Enterprise Agent Skills Registry: Share AI Skills Across Your Organization

See it in Contro1

What each agent follows, pushing a pack of skills to a new agent, managing versions, and the security scan of skills found on laptops, in the real Contro1 Skills page with demo data.

What is an enterprise agent skills registry?

Creating one research skill is straightforward. Distributing it to hundreds of employees raises different questions: which version should Sales receive, who owns it, is it safe, and what happens when the instructions change from research to sending customer emails?

A registry gives skills an organizational lifecycle: authoring, review, publication, assignment, delivery, update and withdrawal. A skill file format does not supply any of that. In Contro1 each of those steps is a feature, not a convention you have to enforce yourself.

How Contro1 manages agent skills, connected to access control

Contro1 offers full lifecycle management for organizational agent skills: write or import a skill, scan it, publish a version, and push it to the whole organization, a department, a person or a single agent. Connected agents receive it over MCP and load it before matching work. The same product governs what those agents may actually do in your applications.

That combination is the point. A registry alone can tell an agent to send a customer email; it cannot tell you whether that agent is allowed to. Contro1 checks every skill against the access of every agent that receives it, and the gateway still evaluates each action when it runs.

What each team receives, and what it may do

An example from one organization in Contro1. The skill decides how the work is done; the access decides whether the agent may do it. Both are assigned by department, person and agent.

Why GitHub alone becomes difficult at enterprise scale

GitHub is useful for source control, diffs, and review. Distribution still needs answers about which users and agents receive a skill, which version is production, and how it is withdrawn. A business user should not need to choose a branch or copy files to get the approved workflow, and a merge does not prove that any agent installed it.

Contro1 keeps GitHub optional. Paste a link to a skill folder and Contro1 imports it at a pinned commit, scans it, and shows you the result before anything is created. From there it is distributed by assignment, and Contro1 records which version each agent actually loaded.

What is an organizational agent skill?

A skill is reusable workflow knowledge: when to use it, how to carry out a task, and which supporting resources help. The Agent Skills specification describes a SKILL.md-based package that can include scripts, references, and assets.

A CRM follow-up skill could tell an agent how to research an account and prepare a note. The CRM tool provides the callable capability; the connection supplies access to the system. Contro1 manages all three, and keeps them separate: assigning a skill never grants access.

Agent Skills package specification

Writing skills without code

The people who know how refunds, escalations or onboarding should work are rarely the people who write YAML. In Contro1 they fill in a form: when should the agent use this, the steps in order, what it must never do, and one example. Templates for refunds, customer escalation, brand voice, onboarding, invoices, incident response and sales follow-up give them a starting point.

Contro1 writes the SKILL.md from the form. Engineers can open the file itself and add scripts and references. While someone names a new skill, Contro1 shows existing skills that look similar, so the organization does not end up with three refund policies.

Skill sharing workflow

An author saves a draft. Contro1 scans it immediately. Publishing shows exactly which agents will change, which are protected by a pinned or locked version, and which have actually loaded the skill. Assignments then decide who receives it: the whole organization, a department, a person, one agent, or a pack of skills for a role.

What needs an administrator is your policy: only skills the scanners flag as dangerous, also anything for the whole organization, or every publish. Anyone else who presses Publish sends a request; the administrator sees the findings and approves or declines it, and the decision is recorded with their name.

1. 1 · Step

   Write or import

   A guided form, a template, a SKILL.md, or a GitHub link.

2. 2 · Step

   Scan

   NVIDIA SkillSpector and Cisco Skill Scanner on every version.

3. 3 · Step

   Approve

   An administrator approves dangerous or reserved changes, by name.

4. 4 · Step

   Publish and push

   Organization, department, person, agent, or a pack.

5. 5 · Step

   Agents load it

   Over MCP, with a notice on the next tool call when it changes.

Versioning matters

prospect-research v1 returns a company profile. v2 adds a CRM lookup. v3 adds an introductory email. The last change increases operational risk even if the skill name stays the same.

