1.5 for compatibility withweb-scraping").Why it fits this repo
iflytek/skillhubis already positioned as the centralized governance layer for skills (with RBAC, versioning, and audit logs). Adding dependency resolution completes the governance loop:claude-skillstrend), preventing "it works on my machine" issues in shared agent environments.clawhub) are simple package managers;skillhubcan become the smart registry that ensures semantic compatibility.References