Bundled upstream skills: reviewable updates and clear redistribution terms #581

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Evidence

At main on 2026-10-17 the marketplace bundles 31 skills. 16 of them come from 11 third-party repositories: github/awesome-copilot, mattpocock/skills, fluxcd/agent-skills, vercel-labs/skills, vercel-labs/agent-skills, obra/superpowers, github/gh-stack, astrolicious/agent-skills, anthropics/skills, Jeffallan/claude-skills and xixu-me/skills.

• Each third-party skill is pinned only by github-tree-sha. None of these upstreams publishes releases for the skill, so "what changed" is a range of upstream commits.
• The shared updater moved third-party skills in chore(deps): update agent skills #162, chore(deps): update agent skills #185, chore(deps): update agent skills #189, chore(deps): update agent skills #220, chore(deps): update agent skills (plugins/github/skills/gh-stack) #376, chore(deps): update agent skills (plugins/go/skills/golang-pro) #444 and chore(deps): update agent skills (plugins/github/skills/github-issues) #568 since 2026-08-17. Its PR body says only that the skill moved "to its latest version" (chore(deps): update agent skills (plugins/github/skills/github-issues) #568).
• Since feat(agentic-engineering): read each dependency update as a release range #572 (2026-10-16), every dependency update must be read as a release range before it is merged, and bundled skill prose counts as executable agent instruction, so these PRs need a semantic review.
• 7 of the 16 third-party skills carry no licence record anywhere in the bundle, while the repository root is Apache-2.0.

Audience and problem

Reviewers of updater PRs, and everyone who installs a bundle. Reviewers have to rebuild each upstream range by hand. Users cannot tell under which terms each bundled skill is redistributed.

Hypothesis

If every updater PR states its upstream range, licence and archival state, and every bundled skill carries its licence, a reviewer can complete the release review from the PR alone, and a licence change upstream is caught before it is redistributed.

Success signal and window

Over the next ten updater PRs after the first child merges: each PR states its range, licence and archival state, and its release review is recorded without the reviewer opening the upstream repository by hand. Every bundled third-party skill shows a licence in docs/plugins.md.

Children

• Updater PRs state what changed upstream for each moved skill.
• Record the licence of every redistributed third-party skill.

Notes

#38 is at GitHub's limit of 100 sub-issues, so this theme has its own epic.

Size

Medium.