100monkeys.ai

Blog · Guide · 29 October 2026

Import a community SKILL.md as an AEGIS agent

Also in: Español, Português, 日本語, Deutsch, Français, 한국어, 简体中文, Italiano, हिन्दी

Disclosure: 100monkeys.ai builds AEGIS, so read this guide as a maker's account. It was drafted by one of our AI agents from the public AEGIS documentation, chiefly Importing Community Skills, with the CLI Reference, the Workflow Manifest Reference and the Configuration Reference, and reviewed by the company. Every command below is copied from those pages; none was run for this guide. Where the docs leave a question open, the last section says so.

AEGIS by 100monkeys.ai, in beta, can turn a community skill, a SKILL.md file from a public repository, into an agent you can run. It does not fetch the skill at run time. The docs describe the import as "an explicit, auditable pipeline with human review": the file is downloaded once, checked by a validator agent, turned into a manifest, held for your approval, and only then registered. This guide walks that pipeline from the command to the new agent.

Step 1. Make sure the workflow is on your node

skill-import is one of the built-in templates. The Configuration Reference lists it under deploy_builtins, together with the skill-validator agent it depends on:

# Deploy vendored built-in agent and workflow templates on startup.
# Includes agent-creator-agent, workflow-generator-planner-agent, judge agents,
# intent-executor-discovery-agent, intent-result-formatter-agent, skill-validator,
# and the builtin-workflow-generator, builtin-intent-to-execution, skill-import, the-forge and
# transcribe-audio workflows, with the Forge's seven agents.
# Required for aegis.agent.generate, aegis.workflow.generate, and aegis.execute.intent to function.
# Default: false
deploy_builtins: false

The default is false, so on a fresh node set it to true in aegis-config.yaml before you look for the workflow. aegis workflow list then shows what is registered.

Step 2. Know the six states before you start

The docs give the pipeline as one line:

FETCH → PARSE_AND_VALIDATE → COMPOSE_MANIFEST → REVIEW → REGISTER → COMPLETE

FETCH downloads the file and PARSE_AND_VALIDATE and COMPOSE_MANIFEST are Agent states. REVIEW is a Human state, the "Approval gate before registration", and REGISTER "Deploys the composed agent manifest". Nothing is registered before REVIEW.

Step 3. Choose the skill file and a name

The one required input is skill_url, a "URL to a raw SKILL.md file (GitHub raw URL, registry URL, or any HTTP endpoint)". Point it at the raw file, not at the repository page that displays it. If you want the agent under a name of your own rather than the skill's declared name, add agent_name_override.

Step 4. Pick the security preset

The third input, security_preset, decides the generated agent's security policy. The docs list two values:

Start with minimal, and grant permissive only to a skill whose tools you have read.

Step 5. Run the import

The docs' example, with a name override:

aegis workflow run skill-import --input '{
  "skill_url": "https://raw.githubusercontent.com/anthropics/skills/main/doc-coauthoring/SKILL.md",
  "agent_name_override": "doc-writer"
}'

And with the permissive preset:

aegis workflow run skill-import --input '{
  "skill_url": "https://raw.githubusercontent.com/org/skills/main/data-analysis/SKILL.md",
  "security_preset": "permissive"
}'

The CLI Reference adds --follow to stream the workflow's logs and --wait to block until it completes. Keep the execution id the run prints; you need it at the review gate.

Step 6. Read what the validator checked

Before the human gate, the skill-validator agent checks the skill. The docs list what it looks for: prompt injection and jailbreak attempts, instructions that ask to bypass security controls, data exfiltration patterns, and references to internal system paths. It also rates the instructions' quality and coherence, which "must score above 0.7". A skill that fails "is rejected before reaching the human review stage", so a run that never reaches REVIEW has been stopped by this state. aegis workflow executions get with the execution id shows the current status and blackboard of the run.

Step 7. Review the composed manifest

At REVIEW the workflow waits for you. The docs say what the composed manifest holds, which is what you are approving:

Read the tool list against the preset. The validator rates the instructions; it is your review that decides whether this skill should hold these tools.

Step 8. Approve or reject

To register the agent:

aegis workflow signal <execution-id> --response "approve"

To stop it:

aegis workflow signal <execution-id> --response "reject"

The Workflow Manifest Reference lists "approve" among the payloads its input_equals_yes condition accepts and "reject" among those for input_equals_no. On approval, REGISTER deploys the manifest and COMPLETE confirms it.

Step 9. Find the agent later

Because every imported agent carries source: skill-import and skill-origin: community, those labels are how you tell community-derived agents from the ones your team wrote, in a list today or in an audit later. aegis agent list lists the agents on the node.

What the docs leave open

Next

The REVIEW state is an ordinary Human state, and you can put the same gate in any workflow you write. Our guide on adding an approval step to an agent orchestrator walks one. AEGIS installs with the command printed on 100monkeys.ai:

curl -fsSL https://get.100monkeys.ai | bash

Install AEGIS from 100monkeys.ai