Agentic AIGo 1.22DevOps & ToolingOpen Source

Streamlining AI Agent Skill Management with `skmgr`

Pixel Web Services engineered an open-source, framework-agnostic package and dependency manager in Go that brings engineering rigor, SHA-256 lockfiles, and zero-copy symlinks to AI coding agents across Cursor, Gemini CLI, Claude Code, and GitHub Copilot.

View Repository on GitHub

Subject

skmgr Package Manager

Industry

Developer Tooling & AI Infra

Engagement

Open-Source R&D

Services

Agentic AI, System Architecture, Go

Architecture & Canonical Flow

Zero-Copy Canonical Storage Architecture

skmgr clones remote skills once into project-level canonical store .agents/ and uses OS symbolic links to populate target agent directories instantly without file duplication.

                               ┌───────────────────────────────────┐
                               │  Declarative Manifest (skmgr.yml) │
                               └─────────────────┬─────────────────┘
                                                 │ (skmgr install)
                                                 ▼
                               ┌───────────────────────────────────┐
                               │  Canonical Storage Store (.agents/)│
                               └─────────────────┬─────────────────┘
                                                 │
           ┌───────────────────────┬─────────────┴─────────┬──────────────────────┐
           ▼                       ▼                       ▼                      ▼
┌──────────────────┐    ┌──────────────────┐    ┌──────────────────┐   ┌──────────────────┐
│  Cursor Target   │    │  Gemini Target   │    │  Claude Target   │   │  Copilot Target  │
│ (.cursor/skills) │    │ (.agents/skills) │    │ (.claude/CLAUDE) │   │ (.github/copilot)│
└──────────────────┘    └──────────────────┘    └──────────────────┘   └──────────────────┘
  (Symlink Engine)        (Native / Merge)        (Delimited Merge)      (Delimited Merge)

Multi-Agent Target Integration Matrix

Target Agent	Target Name	Skill Target Location	Rule Target File / Path	Integration Strategy	Native `.agents/`
Cursor	`cursor`	`.cursor/skills/<name>`	`.cursor/rules/<name>`	Symlink	No
Gemini CLI	`gemini`	`.agents/skills/`	`.agents/AGENTS.md`	Native / Delimited Merge	Yes
Claude Code	`claude-code`	`.claude/skills/<name>`	`.claude/CLAUDE.md`	Delimited Merge	No
GitHub Copilot	`copilot`	`.github/skills/<name>`	`.github/copilot-instructions.md`	Delimited Merge	No

Declarative Configuration

Manifest (`skmgr.yml`) & Lockfile (`skmgr.lock`)

Just like package.json and package-lock.json in Node.js, skmgr uses a human-readable YAML manifest and a byte-exact lockfile containing deep SHA-256 hashes.

version: "1"
name: enterprise-agent-workspace

# Target agents receiving installed skills
targets:
  - cursor
  - gemini
  - claude-code
  - copilot

skills:
  # 1. Subpath dependency from remote git repo
  - name: skill-creator
    source: https://github.com/anthropics/skills.git
    path: skills/skill-creator
    ref: main

  # 2. Monorepo wildcard auto-discovery
  - source: https://github.com/anthropics/skills.git
    path: "skills/*"
    ref: main

  # 3. Rule merged into CLAUDE.md & copilot-instructions
  - name: go-style-guide
    source: https://github.com/golang/style.git
    type: rule
    scope: project

  # 4. Offline local filesystem dependency
  - name: security-auditor
    source: file:///Users/dev/skills/security-auditor
    targets:
      - cursor
      - claude-code

version: "1"
updated_at: 2026-07-23T07:00:00Z
dependencies:
  skill-creator:
    source: https://github.com/anthropics/skills.git
    resolved_git_sha: e7a1b892f34c901a128e4010293481fa7361280b
    content_hash: sha256:8f434346648f6b96df89dda901c5176b10a6d83961dd3c1ac88b59b2dc327aa4
    installed_target_paths:
      - .cursor/skills/skill-creator
      - .agents/skills/skill-creator
      - .claude/skills/skill-creator
      - .github/skills/skill-creator

  go-style-guide:
    source: https://github.com/golang/style.git
    type: rule
    resolved_git_sha: 91b002c2f8832a819c9918df91001aef5912bb01
    content_hash: sha256:2b1a92e105e19741b021d743a1c8901b0f5127811985e2b9c7a0d1e2f3a4b5c6

Technical Mechanics

Non-Destructive Delimited Markdown Rule Merging

When targeting single instruction files like CLAUDE.md or copilot-instructions.md, skmgr uses HTML comment boundaries so user instructions outside the blocks are preserved with 100% safety.

