Skip to content

[Mate] Add skills:install to install extension skills for coding agents#2213

Open
wachterjohannes wants to merge 4 commits into
symfony:mainfrom
wachterjohannes:mate-skills-install
Open

[Mate] Add skills:install to install extension skills for coding agents#2213
wachterjohannes wants to merge 4 commits into
symfony:mainfrom
wachterjohannes:mate-skills-install

Conversation

@wachterjohannes

@wachterjohannes wachterjohannes commented Jun 21, 2026

Copy link
Copy Markdown
Contributor
Q A
Bug fix? no
New feature? yes
Docs? yes
Issues -
License MIT

Agent Skills (SKILL.md) shipped by Mate extensions are now installed onto the
filesystem where coding agents read them — a polyfill until skills can be served
over MCP directly.

Background — MCP Skills (SEP-2640)

This is the consumer/polyfill side of the MCP Skills effort:

The missing piece is getting those skills onto the filesystem: Claude Code and
other agents do not consume MCP-served skills yet (June 2026) — they only read
skills from disk. This PR bridges that gap and can be retired once agents consume
MCP-served skills end-to-end.

How it works

Extensions declare one or more skills directories via a new extra.ai-mate.skills key:

{
    "extra": {
        "ai-mate": {
            "scan-dirs": ["src"],
            "skills": ["skills"]
        }
    }
}

Each immediate subdirectory holding a SKILL.md is one skill. Mate symlinks each one
— under a mate- prefixed directory name (e.g. mate-system-information) to avoid
clashing with skills you maintain from other sources — into .agents/skills/ (read by
Codex, OpenCode and GitHub Copilot) and mirrors it into .claude/skills/ for Claude Code,
which only reads its own directory. The links point into the gitignored vendor/, so
skills auto-update on composer update.

Usage

Skills install automatically as part of discover, which already runs after
composer require, so there's usually nothing to run:

$ vendor/bin/mate discover

For an explicit re-sync:

$ vendor/bin/mate skills:install

The core package ships a built-in system-information skill to demonstrate the
format and dogfood the mechanism.

Notes

  • Documentation added under docs/components/mate.rst and
    docs/components/mate/creating-extensions.rst; CHANGELOG.md updated.
  • Covered by tests (installer, command, discovery, and the discover auto-sync);
    PHPStan clean.

@wachterjohannes wachterjohannes force-pushed the mate-skills-install branch 2 times, most recently from 01dd62a to 9e94597 Compare June 21, 2026 19:28
@Guikingone

Guikingone commented Jun 24, 2026

Copy link
Copy Markdown
Contributor

What about using https://packagist.org/packages/guikingone/agent-skills as the retrieval layer for skills? Already implement the specifications and allows to add new loader if needed 🤔

This could also trigger discussion about #1718

@wachterjohannes

Copy link
Copy Markdown
Contributor Author

Thanks @Guikingone — looked at both agent-skills and #1718. I think we're solving two different layers, so I don't think the package replaces this PR:

  • agent-skills / [Agent] Add support for AgentSkills #1718 load skills into a PHP agent runtime (system-prompt injection, skill-as-tool, eval/grading).
  • This PR goes the other way: it materializes skills onto disk (.agents/skills/ + symlinks into .claude/skills/) so external coding-agent CLIs read them — the polyfill side of SEP-2640 until they consume skill:// directly.

The only real overlap is the thin "parse SKILL.md" slice. That's worth sharing — but I'd rather see a common spec/parse abstraction land first-party in the Agent component via #1718 than have Mate core take a third-party dependency. Happy to align this PR with whatever #1718 settles on.

@wachterjohannes wachterjohannes marked this pull request as ready for review June 25, 2026 19:21
@carsonbot carsonbot added Feature New feature Mate Issues & PRs about the AI Mate component Status: Needs Review labels Jun 25, 2026
@wachterjohannes wachterjohannes force-pushed the mate-skills-install branch 10 times, most recently from 1ad2eb4 to 101b0cf Compare June 25, 2026 20:41
@wachterjohannes

Copy link
Copy Markdown
Contributor Author

@kbond i have striped down the scope of this PR i have a few ideas for further PRs but that is not important for the first tests here.

@chr-hertel you can review but i would wait for @kbond to test this feature with maker skills

Agent Skills (SKILL.md) shipped by Mate extensions are now installed onto
the filesystem where coding agents read them, as a polyfill until skills can
be served over MCP directly.

Extensions declare a skills directory via the new extra.ai-mate.skills key.
The skills:install command installs them into .agents/skills (read by Codex,
OpenCode and Copilot) and symlinks them into .claude/skills for Claude Code.
Skills are copied by default (editable in the project) or symlinked to the
vendor package with --mode=symlink. discover runs the install automatically,
so skills appear after composer require with no extra step. Individual skills
can be disabled with --skip, persisted in mate/skills.php.

Ships a built-in system-information skill on the Mate package itself.
Follow-up hardening for the unreleased skills:install feature:

- Security: reject a skill whose directory is a symlink or whose tree
  contains any symlink. Since a skill directory is symlinked wholesale
  into .agents/skills and .claude/skills, a nested symlink (e.g. a
  "secrets" entry pointing at ~/.ssh) would otherwise be followed by the
  coding agent, letting a malicious package surface out-of-tree files.
- Prune Mate-managed mate-* skill links that are no longer discovered
  (extension or its skills removed) instead of leaving dangling links;
  only symlinks are removed, real user files/dirs are never touched.
- Self-heal a dangling or incorrect source-of-truth link, symmetric with
  the existing mirror repair.

Adds regression tests covering symlink rejection, stale-link pruning,
user-owned mirror entries, relative link targets, dangling-link repair
and the duplicate-name warning.
- discover now installs root-project (_custom) skills even when no
  Composer extensions are present, matching the standalone skills:install
  command instead of silently skipping them.
- Add the required skills key to ExtensionData test fixtures (fixes
  PHPStan) and replace a tautological array-vs-count assertion.
- Add discovery coverage for package skills traversal/absolute-path
  rejection and root-project skills extraction.
@kbond

kbond commented Jul 8, 2026

Copy link
Copy Markdown
Member

@wachterjohannes Ok, I finally got around to testing this.

I used zenstruck/foundry as an example package to add skills. Here's the branch.

It worked as expected but I had to run vendor/bin/mate discover explicitly to sync. I have the plugin installed/enabled. Maybe something to do with my local vendor setup?

I love the simplicity of this! Let's discuss how to move forward!

@wachterjohannes

Copy link
Copy Markdown
Contributor Author

@kbond thanks for the feedback - this first version is indeed a very simple version that just proves that it works and make sense.

As discussed in slack one-by-one i think your developer setup with the link binary do not trigger the composer plugin and thats the reason why it does not run discover automatically.

The next steps should be following:

  1. En/Disable Skills - so that they will not be symlinked or removed from the "blacklist"
  2. Overwrite Skills- that will copy the skill into the directory instead of symlink and not overwrite it in any later on run of skills install
  3. Make the init command more interactive
  • ask for agents (codex, claude, ...) so that the symlinks, wrappers, ... can be build ontop of that information
  • ask for the purpose - mcp or skills or both - so that the developer can decide what he actually needs
  • maybe other questions to individualize that
  1. Some kind of debugging command

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Feature New feature Mate Issues & PRs about the AI Mate component Status: Needs Review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants