How to manage Claude Code and Codex skills across a team

Once more than one person on a team writes skills, the folder-copying phase ends badly. Someone improves the deploy skill in their repo, three other repos keep the old one, and nobody can say which version an agent used last Tuesday.

The fix is the same one package managers settled on years ago: a manifest, a lockfile and a registry.

1. Declare skills, do not copy them

Keep a skills.toml in each repo listing the skills it needs and where they come from: a GitHub folder, a local path or your team registry.

[settings]
targets = [".claude/skills", ".agents/skills"]
min_grade = "B"

[skills.deploy]
source = "registry:acme/deploy@1.4.0"

[skills.pdf]
source = "github:anthropics/skills/skills/pdf"

Setting two targets means Claude Code and Codex (and anything else reading .agents/skills) get the same pinned copy.

2. Lock exact content

skillhash lock records the commit and a SHA-256 of every file. Commit skills.lock. Now “which version did the agent use” has an answer in git history.

3. Publish internal skills to a registry

Internal skills should not live in one person's repo. skillhash push ./skills/deploy -v 1.4.0 publishes an immutable version, scanned on the way in, and rejected if it falls below the grade your team set. See the registry docs.

4. Verify in CI

Add uvx skillhash verify to your pipeline. Hand edits to installed skills, half-finished updates and grade regressions fail the build instead of shipping to every developer's agent. The CI guide has GitHub Actions, GitLab and pre-commit snippets.

5. Watch what you do not control

For public skills you depend on, add a watch. When upstream changes, you see the new grade and decide whether to accept it, instead of finding out from an incident.

Start free: one developer, three private skills and three watches cost nothing. Team is $29 a month for up to ten people.