[Mate] Add skills:install to install extension skills for coding agents#2213
[Mate] Add skills:install to install extension skills for coding agents#2213wachterjohannes wants to merge 4 commits into
Conversation
01dd62a to
9e94597
Compare
|
What about using https://packagist.org/packages/guikingone/agent-skills as the retrieval layer for skills? Already implement the specifications and allows to add new loader if needed 🤔 This could also trigger discussion about #1718 |
|
Thanks @Guikingone — looked at both
The only real overlap is the thin "parse |
9e94597 to
ab85481
Compare
1ad2eb4 to
101b0cf
Compare
|
@kbond i have striped down the scope of this PR i have a few ideas for further PRs but that is not important for the first tests here. @chr-hertel you can review but i would wait for @kbond to test this feature with maker skills |
e955345 to
2e1aa1f
Compare
a0a50fb to
6639533
Compare
Agent Skills (SKILL.md) shipped by Mate extensions are now installed onto the filesystem where coding agents read them, as a polyfill until skills can be served over MCP directly. Extensions declare a skills directory via the new extra.ai-mate.skills key. The skills:install command installs them into .agents/skills (read by Codex, OpenCode and Copilot) and symlinks them into .claude/skills for Claude Code. Skills are copied by default (editable in the project) or symlinked to the vendor package with --mode=symlink. discover runs the install automatically, so skills appear after composer require with no extra step. Individual skills can be disabled with --skip, persisted in mate/skills.php. Ships a built-in system-information skill on the Mate package itself.
Follow-up hardening for the unreleased skills:install feature: - Security: reject a skill whose directory is a symlink or whose tree contains any symlink. Since a skill directory is symlinked wholesale into .agents/skills and .claude/skills, a nested symlink (e.g. a "secrets" entry pointing at ~/.ssh) would otherwise be followed by the coding agent, letting a malicious package surface out-of-tree files. - Prune Mate-managed mate-* skill links that are no longer discovered (extension or its skills removed) instead of leaving dangling links; only symlinks are removed, real user files/dirs are never touched. - Self-heal a dangling or incorrect source-of-truth link, symmetric with the existing mirror repair. Adds regression tests covering symlink rejection, stale-link pruning, user-owned mirror entries, relative link targets, dangling-link repair and the duplicate-name warning.
- discover now installs root-project (_custom) skills even when no Composer extensions are present, matching the standalone skills:install command instead of silently skipping them. - Add the required skills key to ExtensionData test fixtures (fixes PHPStan) and replace a tautological array-vs-count assertion. - Add discovery coverage for package skills traversal/absolute-path rejection and root-project skills extraction.
6639533 to
49b5a1d
Compare
|
@wachterjohannes Ok, I finally got around to testing this. I used zenstruck/foundry as an example package to add skills. Here's the branch. It worked as expected but I had to run I love the simplicity of this! Let's discuss how to move forward! |
|
@kbond thanks for the feedback - this first version is indeed a very simple version that just proves that it works and make sense. As discussed in slack one-by-one i think your developer setup with the link binary do not trigger the composer plugin and thats the reason why it does not run discover automatically. The next steps should be following:
|
Agent Skills (
SKILL.md) shipped by Mate extensions are now installed onto thefilesystem where coding agents read them — a polyfill until skills can be served
over MCP directly.
Background — MCP Skills (SEP-2640)
This is the consumer/polyfill side of the MCP Skills effort:
skill://resources — SEP-2640: Skills Extension modelcontextprotocol/modelcontextprotocol#2640.the extension (agentskills.io + SEP-2640 layout) — [Mate] Add Symfony bridge skills anticipating the MCP Skills extension #2132.
SDK (
skill://resources + discovery index).The missing piece is getting those skills onto the filesystem: Claude Code and
other agents do not consume MCP-served skills yet (June 2026) — they only read
skills from disk. This PR bridges that gap and can be retired once agents consume
MCP-served skills end-to-end.
How it works
Extensions declare one or more skills directories via a new
extra.ai-mate.skillskey:{ "extra": { "ai-mate": { "scan-dirs": ["src"], "skills": ["skills"] } } }Each immediate subdirectory holding a
SKILL.mdis one skill. Mate symlinks each one— under a
mate-prefixed directory name (e.g.mate-system-information) to avoidclashing with skills you maintain from other sources — into
.agents/skills/(read byCodex, OpenCode and GitHub Copilot) and mirrors it into
.claude/skills/for Claude Code,which only reads its own directory. The links point into the gitignored
vendor/, soskills auto-update on
composer update.Usage
Skills install automatically as part of
discover, which already runs aftercomposer require, so there's usually nothing to run:For an explicit re-sync:
The core package ships a built-in
system-informationskill to demonstrate theformat and dogfood the mechanism.
Notes
docs/components/mate.rstanddocs/components/mate/creating-extensions.rst;CHANGELOG.mdupdated.discoverauto-sync);PHPStan clean.