SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsdym-scientific-agent-skills-pin-va-cap-nhat

dym-scientific-agent-skills-pin-va-cap-nhat

Agents & models

View repository

Updated 10-18 01:22

About this skill

Skill: dym-scientific-agent-skills-pin-va-cap-nhat — Pin version, update, remove

Why use it: a skill is an instruction that the agent follows. A silent update changes agent behavior between two runs — exactly what you don't want in an analysis that needs to be reproducible. This file locks the version and makes upgrading a deliberate action. What it produces: the skill pinned by tag or SHA, and an upgrade process that previews the diff before applying.

Traceability metadata that the installer inserts into

gh skill install inserts provenance into the frontmatter of the installed version. This is the real frontmatter of depmap after installation (compared with the version in the repo, the part metadata has 3 keys added github-*):

---
description: Query the Cancer Dependency Map (DepMap) ...
license: CC-BY-4.0
metadata:
    github-path: skills/depmap
    github-ref: refs/tags/v2.66.0
    github-repo: https://github.com/K-Dense-AI/scientific-agent-skills
    github-tree-sha: 9c13e51a32b3a91510f2d7f6e1e5bf9c6e6f373a
    skill-author: Kuan-lin Huang
    version: "1.0"
name: depmap
---

Two different versions, don't confuse them:

  • metadata.version — the skill's own version (for example "1.0"), which the author bumps according to the repo's rules.
  • github-ref / github-tree-sha — the collection version, the one that gh skill update uses to detect changes.

Quick check of which version is installed:

grep -A6 'metadata:' .claude/skills/*/SKILL.md | grep -E 'github-ref|version|^\S+SKILL'

Pin version

# ghim theo release tag
gh skill install K-Dense-AI/scientific-agent-skills depmap --pin v2.66.0

# ghim theo commit SHA
gh skill install K-Dense-AI/scientific-agent-skills depmap --pin 1e5eeffbdad3749125afe7ab48a39694e27f181c

# hoặc dạng @VERSION ngay sau tên skill
gh skill install K-Dense-AI/scientific-agent-skills depmap@v2.66.0

VERSION resolves by git tag or commit SHA. When not pinned, the resolution order is: latest release tag, then the HEAD of the default branch.

With npx skills, the lock file is in skills-lock.json in the project; restore with:

npx -y skills experimental_install

Note skills-lock.json is in .gitignore of the source repo — but in your project you should commit it, that is precisely the reproducibility lock point.

Update

# xem có gì mới, KHÔNG sửa file nào
gh skill update --dry-run

# cập nhật một vài skill (hỏi xác nhận)
gh skill update depmap paper-lookup

# cập nhật tất cả, không hỏi
gh skill update --all

# tải lại kể cả khi đã mới nhất (ghi đè sửa đổi cục bộ)
gh skill update --force

# bỏ ghim rồi mới cập nhật
gh skill update --unpin depmap

Behavior read from gh skill update --help:

  • It compares the local tree SHA (taken from the frontmatter) with the remote — not comparing dates.
  • It automatically scans every host directory (Copilot, Claude, Cursor, Codex, Gemini, Antigravity) in both project and user scope.
  • Pinned skills are skipped with a notice. This is what you want — but it also means "update --all" does not at all mean "everything is up to date".
  • --force overwrites locally modified skill files, but does not delete files you added. The result can be a half-baked mix if you have ever patched a skill.

With npx skills:

npx -y skills update            # tương tác
npx -y skills update -g -y      # chỉ global, không hỏi
npx -y skills update -p -y      # chỉ project

Safe upgrade process (recommended)

# 1. giữ bản đang chạy để đối chiếu
cp -R .claude/skills .claude/skills.bak

# 2. xem cái gì sẽ đổi
gh skill update --dry-run

# 3. áp
gh skill update --all

# 4. đọc diff của chỉ dẫn — đây mới là phần đổi hành vi agent
diff -ru .claude/skills.bak .claude/skills | head -200

Step 4 is the step that often gets skipped. Diffing a SKILL.md is a behavior diff; not reading it makes upgrading a skill like merging unfamiliar code without review.

Remove

# npx skills
npx -y skills remove -s "depmap,paper-lookup" -y
npx -y skills remove --all          # gỡ sạch (đã hàm ý -y)

# cài tay / gh skill: xoá thư mục
rm -rf .claude/skills/depmap
rm -rf .agents/skills/depmap

gh skill has no subcommand remove; deleting the directory is the right way.

Pitfalls

  • Duplicate installation across two scopes. Installing at the project level and then again at the user level for the same skill results in two copies; the host usually picks the project one. Check both ls .claude/skills and ls ~/.claude/skills.
  • .agents/skills shared across many hosts. Removing there removes it for all hosts that point to it.
  • metadata.version of a skill can stay the same while its content has changed — if the author forgot to bump it. Don't use it as a reproducibility anchor; use github-tree-sha.
  • Pinned versions also age from a security standpoint. Pinning also freezes unpatched security findings. Re-read 02 periodically instead of pinning and forgetting.