
Article 5/20 in the AgentKit v3 onboarding series. About a 12 minute read.
This is the longest article in the series, because it holds the part of v3 I am most excited about: your skills are your assets. You write them, edit them, carry them to another machine, share them with your team, and the next kit update does not overwrite them.
But I have to say it straight at the top: a big part of this is still preview 🧪. I marked each section carefully so you know what you can use right now and what to wait for.
1/ Basic skill management ✅
ak skills list
ak skills search "deploy"
ak skills show ak-cook
ak skills install <skill-name>
ak skills remove <skill-name>To see which skill calls which:
ak skills graphLocal skill router ✅
Too many skills, can't remember what each one does? Ask the router:
ak skills route "write a blog post about the new release"The router runs locally, picks one fitting skill, or answers NONE if nothing matches. It would rather say "I don't know" than pick at random.

(The screenshot above was taken in a temporary HOME with no kit installed, so the router returned empty. Correct behavior.)
2/ Create your own skill ✅
The quickest way is to let the agent do it. In Claude Code:
/ak-skill-creator create a skill "write-changelog" that reads the git log since the latest tag and writes a changelog in the team's voiceThis skill creates the full SKILL.md, references/, scripts/ if needed, then checks the structure. It also audits, validates and packages existing skills.
After a working session, to turn the places where the agent went in circles into skill improvements:
/ak-dogfoodak-dogfood only proposes by default (dry-run), and only --apply actually edits. How dogfood writes fixes into your personal kit is covered in guide 20.
3/ --ssot and SkillX: the foundation for personal skills 🧪
Everything in sections 3 through 6 needs you to have turned on the single-source skill store (more in article 1):
ak update --ssot --dry-run
ak update --ssot --yesOnce the global scope has been committed to the store, SkillX switches on automatically. You can also enable it for a single command with AGENTKIT_SKILL_STORE=1 or AGENTKIT_SKILLX=1.
What is SkillX? It is the skill marketplace at skillx.sh, with a skillx-sh CLI (version 0.8.0), hybrid search (vector + full-text) and signed releases.

With ak, you can read and inspect skills on SkillX without running any script:
ak skills resolve @publisher/skill-name
ak skills inspect @publisher/skill-name@1.2.0
ak skills read @publisher/skill-name@1.2.0
ak skills read @publisher/skill-name@1.2.0 references/notes.mdread prints SKILL.md by default, capped at 256 KiB, and only reads non-executable files listed in the signed manifest. The printed content is marked "untrusted", and terminal control characters are neutralized.
inspect and read only read non-executable files, after verifying the signature and digest. Read carefully before installing, like reading the label before taking medicine.
4/ Personal kit: "my own" kit built on the base kit 🧪
The idea: you take the Engineer kit as the base, then overlay your own changes on top. When the base kit ships a new version, you rebase instead of redoing everything from scratch.

ak skills kit init mine --extends engineer@0.2.0 # create a personal kit
ak skills kit status mine # where you are, what has changed
ak skills kit inspect mine # view details
ak skills kit rebase mine --to engineer@0.3.0 --dry-run # trial rebase onto the new base
ak skills kit apply mine # apply to the project
ak skills kit rollback mine # go back to the previous revision
ak skills kit revisions mine # revision historyA few principles I set for it:
Immutable revisions. Every change is a new revision, and old revisions are never overwritten.
Deterministic rebase. Conflicts are recorded explicitly, and it never picks a winner on its own.
No revision takes effect until you approve it.
status, inspect and the dry-runs of init, resolve, rebase run offline, with no SkillX account needed.
5/ Publishing, sharing, syncing across machines 🧪
Publish
ak secrets set SKILLX_TOKEN # store the SkillX API key in the vault, not in .env
ak skills kit publish mine --privatepublish pushes a private revision. To make it available to the community (public or unlisted), use the SkillX CLI:
skillx publish ./your-skill --visibility publicNew packages are private by default. Changing the visibility of an already published package can currently only be done on the SkillX web dashboard, not in the CLI. I put it in the gap report already.
Syncing across machines
Sync is based on a lock file. Machine A publishes and commits the lock file to the repo, then machine B runs:
ak skills sync --locked
ak skills kit sync <kit-name> --lockedTo preview without writing anything: add --dry-run.
--locked means installing exactly the versions the lock pins, by digest. Machine B can never accidentally grab a different version.
The real state at the time of writing
The
ak skills kit ...commands are in the 3.0.0 binary. They are hidden if you setAGENTKIT_SKILL_OVERLAYSto anything other than1.The personal kit API on the SkillX server side is behind a flag, off by default. If you hit a
kit.api_disabled(404) error when publishing or syncing, that is why, and you did nothing wrong.The agentkit.best FAQ also states clearly: private skill publish/sync and personal kits are preview, not GA.
6/ Running skill scripts safely 🧪 behind a flag
Some skills have scripts (Python, Node, shell). Running scripts from a downloaded skill needs care. v3 ships an exec broker framework:
AGENTKIT_SKILL_EXEC_BROKER=1 ak skills grants add ...
AGENTKIT_SKILL_EXEC_BROKER=1 ak skills exec ...How it is designed:
Pinned by digest: a grant covers exactly one version of a script. Change one byte of the script and you must grant again.
Real isolation: runs inside bubblewrap (Linux), AppContainer (Windows), or docker/podman. With no isolation backend it refuses to run, it does not "just run it anyway".
Network allowlist: a script can only call the domains that are permitted.
Secrets passed as files, not dumped into environment variables anyone can read.
Refused before running: a SkillX version that is yanked, quarantined or revoked, running as root/admin, a missing grant... are all blocked before any process is created. Script output is size-capped and secrets are redacted.
I put it behind a flag for a simple reason: a static scanner is not a sandbox. When the isolation layer runs well on all 3 operating systems, then it gets enabled by default.
7/ Staying safe with skills other people wrote
My checklist:
ak skills inspectbefore installing. See who the publisher is and whether the signature is valid.ak skills readto readSKILL.mdand the scripts. You have to know what a skill tells the agent to do before it does it.Install with
--lockedfrom a committed lock file, so the whole team has the same version.Do not hand out broad
grantsjust because you are lazy. Grant exactly what the script needs.Keep secrets (API keys...) in the vault (
ak secrets), never write them straight into a skill.
On the server side, SkillX scans content and prompt injection at registration, hashes API keys, quarantines suspicious versions, and the @agentkit/* namespace is reserved so nobody can impersonate it. But honestly: the last line of checking is still your own eyes.
Next article: AgentKit Vault: secrets, credentials, multi-device sync →
Sources
ak skills --help,ak skills kit --help(ak 3.0.0): command listexec,grants,inspect,kit,read,resolve,route,syncv2 → v3 migration guide, the SkillX part after
ak update --ssot:agentkit/docs/guides/v2-to-v3-migration.md(tagv3.0.0)SkillX: https://skillx.sh, release
skillx-shv0.8.0 (29/10/2026), docsdocs/personal-kits-api.md,docs/cli-reference.md(repo nextlevelbuilder/skillx)FAQ https://agentkit.best (checked 02/11/2026): SkillX private publish/sync and personal kits are preview
Source
agentkit/apps/cli/internal/commands/skillbrowsecmd/personal_kit*.go,skillx_*.go(tagv3.0.0)