Camunda Ships spm, Which Makes Agent Skills Git Dependencies With an ai.json Manifest and an ai.lock SHA File
Camunda spm-cli docs, via Hacker News Show HN (repo metadata verified via the GitHub API; low star count, single source)·low signal
Camunda posted spm to Show HN on September 10, a CLI that declares AI skills as git dependencies pinned by tag, branch or commit and locked to immutable SHAs, then projects them into Amp, Claude Code, Cline, Codex CLI, Copilot CLI, Cursor, Gemini CLI and Windsurf. Skills stay out of your repo and come from a global fetch cache. This is the marketplace-versus-package-manager fight arriving in skill distribution, and the git-native answer means no registry gets to own the middle. Apache-2.0, 7 stars, created July 29.