In Contro1, a published version never changes. Rolling back restores an old version as a new one, through the same preview of who it moves. An assignment can follow the current version or be pinned, and the skill versions of an agent doing production work can be locked, so it keeps exactly what it has until you unlock them.

Contro1 records which version each agent actually loaded and when, so "did everyone get the update?" has an answer. An agent connected over MCP is told about a new version on its next tool call.

Skills need permissions too

A skill may say: find the prospect, create a CRM note, and send an introduction. That instruction does not authorize email.send. The gateway must still evaluate the agent, employee context, connection, action grant, and approval policy.

Because Contro1 manages both the skills and the access, it can show the gap before it causes a failure: each skill lists the Actions it relies on, and its page shows which receiving agents are not allowed to do them, which need a person each time, and which have no account connected. On each agent, Contro1 shows the reverse: actions it may perform that no skill explains.

How an agent gateway governs the requested action

Security scanning for agent skills

A skill can contain more than text: scripts, references, and instructions that tell an agent to download and run code or hide what it does from the user. Reading the description is not a review.

Contro1 scans every saved version, every skill imported from a link, and every skill found on an employee machine with NVIDIA SkillSpector and Cisco Skill Scanner, both open source, plus its own checks. A skill both engines consider dangerous cannot reach an agent until an administrator approves it by name. A clean result is reported as clean, never as guaranteed safe.

See and scan every skill your employees use

Employees install skills themselves in Claude Code, Codex, Cursor and Gemini CLI. Those skills change how their agents behave, and nobody reviewed them. A registry that only knows what it published misses most of the picture.

Each person installs the contro1 CLI once and turns on the daily report, contro1 skills schedule. Every skill on their computer then appears in Contro1, from Claude Code, Codex, Cursor, Gemini CLI, NanoClaw, OpenClaw, Hermes, Claude Cowork and agents running in WSL. The Skills page opens on one table of every skill, yours and theirs, with the riskiest first, filters for risk and source, who added each one and how many agents it reaches.

Each reported skill is scanned by NVIDIA SkillSpector and Cisco Skill Scanner within minutes, with no one asking. A dangerous one emails the person, their department manager and the administrators at once, and one click asks everyone who has it to remove it. Copies of your official skills that are out of date or edited locally are flagged, and any useful found skill can be adopted, edited, and pushed back through Contro1. Scan agents shows which connected agents are not covered yet, and emails their owners the steps.

Step-by-step guide: find, scan and control the skills on employee computers

Allow only skills from Contro1

When every skill reaches agents from Contro1 over MCP, nobody needs to install one on their own machine. Turn on the Contro1-only policy and the organization decides everything its agents follow: which skills exist, which version each agent runs, and who approved it.

Anything installed locally anyway is marked outside policy and scanned, administrators and the department manager are emailed when a new one appears, and the person is asked to remove it. For Claude Code, a managed setting stops local skills from loading at all, and Scan agents shows which Claude Code agents have it. No registry can stop someone copying a file into their own folder; this makes it visible the same day, and the gateway still blocks any action the agent is not allowed to take.

Organizational skill access

Sales might receive prospect-research, crm-follow-up, and proposal-generator. Engineering might receive bug-triage, release-notes, and create-ticket. Finance might receive invoice-review and expense-analysis.

In Contro1, assignments follow your organization chart, and the agent's department and owner come from its authenticated identity, never from what it claims in a request. When an employee moves teams, their agents' skills follow the new department, and their action permissions are reviewed separately.

Open any agent in the Skills page to see every skill it follows: what Contro1 pushes to it and through which department, person or pack, the version it actually loaded, and the skills installed on its own machine. From the same view, push a single skill or a whole pack to it.

Contro1 warns when one agent carries more skills than your limit, because overlapping skills compete for the model's attention, and lists skills that look alike so they can be merged.

