Install skills straight from GitHub

Plenty of great harness config lives in plain GitHub repos — skill collections like obra/superpowers or anthropics/skills — with no registry or packaging involved. baselane install takes a git ref directly, resolves it to a commit SHA, vendors the content, and pins it in harness.json.

Install a whole repo at a tag

baselane install github:obra/superpowers@v6.1.1

The ref (v6.1.1) is resolved to its commit SHA at install time, and the SHA — not just the ref — is what gets recorded. Tags can move; the pin can't. Re-running an install from the same manifest always reproduces the same bytes, and tampering shows up in drift because every vendored file's hash is recorded too.

Install a single skill from a repo

baselane install obra/superpowers@test-driven-development

The owner/repo@skill form picks one skill folder out of a collection instead of vendoring everything — useful when you want a repo's TDD skill but not its forty neighbors.

Repo-level or machine-level

baselane install github:obra/superpowers@v6.1.1       # this repo: ./.claude + ./harness.json
baselane install github:obra/superpowers@v6.1.1 -g    # this machine: ~/.claude + global manifest

Without -g, the skills vendor into the current repo and the pin lands in its committed harness.json — teammates get the exact same skills from the manifest. With -g, it's personal config for every project on this machine.

What lands in harness.json

"resolutions": {
  "github:obra/superpowers": {
    "ref": "v6.1.1",
    "sha": "c984ea2e7aeffdcc865784fd6c5e3ab75da0209a",
    "packId": "superpowers"
  }
}

Ref → exact SHA, plus per-file hashes under materialized. See the harness.json reference for the full shape.

Update deliberately

baselane update github:obra/superpowers   # re-resolve the ref, bump the pin
baselane drift                            # verify disk matches the manifest