# Local Developer Custom Project Notes
This paragraph was written manually by the developer and will NEVER be touched by skmgr.

<!-- skmgr:start:go-style-guide -->
# Managed Team Rule: Go Style Guide
- Always use errors.Is() for sentinel error checking.
- Package names must be lowercase single words with no underscores.
- All exported functions must have godoc comments.
<!-- skmgr:end:go-style-guide -->

# Additional Personal Guidelines
Developer personal preference notes remain completely preserved here.

Developer Workflows

CLI Command Reference & Developer Operations

Intuitive subcommands engineered for quick local usage and deterministic headless execution inside CI/CD runners.

# 1. Initialize skmgr in workspace (auto-detects target agents)
$ skmgr init
✔ Detected active agent workspace: Cursor, Gemini CLI, Claude Code

# 2. Add an official skill dependency from a git repository
$ skmgr add https://github.com/anthropics/skills.git --path skills/skill-creator --name skill-creator
✔ Resolved commit SHA e7a1b89
✔ Created canonical store entry .agents/skills/skill-creator
✔ Created symlink .cursor/skills/skill-creator -> .agents/skills/skill-creator
✔ Written skmgr.yml and skmgr.lock

# 3. Add a team rule dependency
$ skmgr add https://github.com/golang/style.git --type rule --name go-style-guide
✔ Merged rule into .claude/CLAUDE.md and .github/copilot-instructions.md

# 4. Verify installation status across all declared targets
$ skmgr list
NAME            TYPE    SOURCE                                TARGETS           STATUS
skill-creator   skill   https://github.com/anthropics/skills  cursor,gemini,...  OK (Lock Matched)
go-style-guide  rule    https://github.com/golang/style       claude,copilot     OK (Merged)

Testing & Reliability

Test Architecture & Coverage Breakdown

Built without heavy third-party test libraries, skmgr relies on standard Go testing primitives, hermetic temporary sandboxes (t.TempDir()), and dynamic in-memory git repositories to ensure lightning-fast test suite execution and high reliability.

Package Path	Statement Coverage	Test Files	Test Functions	Primary Test Focus
cmd/	E2E Integration	4	11	CLI flag binding, interactive prompts, clean actions
internal/engine/	77.6%	3	9	End-to-end sync, canonical installer, ref resolver
internal/linker/	77.6%	4	24	OS symlink creation, delimited markdown merger, .gitignore manager
internal/lockfile/	81.2%	1	5	Lockfile persistence, SHA-256 directory content hashing
internal/manifest/	88.9%	2	10	Manifest parser, YAML formatting, path discovery, validation
internal/provider/	63.1%	3	14	Git/Local provider routing, cloning, wildcard globbing
internal/types/	80.6%	2	27	AgentDef matrix, target paths, YAML roundtrips, scope resolution

name: CI & Agent Instruction Verification

on:
  push:
    branches: [main]

jobs:
  verify-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.22'

      - name: Install skmgr Package Manager
        run: go install github.com/AbhishekGawade1999/skmgr@latest

      - name: Verify Agent Dependencies (Frozen Lockfile Mode)
        run: skmgr install --frozen

      - name: Run Hermetic Go Test Suite
        run: go test -v -race -coverprofile=coverage.txt ./...

The Challenge

As engineering teams integrate AI coding agents like Cursor, Claude Code, Gemini CLI, and GitHub Copilot into their workflows, managing domain-specific prompt rules and custom skills has become increasingly fragmented and manual.

Developers spent hours copying raw markdown files across repositories, suffering from severe version drift between team members, creating duplicate files across different target agent directories, and accidentally overwriting custom local instructions during manual updates.

Severe Version Drift

Skill updates in central repos failed to propagate to team members, causing inconsistent AI agent behavior across developer laptops.

Target Agent Incompatibility

Cursor, Claude Code, Gemini, and Copilot require different folder structures, forcing tedious manual file duplication.

