Fifty marketing playbooks, installable. We pinned them and ran the validators.

We pinned coreyhaines31/marketingskills at one commit, installed four of its skills into .claude/skills/, and ran the author's own validators with no API keys. The report from 2026-10-13 (run on October 13, 2026) counted 50 upstream skills at the pin, 4 local skills installed, and every gate PASS in 7,868 ms. The catch is that a skills pack is a dependency, and if you copy the files without pinning them nothing tells you when they go stale.

The pack itself is a set of marketing playbooks written as agent skills, one SKILL.md per discipline, with references and evals where the author has them.

The catch

Install once, forget, and the files rot. If you copy fifty SKILL.md files into your repo and the upstream keeps moving, six months later nobody can say which commit you are running, whether the frontmatter still parses, or whether the author's own regression fixtures still pass. A star count does not lock anything.

So the lab treats the pack like any other pinned dependency. The commit is fixed in one place (src/upstream.ts, currently 3b84db2e3dc5a91563cc0c5ab359c5b3f7d3c9cd), the install goes through the skills@1.7.2 CLI with --copy, and skills-lock.json is diffed against a committed fixture so an accidental reinstall cannot silently change what is on disk. The validators run against that SHA only.

What we ran (keyless)

bun install && bun run report

scripts/report.ts is the entry point. It runs four steps with no API keys and writes reports/skills.json plus a human-readable reports/skills.md.

1. install: verifies the curated install. There must be a SKILL.md for each pinned name, skills-lock.json must equal fixtures/expected-skills-lock.json, and there must be no .agents/skills mirror. Set REPORT_INSTALL=1 to re-run bun run install:skills first (that step needs npm and GitHub).
2. frontmatter: every local skill must have name equal to its folder and a description of at most 1,024 characters.
3. validators: bash scripts/upstream-validators.sh clones the pin and runs the author's validate-skills.sh and tests/run-regression.sh. It also gives us the upstream skill count by listing skills/*/SKILL.md in that checkout.
4. smoke: bun run smoke:node, so the Node 24 floor in .nvmrc is exercised.

Headline numbers from reports/skills.json (run on October 13, 2026):

The report records network failures instead of hiding them. If the clone fails, the validators step is written as FAIL with a NETWORK FAILURE prefix and the rest of the report still lands. This run had none.

The title says fifty because that is how many skill folders we counted at the pin. Bump the pin and the number may move, so re-run the report before you reuse it anywhere.

Four local skills, one pack

We do not commit all fifty. The lab installs four specialists that cover the stretch from first draft to conversion:

• copywriting: frameworks and voice for marketing copy
• launch: product and site launch checklists
• ai-seo: citation-oriented content for AI-era search
• cro: conversion work on pages and forms

Each one ships with the upstream references/ and evals/ where the author provides them. To add more, extend scripts/install-marketing-skills.sh with extra --skill flags, refresh the lock fixture, update INSTALLED_SKILL_NAMES, and run the report again. Skills live only under .claude/skills/; the install script removes any .agents/ copy the CLI leaves behind.

Where the validator sits

The diagram above draws the agent as a hub with the four skills around it, and the upstream repo feeding one more node, the validator. The validator is the control point. It pins the commit, re-runs the author's checks, and fails the run when a SKILL.md loses its frontmatter or a regression fixture breaks. Without it, the agent loads files nobody has checked since the day they were installed.

Minilab (open source)

Upstream: coreyhaines31/marketingskills (MIT, 54,501 GitHub stars at fetch time on 2026-10-13). The star count on the video card is GitHub API metadata frozen at fetch time; it is not a quality score.

bun install && bun run report