Camunda's spm makes agent skills git dependencies with a manifest and a SHA lock file.

spm declares skills as git dependencies pinned by tag, branch or commit and locked to immutable SHAs in ai.lock, then projects them into Amp, Claude Code, Cline, Codex CLI, Copilot CLI, Cursor, Gemini CLI and Windsurf, keeping skills out of your repo behind a global fetch cache. Apache-2.0, 7 stars, created July 29. The marketplace-versus-package-manager fight arriving in skill distribution, and the git-native answer means no registry owns the middle. Single source, tiny repo, so this is a direction rather than a result.