Google's official repository of Agent Skills climbed GitHub's trending list on Friday, adding 449 stars in 24 hours, and its contents say more about where developer documentation is heading than any launch post could.

The repo, google/skills, is a collection of SKILL.md packages — folders of instructions, scripts and reference material that a coding agent loads when a task matches. One command installs them: `npx skills add google/skills`, which then asks which skills, which target agents, and whether the install is project-local or global. Everything is Apache 2.0.

What is inside is not marketing copy. Beside "Getting started with Google Cloud" sit troubleshooting skills for specific failure modes: GKE nodes stuck in NodeNotReady, TPU slices blocked by an unstable MIG, BigQuery query optimisation, an upgrader that walks Cloud Armor's OWASP rules from CRS 3.0/3.3 to 4.22, an IAM policy simulator, SecOps triage and threat-hunting workflows, Google Ads API diagnostics, a guide for migrating legacy codebases to Safe Rust. Separate Google repositories cover Android, Flutter, Dart, Firestore and Maps.

This is the operational knowledge that used to live in support tickets, runbooks and the heads of solutions architects. It is now versioned, forkable and machine-readable.

The distribution is the interesting part. The same repository ships as a plugin set for three agent harnesses: Claude Code (`claude plugin marketplace add google/skills`), OpenAI's Codex, and Google's own Antigravity CLI. Google is packaging its platform expertise so that a competitor's coding agent, running in a customer's terminal, reaches for Google Cloud first — with the vendor's own instructions already in context.

That makes skills the new documentation channel, and the ecosystem around them is thickening fast. Anthropic's skills repository is among GitHub's most-starred projects; Cloudflare's security-audit skill passed 30,000 stars after the company open-sourced the harness behind its vulnerability discovery; Matt Pocock's personal skill collection added another 1,111 stars today. The `skills` npm package writes a lockfile recording what was installed and at which version.

Which is exactly why governance is arriving in the same week. StepSecurity began inventorying agent skills inside repositories and on developer machines, covering 18 coding agents and the skills.sh lockfile. A self-hosted registry, iflytek/skillhub, appeared within a day. And Google Cloud's own release notes added skill security scanning and governance to Agent Registry two days ago, so standalone skill revisions can be scanned for issues before anyone approves them.

That last item is the tell. Google is simultaneously the largest publisher of skills and a vendor selling the scanner that inspects them — which is a reasonable position only if you believe skills are artifacts, not documentation.

The caveat is the obvious one. A skill is text an agent trusts. It can be a year out of date, subtly wrong, or hostile, and its authority comes from having been installed rather than read. Vendor skills are also a lock-in mechanism dressed as convenience: a skill that knows GKE's failure modes knows nothing about EKS, and the model that follows it will not go looking.

The docs now run. The question is who reads them before the agent does.

Sources