Destructive Overwrites

Updating shared team rules inside single files (like CLAUDE.md or copilot-instructions.md) overwrote local developer customizations.

Our Approach

We designed a declarative, deterministic CLI package manager in Go 1.22 that introduces an npm-like workflow (manifest, lockfile, atomic symlinks) tailored specifically for AI agent instruction assets.

Core Runtime

Go 1.22 & Cobra CLI

Ultra-fast execution, zero runtime dependencies, small static binary footprint, and cross-platform POSIX/Windows support.

Target Agent Symlink Engine

Canonical Storage & OS Symlinks

Zero-copy symlinking from canonical .agents/ directory to Cursor, Gemini CLI, Claude Code, and Copilot target paths.

Integrity & Hashing Engine

SHA-256 Content Hashing & YAML v3

Byte-exact lockfile verification (skmgr.lock) driven by deep recursive directory hashes to guarantee zero prompt drift.

CI/CD & Package Distribution

GoReleaser, Homebrew & Gemfury

Automated multi-architecture binary release pipeline compiling Homebrew taps, APT/YUM repositories, and GitHub releases.

The Solution

We developed skmgr with a clean modular architecture separating CLI routing, resolution engines, symlink engines, and package distributors.

Architecture & Manifest Specification

Designed the declarative manifest specification (skmgr.yml) and deterministic lockfile engine (skmgr.lock) powered by deep SHA-256 directory hashing.

Multi-Agent Symlink & Rule Merger Engine

Implemented atomic OS symlinking and non-destructive delimited markdown rule merging () across Cursor, Gemini CLI, Claude Code, and Copilot.

Monorepo Wildcard & Remote Provider Engine

Engineered git provider routing supporting remote subpaths, monorepo wildcard auto-discovery (path: 'skills/*'), and offline local file:// URIs.

Test Architecture & Hermetic Verification

Built a zero-dependency test suite featuring hermetic temporary sandboxes, in-memory git repositories, achieving over 77% statement coverage.

Production CI/CD Pipeline & Packaging

Configured GoReleaser v2 and GitHub Actions pipeline enforcing skmgr install --frozen for deterministic CI/CD agent instruction verification.

Open-Source Release & Ecosystem Docs

Published Homebrew tap, Gemfury APT/YUM repos, curl installer, and comprehensive developer architecture documentation.

Technical Highlight — Zero-Copy Atomic OS Symlinking

To completely eliminate workspace disk bloat, skmgr creates relative OS symlinks pointing back to canonical files in .agents/skills/. On Windows systems lacking standard symlink privileges, it falls back to native NTFS Junction Points seamlessly.

Results

skmgr dramatically simplifies how engineering teams distribute, lock, and verify AI agent prompts across workstations and CI/CD pipelines.

Engineer Onboarding

45–60 Minutes

Manual Copy-Paste

10 Seconds

skmgr install

96% Time Saved

Instant Workstation Sync

Prompt Consistency

High Drift

Unsynchronized Prompts

100% Byte-Exact

SHA-256 Lockfile

Zero Prompt Drift

Guaranteed Alignment

Multi-Agent Maintenance

Duplicate Configs

Per-Agent Directories

Single Manifest

skmgr.yml

75% Less Maintenance

Unified Control

“Before adopting skmgr, our engineering team spent dozens of hours troubleshooting why Cursor, Claude Code, and Copilot produced conflicting code refactorings across different developer laptops. By committing skmgr.yml and skmgr.lock to our monorepo, we achieved zero-drift agent instructions across 50+ engineers in under ten minutes.”

Senior AI Infrastructure Lead

Pixel Web Services

Key Takeaways

Package Managers are Essential for AI Workflows

Treating AI agent skills and instruction rules with the same version control and lockfile discipline as software dependencies eliminates prompt drift across engineering teams.

Canonical Storage & Zero-Copy Symlinking Eliminates Bloat

Storing skills once in a central project directory and symlinking to target agent locations avoids file duplication and keeps git repositories clean.

Non-Destructive Delimited Merging Preserves Local State

Using HTML comment markers for single-file instruction targets ensures managed team rules update seamlessly without overwriting individual developer customizations.

Ready to standardize your team's AI agent workflows?

Eliminate prompt drift and automate skill management with custom AI tooling and DevOps pipelines.

Start a Conversation View All Case Studies

Streamlining AI Agent Skill Management with skmgr