Today's GitHub Trending tells a clear story about how AI agent capabilities are evolving.
cloudflare/security-audit-skill packages multi-phase security audits into a coding-agent skill with 「independently verified, machine-readable findings.」 It's not a prompt. It's not a plugin. It's a skill — versioned, distributable, verifiable.
addyosmani/agent-skills takes it further: 「Production-grade engineering skills for AI coding agents.」 Nearly 100K stars. The community has spoken: skills are the unit of agent capability.
yynxxxxx/Codex-X adds another piece: visual management of Skills/MCP across desktop and CLI, with TOML config visualization and provider switching.
The Gap Nobody's Talking About
Skills are becoming packages. But packages need registries — not just collections.
Here's what happens when an enterprise starts using agent skills:
- Version chaos: Someone updates a skill from v1 to v2. Who did it? When? Can you roll back?
- Permission gaps: An intern runs a security audit skill that accesses production code. Was that authorized?
- Audit blindness: Compliance asks for a log of every skill invocation last month. Where is it?
- Discovery friction: Five teams wrote their own OCR skill. Nobody knows the others exist.
cloudflare/security-audit-skill gives you the skill. addyosmani/agent-skills gives you a collection. But who gives you the registry?
Enter skillhub
iflytek/skillhub is a self-hosted, open-source agent skill registry designed to fill this exact gap:
- Skill package publish & version management: Register skills, version them, roll back when needed.
- RBAC permissions: Control who can publish, who can call, who can modify.
- Audit logs: Every skill invocation is traceable. Compliance-ready.
Think of it as npm for agent skills — but self-hosted, with enterprise-grade permissions and audit trails.
Pair It With Official Skills
iflytek/iFly-Skills provides iFLYTEK's official skill collection: speech recognition, OCR, translation, proofreading, and multimodal capabilities. These are production-ready skills that can be registered directly into skillhub for unified management.
The flow:
- Register iFly-Skills (or cloudflare/security-audit-skill, or your custom skills) into skillhub
- Assign RBAC permissions per team per skill
- Every invocation is logged for audit
- Version updates are tracked and rollbackable
The Takeaway
The community has decided: skills are the distribution unit for agent capabilities. The next question isn't 「how to write a skill」 — it's 「how to govern skills at scale.」
That's what skillhub is for.
- skillhub: https://github.com/iflytek/skillhub
- iFly-Skills: https://github.com/iflytek/iFly-Skills
