Pin Your AI Agent Skills Like You Pin Your Dependencies

AI coding tools can load reusable instructions from external repositories. When those sources change without review, the team loses a clear record of which instructions were available during a task. Treating instruction sources as dependencies makes that input traceable.

Record the source

Maintain a reviewed manifest with the repository, selected skills, license, immutable revision and installation location. A tag is convenient for people, but a resolved commit provides a precise reference. Review both the content and the permissions or tools a skill expects to use.

Upgrade deliberately

Review upstream changes before updating the pin. Exercise representative tasks, record any changed expectations and deploy the reviewed revision to the intended clients. Check the installed copy against the manifest so local drift is visible.

Keep expectations realistic

Identical instructions do not guarantee identical output. Model versions, tool access, repository state and runtime context also affect behavior. Pins give an investigation a stable input to inspect; task verification still determines whether the result is acceptable.

Build an operating baseline

• Declare each source and its owner.
• Record the reviewed revision and permitted use.
• Make failed installation and drift checks visible.
• Verify outcomes on representative tasks after changes.
• Retain the prior manifest so a change can be compared or rolled back.

This is part of the governed development approach behind Anvil: make the instructions, tools and delivery evidence available to the team responsible for the result.