Governance Begins Before Publication
The CLI and MCP server can protect a user's local destination, but they cannot decide whether a skill deserved to be distributed in the first place. For Tech Leads Club's Agent Skills repository, governance begins earlier: authors must provide a routable package, the catalog must be generated consistently, changed content can enter a security scan, exceptions must remain reviewable, and humans need enough provenance to inspect what they are about to install. These gates catch different failures, so a passing structural check or a matching hash should not be mistaken for a complete endorsement.
Authoring gates make a skill's interface visible
The repository's validator treats a skill as a document with an interface. It checks that the folder exists and follows the expected naming form, that the main file has the exact casing, and that its frontmatter is valid YAML. It looks for a name and description, checks naming and reserved terms, and examines whether the description contains routing guidance and negative scope. It also checks optional author/version metadata, body shape, examples, error handling, and whether supporting reference files are mentioned by the main instructions.
These checks matter because the runtime system depends on properties that are easy for an author to overlook. A missing or malformed description weakens discovery. A missing negative scope makes neighboring skills harder to distinguish. An unlinked reference may exist on disk but remain invisible to an agent that only follows the main instructions. A skill whose name does not fit the catalog's conventions creates friction between what a human calls it and what the registry can safely address.
The validator does not treat every result the same way. Some conditions are hard errors; others are warnings that identify a quality concern without blocking the batch. That distinction is useful when interpreted correctly. A hard failure means the package does not meet a structural condition the rest of the system relies on. A warning means the package may be usable but deserves attention, such as a missing example or an oversized main body. A green validation result therefore means that the structural gate passed, not that the recommendations are technically correct, current, or safe in every context.
The generator is a separate control point. It turns names, descriptions, categories, file lists, and hashes into the registry that runtime tools consume. The validator asks whether the source package has a usable interface; the generator publishes the machine-readable identity of that package. Keeping those responsibilities separate makes the lifecycle easier to inspect. One can pass while the other still needs to be run, and neither replaces a substantive review of the advice.
The authoring examples show what these gates are trying to preserve. A planning skill states when its phases apply and when they do not. A security skill distinguishes secure-coding guidance from general debugging and tells the agent to inspect relevant references.