# 🍸 skill-bartender ### *Mix the right skill cocktail for every task — and never pour an untasted bottle.* [](LICENSE) [](https://github.com/akqwpeter-prog/skill-bartender/actions/workflows/scan.yml) [](https://github.com/topics/dsh-plugin) [](docs/skillspector-report.json) [](README.md#-why) [](README.md#-quick-start) [](docs/lang/README_ZH.md)
Your agent already sees a catalog of skill names and descriptions — but it **over-pours**: loads too many skills, loads the wrong ones, or misses the one workflow skill that composes the task. **skill-bartender** is the meta-skill that fixes the pour: - 🪜 **Laziness ladder** — zero skills when plain tools suffice; one skill when one matches; workflow over hand-composed atomics; unsure → don't load. - 🍷 **Routing table** — a user-editable task→skill map (`references/policy.md`) that overrides the defaults. - 🔐 **Safe cellar** — a needed skill missing? Quarantine → SkillSpector scan → explicit human approval → install. Never auto-installs. - 🧠 **Learn** — loaded-but-unused skills get logged and skipped next time. - 🧪 **Taste test** — audit installed skills and rewrite weak descriptions into "when-to-use" sentences. [Why](#-why) · [What you get](#-what-you-get) · [Quick start](#-quick-start) · [See it in action](#-see-it-in-action) · [Usage](#-usage) · [Security model](#-security-model-read-this) · [FAQ](#-faq) · [Examples](#-examples) · [Layout](#-layout) · [License](#-license) [**English**](README.md) · [**简体中文**](docs/lang/README_ZH.md)
## 🚀 Usage Four ways to use it: | Way | How | When | |---|---|---| | **A. Say the name** | In any session, just say "skill-bartender" | One-off or first-time setup | | **B. Always-on routing** | Paste the routing table into AGENTS.md | Every task routes through the ladder | | **C. Request a pour** | "Which skill fits this task?" | Choosing among skills | | **D. Cellar audit** | "Audit my installed skills" | Taste test: weak descriptions get rewritten | `skill-bartender` must itself be loaded once (user gesture or task match) — it never self-triggers, and never pre-loads "just in case". ## 🔐 Security model (read this) - Skills are **instructions**, and instructions can be adversarial (prompt injection). SkillSpector is a **filter, not a guarantee**. - `scripts/` in any skill is **code** — never executed without human review. - Human approval is mandatory for every install. **No silent installs, ever.** - This skill scans itself clean: SkillSpector **0 findings** (score 0 / SAFE) — [docs/skillspector-report.json](docs/skillspector-report.json). - Security policy: [SECURITY.md](SECURITY.md). ## ❓ FAQ **Does it auto-install missing skills?** No. Every download goes to a quarantine dir, gets scanned with SkillSpector, and is copied into the skills root only after explicit human approval. A passing scan is a filter, not a guarantee — prompt injection survives static scans, so scripts are shown to the human and default-deny. **What if SkillSpector isn't installed?** `uv tool install git+https://github.com/NVIDIA/skillspector.git`, or run the manual checklist in `references/policy.md`. **Does it work with Claude Code and Codex?** Yes — the same SKILL.md installs on all three platforms in ~15 seconds. **How is this different from DshMarket / dsh-find-plugin / dsh-plugin-autoevo?** They find, search, and auto-install plugins. skill-bartender adds the **routing policy** (ladder + routing table) and the **quarantine-then-approve** discipline. Use it *alongside* the ecosystem, not instead of it. **How is it evaluated?** The routing policy ships with a gold-task suite: [docs/eval.md](docs/eval.md). ## 🎁 Examples - [docs/EXAMPLES.md](docs/EXAMPLES.md) — real routing cases, cellar installs, audits. - [docs/ROUTING-GUIDE.md](docs/ROUTING-GUIDE.md) — how to write your own task→skill rules. - [docs/eval.md](docs/eval.md) — gold-task suite for the routing policy. ## 🗺️ Layout ``` skill-bartender/ ├── skills/ │ └── skill-bartender/ │ ├── SKILL.md # the skill itself (one file, three platforms) │ └── references/policy.md # user-editable routing table ├── docs/ │ ├── screenshots/how-it-works.png │ ├── eval.md # gold-task suite │ ├── EXAMPLES.md / ROUTING-GUIDE.md │ ├── skillspector-report.json # self-scan: 0 findings │ ├── social-preview.png # banner (regenerate via scripts/) │ └── lang/README_ZH.md # 简体中文 ├── scripts/ │ ├── make-banner.py # composes docs/social-preview.png │ ├── make-diagram.py # composes the how-it-works diagram │ └── validate.py # local structure validation ├── cordis.patch.yml / index.js / package.json # DSH bundle manifest └── LICENSE (MIT) ``` ## 🤝 Join the DSH plugin ecosystem DeepSeek Harness developer preview is still in its testing phase for Harness developers; core plugins and base APIs will keep iterating. We look forward to exploring the upper limits of intelligence together with developers worldwide, on top of open-source, open, reusable, and composable infrastructure. - [dsh-plugin topic](https://github.com/topics/dsh-plugin) - [Quickstart](https://deepseek-harness.github.io/deepseek-harness/guide/quickstart) - [DeepSeek Harness repo](https://github.com/deepseek-ai/deepseek-harness) - Companion executor: [dsh-skill-router](https://github.com/akqwpeter-prog/dsh-skill-router) > This repo is tagged [`dsh-plugin`](https://github.com/topics/dsh-plugin) and > listed in the [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin) > curated list. PRs, issues and translations are welcome. ## 📄 License [MIT](LICENSE). Ponytail (MIT) is referenced, not bundled — tribute in the SKILL.md.