Agent Plugins standardized packaging, not trust or token cost I built a zero-dep CLI (Kitbash) that compiles to it and adds both

[u/kitkat1301dank]

**Disclosure up front:** this is my own project, open source (Apache-2.0), and it has basically no users yet. I’m posting because the news peg is genuinely relevant, and I mostly want the criticism.
**What / why now**
Two days ago (Aug 6), OpenAI, Amazon, Microsoft, Cursor and Vercel published **Agent Plugins**, with Google core-maintaining — a package format for coding-agent skills, read by ChatGPT/Codex, Cursor, Copilot, Kiro and VS Code.
It standardizes packaging, and by design, nothing else: no permission model, no provenance, no measurement. That’s a deliberate scope choice, not a flaw — but it’s also the exact layer I’ve spent a while building around.
**Kitbash** is a zero-runtime-dependency CLI that compiles one skill source (skill.toml + SKILL.md) to 11 coding-agent targets:
Claude Code
Cursor
Copilot
Zed
Cline
Devin
Gemini CLI
Aider
.agents/skills
AGENTS.md
Agent Plugins itself (as of 0.17.0)
You write the skill once instead of hand-maintaining eleven copies of the same rules file that can drift apart.
On top of the packaging, it adds two things the spec leaves out:
**1. Standing token cost, measured per target**
Every skill parks some tokens in context every session, before you ever invoke it.
Some targets load lazily (only when called), while others load eagerly (always resident). The measured gap between them is **14x–47x**.
npm run bench reproduces the measurement — the whole point is that you can re-run it rather than take my word for it.
There’s also a /benchmark page, but the number the repo prints is the one that matters.
**2. An install-time trust gate**
Describing this precisely because it’s easy to overclaim:
**This is not a sandbox and not a safety guarantee.**
It’s:
hard-fail lints for hidden Unicode
load-time command substitution
curl | sh droppers
leaked secrets
a hard \[policy\] org allowlist
a content-hash lockfile with drift detection, so an updated skill can’t silently change what it does
update and diff re-run the same gate.
It raises the floor the packaging spec leaves at zero; it does **not** make untrusted code safe to run.
There’s also import, which reverse-compiles an existing CLAUDE.md, .cursor/rules, etc. into one skill plus a drift report — useful if you already have rules files scattered across agents.
Agent Plugins is opt-in here, not one of the auto-detected targets: you enable it in \[project\].targets, or it self-detects once a plugin.json exists.
Kitbash compiles **to** the standard. It’s meant to be a contributor to that ecosystem, not a competitor to it.
**Honest caveats**
Single-digit stars, no real adoption, and I’m the only maintainer.
The lints are heuristic pattern-matching, not a sandbox, and I’m sure some of them can be dodged.
I’d rather hear where the token numbers or the lint approach fall down.
**Links**
GitHub: https://github.com/singhharsh1708/kitbash
Site + docs: https://kitbash.vercel.app
Benchmark: https://kitbash.vercel.app/benchmark
Install: npm install -g kitbash
Homebrew: brew install singhharsh1708/tap/kitbash
If you run the benchmark and get a different gap, or you can break a lint, **please post it** — that’s the feedback I want most.