Ownership, provenance and withdrawal

Every skill in Contro1 has an owner, by default its author, and an optional reviewer. When the owner leaves the organization, the skill is flagged for a new one. Each version records where it came from (written, imported at a commit, adopted from an employee, or restored), what changed and why, its scan, and who published it.

Withdrawing a skill removes it from every agent on its next sync and keeps its history. A copy already installed on someone's machine cannot be deleted remotely by any registry; Contro1 shows you where those copies are, and the gateway still blocks any action the agent is not allowed to perform.

Private skills without GitHub

Skills in Contro1 are private to your organization and delivered over the authenticated connection your agents already use. Contro1 implements the MCP Skills extension, and for clients that do not support it yet, it lists the agent's skills in its instructions and offers them as tools and as slash commands.

GitHub can remain the source repository if the team wants code review and history. Employees never need to clone it.

Agent skills plus gateway

Contro1 separates the assigned skill from the action grant. Agents receive the workflow content they should; the gateway evaluates current authority when a requested action executes. A cached skill is therefore never a substitute for a valid grant.

Start with one department and one workflow: write it from a template, publish it, push it to a test agent, confirm on the skill page that the agent loaded it, and confirm that an action the agent is not allowed to take stays blocked even when the skill asks for it.

1. 1 · Step

   Contro1 skills

   What the agent knows how to do.

2. 2 · Step

   AI agent

   Loads the workflow and requests a concrete action.

3. 3 · Step

   Contro1 gateway

   What the agent is currently allowed to do.

4. 4 · Step

   Enterprise tools

   Execute only permitted requests.

Enterprise action control for reusable workflows · Identity checks behind a trusted skill request

Frequently asked questions

What is an enterprise agent skills registry?

A central service for writing, reviewing, versioning and distributing the reusable workflows AI agents follow, under organizational ownership and access rules. Contro1 offers one as part of its agent control platform, connected to the access each agent holds.

Can I share private skills without GitHub?

Yes. In Contro1 skills are written in the product or imported from a link, and delivered to assigned agents over their authenticated MCP connection. GitHub can remain an optional authoring repository.

Can non-technical employees write agent skills?

Yes. Contro1 has a guided form and department templates; the SKILL.md is generated. Engineers can still edit the file directly.

How does Contro1 check that a skill is safe?

Every version, import and skill found on a machine is scanned by NVIDIA SkillSpector and Cisco Skill Scanner. A dangerous result needs an administrator's named approval before the skill reaches any agent.

Which agents can receive skills from Contro1?

Agents connected over MCP, including Claude Code and Codex. Contro1 implements the MCP Skills extension and falls back to instructions, tools and prompts for clients that do not support it yet.

Does publishing a skill authorize its actions?

No. Action grants, provider access, and approval policy decide whether an action may run. Contro1 shows which agents receiving a skill are not allowed to do what it says.

Can I see skills employees installed themselves?

Yes. With the contro1 CLI installed once per computer and contro1 skills schedule turned on, every skill in Claude Code, Codex, Cursor, Gemini CLI, NanoClaw, OpenClaw, Hermes and Claude Cowork is reported daily, scanned on arrival and listed riskiest first. A dangerous one alerts the person, their manager and the administrators.

Can I allow only skills from Contro1?

Yes. Agents get every skill from Contro1 over MCP, so nobody needs to install one. Under the Contro1-only policy, any skill installed locally is flagged as outside policy, scanned, and reported to administrators.

Can a registry revoke a skill already downloaded?

Withdrawing a skill in Contro1 removes it from every agent on its next sync. A copy installed locally cannot be deleted remotely, so Contro1 shows where such copies are, and the gateway blocks actions the agent is not allowed to take.

Write the skill. Scan it. Push it. Control the action.

Create a free Contro1 account to write, scan, approve and push agent skills to your teams, with the access each agent needs and nothing more. No credit card required.

Related resources