GitHub Introduces a Package Manager for Prompts, Supply Chain Headaches Included

Your dependency tree wasn't complicated enough, apparently. GitHub has introduced a package manager for AI agent prompts, baked directly into the GitHub CLI. The new gh skill command, available in v2.90.0 and up, lets you discover, install, and manage "skills" for various AI assistants directly from Git repositories. It's npm for prompt engineering, with all the same baggage.

The feature, announced in a changelog post on April 16, 2026, is currently in public preview. It's built on an open Agent Skills specification and supports a surprisingly broad range of hosts: GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI, and something called Antigravity.

Installation mimics package managers we use daily:

# Discover and install skills from a repo
gh skill install github/awesome-copilot

# Install a specific skill at a specific version
gh skill install github/awesome-copilot/documentation-writer@v1.2.0

# Install for a different agent host
gh skill install OWNER/REPO/SKILL_NAME --agent claude-code

The system offers some supply chain hygiene features. You can pin skills to a specific tag or even a commit SHA for reproducibility. The announcement correctly identifies the core problem: "A skill that changes silently between installs is a supply chain risk." The mechanism rests on git's content-addressing plus support for immutable releases via tag protection.

Then the documentation drops the line that resets every assumption above: "Skills are not verified by GitHub and should be installed at your own discretion." They've built a distribution mechanism for executable instructions, because that is what a complex prompt now is, and formally adopted a hands-off security policy. The same docs warn that skills "may contain prompt injections, hidden instructions, or malicious scripts" and recommend running gh skill preview to inspect the content before you install.

The responsibility for vetting every skill now falls squarely on the developer. GitHub provides the tools for security - code scanning in the source repo, version pinning - but no trust infrastructure. No central registry. No vetting process. No automated malware scanning on the "package" itself. Just a recommendation to be careful.

Other ecosystems have run this experiment. The results were not great.

Full disclosure: I work on a related problem in PromptScript. The author of a base .prs skill can mark fields as sealed, and the compiler raises a hard error the moment an imported overlay tries to overwrite them. A malicious skill cannot silently swap out a sealed content field on your local skill, because the project simply will not compile. I will cover it in a separate article.

The feature is in public preview, so the security posture may still shift. As shipped, you bring your own auditor and your own boombox. GitHub waves from the lawn. (Say Anything, 1989)