Install skills. Then gate them in CI. A keyless lifecycle gate, measured.

Installing agent skills takes one command. Proving that the install is pinned, that the frontmatter parses, and that a PR diff still maps to the headings the skill claims to enforce takes a gate, so we built one and measured it. We pinned two skills from addyosmani/agent-skills, compared the install to a committed lock snapshot, and ran the gate over three fixture diffs with no API key (run on October 13, 2026): 6 of 6 report steps passed, 25 checklist rows, 763 ms wall clock. The catch is that the gate says which parts of a review skill apply to a diff and nothing about whether the change is good.

The lab installs the two skills into a throwaway directory, compares the resulting skills-lock.json to a committed fixture, and runs a lifecycle gate that turns a unified diff into a checklist where every row cites a heading and a line number in SKILL.md. There is no LLM review and no invented quality score.

The catch

An unpinned skill pack is a supply chain. A SKILL.md copied into an agent's home directory is a prompt someone else can change under you on the next install, and nothing tells you it moved. Stars measure popularity and pin nothing. So this lab keeps upstream copies out of the committed tree. Only the lock snapshot (fixtures/expected-skills-lock.json) and two lab-owned skills under .claude/skills/ are versioned. If upstream retags, the lock comparison goes red and you bump the fixture deliberately.

There is a second limit. The gate maps diff signals to headings deterministically. It tells you which parts of the review skill apply to this change. Whether the change is good is still the reviewer's job.

What we ran (keyless)

bun install && bun run report

scripts/report.ts runs the real package scripts as subprocesses and writes reports/gate.json plus reports/gate.md. Six steps, in order:

1. bun run check:skills: every folder under .claude/skills/ has a SKILL.md whose frontmatter name matches the folder and whose description stays under 1,024 characters. Result: 2 of 2 OK.
2. bun run smoke:node: Node must be a 24.x release (engines parity with CI). Result: ok on v24.14.1, Bun 1.4.2.
3. verify:lock: the installed skills-lock.json must equal the committed fixture, skill by skill, and each pinned SKILL.md must exist on disk. Result: 2 pins match (code-review-and-quality, test-driven-development), installed via skills@1.7.2 -a claude-code --copy.
4. Steps 4 to 6 are bun run gate -- --skill <pinned review skill> --diff fixtures/diffs/<patch>, once per fixture. The report counts - [ ] rows and checks that every row carries a cite: … line N reference.

From reports/gate.json (run on October 13, 2026):

The zero in the middle is deliberate. The review skill has nothing to say about a README change, so the gate refuses to invent work. The dependency bump cites Dependency Discipline and Verification; the feature-without-tests patch lights up all five review axes plus the verification block. Every row points at a heading and a line number.

Why this matters

The chain is upstream skills, then pin and copy, then the frontmatter gate, then CI. The diagram above zooms in on the gate because the other three steps already exist wherever agent skills are used: someone installs, someone copies, CI runs. What is usually missing is the step that proves the copy is the one you reviewed and that the skill still applies to the diff in front of you.

The gate is cheap enough to run on every PR. Three fixture diffs took 185 ms and the whole report finished under a second. The report spawns the same commands CI runs, records exit codes per step, and keeps writing when a step goes red.

The repo metadata comes from gh api repos/addyosmani/agent-skills on October 13, 2026: JavaScript, MIT, 106,021 stars. We froze it at fetch time and do not treat it as a quality claim.

The upstream pack

agent-skills is pinned via skills@1.7.2, SKILL.md only. The copy step skips references/, so the gate reads headings from SKILL.md alone.

Two local skills ship with the lab, only under .claude/skills/: addy-skills-install-verify (throwaway install, lock snapshot, layout check) and lifecycle-gate-run (SKILL.md plus a diff in, cited checklist out).

Minilab (open source)

export MINILAB_UPSTREAM_WORKDIR="$PWD/.throwaway-skills"
bash scripts/install-upstream-skills.sh
bun run report

Then read reports/gate.md. If the lock comparison goes red, upstream moved; read the diff before you bump the fixture.

bun install && bun run report