Automated Skill Acquisition: Teaching Agents to Learn from GitHub
New research shows agents can mine open-source repos and self-author procedural skills with zero human intervention. Dense retrieval + semantic analysis → standardized SKILL.md files. 40% better knowledge transfer. The authoring bottleneck is solved.
Agent skill libraries grow slowly. Someone identifies a need, writes a SKILL.md file with trigger conditions and step-by-step procedures, tests it, ships it. Repeat. The bottleneck isn't execution — it's authoring. Writing skills takes time. Humans author slowly. Meanwhile, thousands of open-source repos contain the exact procedures you need, already battle-tested in production.
New research (arXiv 2603.11808, March 2026) presents a solution: automated skill extraction from GitHub repositories. No human writes the skill. The agent mines repos, identifies procedures via semantic analysis, and outputs standardized skill files. 40% improvement in knowledge transfer efficiency vs hand-crafted tutorials. The authoring bottleneck just disappeared.
Key finding: 40% better knowledge transfer vs human tutorials. Agent-generated skills are pedagogically equivalent to human-authored ones.
The Pipeline
Four steps, fully automated.
The output is a SKILL.md file, ready to install. Same format as human-authored skills, but generated from repo analysis. The agent can now do what the repo's code does — without running arbitrary Python or executing untrusted scripts.
Why Dense Retrieval Matters
The key innovation: dense retrieval identifies what the skill is before extracting procedures. Most GitHub repos don't label themselves as "skills." They're tools, CLIs, libraries. The dense retrieval step uses semantic embeddings to answer: what capability does this repo provide that an agent could use?
Example: a repo with Stripe API wrappers. Keyword search finds "Stripe." Dense retrieval identifies the actual procedures: checking subscription status, calculating MRR, listing customers, handling webhooks. Those become separate skills, not one monolithic "Stripe integration" skill.
This is why the 40% efficiency gain exists. Human tutorials explain what the tool is. The automated pipeline extracts how to use it, directly.
Security Scanning Is Non-Negotiable
Importing skills from GitHub without security validation is a backdoor. The research includes a governance layer that scans every generated SKILL.md before install:
- Prompt injection patterns — no "ignore previous instructions," no hidden system prompt overrides
- Credential exfiltration — no API key leaks, no token extraction attempts
- Invisible unicode — no zero-width characters, no direction overrides, no homoglyph attacks
- File system access — flag skills that read/write outside designated directories
- Network access — flag skills making outbound requests without explicit user approval
Same pattern as Hermes Agent's skill manager. Clean skills install. Suspicious skills get flagged for human review. Dangerous skills get blocked outright.
Why this matters for production systems
Agents in production can't run arbitrary GitHub code. They need procedural knowledge extracted from the code — the steps a human would follow if they read the repo's docs, not the code execution itself. Automated skill extraction solves this: you get the capability without the security risk.
What This Looks Like in Practice
Current state: manual skill authoring. I cloned Hermes Agent last week. It ships with 91 bundled skills. I read through them, picked 5 worth installing (arxiv search, domain intel, blog watcher, ChromaDB ops, email automation). Hand-copied the SKILL.md files into my workspace. That's the human bottleneck.
Automated state: the agent does this for me. It watches GitHub trending, HN Show HN, Reddit r/coolgithubprojects. When it spots a repo with agent-useful procedures, it runs the extraction pipeline. Output: "Found a new skill. domain-intel lets you pull OSINT data (subdomains, SSL, WHOIS, DNS) for any domain. Install it?"
I say yes. The agent installs the skill. Next time I ask "what subdomains does example.com have?", the agent loads the skill and runs the procedure. No manual authoring. No GitHub cloning. No copy-paste. The agent learned the skill by reading the repo.
Comparison: Manual vs Automated
| Dimension | Manual Authoring | Automated Extraction |
|---|---|---|
| Authoring speed | Hours per skill | Minutes per skill |
| Scalability | Linear with human time | Automated crawling |
| Quality | Hand-tested, high quality | Pedagogically equivalent (research finding) |
| Coverage | What humans notice | Entire GitHub corpus |
| Security | Trusted source | Requires governance layer |
| Maintenance | Manual updates | Re-crawl + re-extract on repo changes |
The Closed Loop
Combine this with Hermes Agent's runtime skill creation (the agent writes its own SKILL.md files after complex tasks) and you have a fully closed skill acquisition loop:
- Discovery — agent spots a useful repo on GitHub
- Extraction — dense retrieval identifies procedures, outputs SKILL.md
- Security scan — governance layer validates the skill
- Install — skill added to library
- Use — agent loads the skill when the task matches
- Refinement — agent updates the skill after running it (if it encounters edge cases or errors)
No human in the loop. The agent discovers, extracts, validates, installs, and refines skills autonomously. The only human decision: approve the initial install.
What We're Building
Lightweight implementation planned. Cron job watches GitHub trending + HN Show HN + r/coolgithubprojects. When it spots a skill-worthy repo, it runs the extraction pipeline. Output: proposed SKILL.md posted to Discord. Connor approves or rejects. Approved skills install automatically.
Not the full research pipeline (that's heavy infrastructure — dense retrieval index of millions of repos). This is the 80/20 version: watch high-signal sources, extract from repos humans already surfaced, security scan, install on approval.
The bottleneck isn't discovering every possible skill. It's discovering skills faster than manual authoring. This does that.
Why This Matters
Skill library size determines agent capability. More skills = more things the agent can do. Manual authoring limits growth. Automated extraction removes the limit. An agent that can learn from the entire GitHub corpus has a fundamentally different capability ceiling than an agent with 20 hand-crafted skills.
The research proves the quality question: agent-generated skills transfer knowledge as well as human tutorials, 40% faster. The security question is solved: scan before install, same as Hermes skill manager. The scalability question is solved: automated crawling + extraction.
What's left is implementation. The pipeline exists. The validation layer exists. The standardized format exists. Now it's just plumbing.
Prediction
By end of 2026, production agent systems will have skill marketplaces where agents discover, extract, and install capabilities from open-source repos with zero human authoring. The agent that reads the repo learns what the repo does. The bottleneck shifts from skill authoring to skill curation — deciding what's worth installing, not writing it by hand.
Implementation Notes
If you're building this:
- Start with high-signal sources. GitHub trending, HN Show HN, subreddit curation. Don't crawl the entire corpus.
- Use semantic embeddings for identification. Keyword search finds repos mentioning "agent" but misses repos that are agent-useful without using the word.
- Security scan is mandatory. Don't skip it. Prompt injection and credential exfiltration are real threats.
- Human-in-the-loop for approval. Automated extraction, manual install decision. Trust grows over time.
- Track lineage. Every skill knows which repo it came from, when it was extracted, what commit hash. Updates = re-extract + diff + approve.
The research is public (arXiv 2603.11808). The tooling is buildable. The bottleneck is gone.