I have been building and using agent skills across Claude Code, Codex and GitHub Copilot, alongside plugins such as Ponytail and Superpowers. I am using Microsoft Agent Package Manager (APM) to manage that collection through a shared manifest.
My agent-setup repository holds the configuration and a copy of the global lockfile. The manifest declares what I want installed; the lockfile records the resolved dependency revisions.
Configure the target tools and dependencies
My apm.yml targets Copilot, Claude Code and Codex (dependencies will ever increase over time):
name: personal-agent-toolkit
version: 0.1.0
targets:
- copilot
- claude
- codex
dependencies:
apm:
- DietrichGebert/ponytail
- obra/superpowers
- thomast1906/github-copilot-agent-skills/.github/skills/skill-creator
Ponytail provides agent workflows, skills and hooks. Superpowers includes planning, TDD, debugging and code review workflows. The final dependency selects Skill Creator from my skills repository.
APM inspects each dependency’s package layout and manifests, so the same list can contain plugins and individual skills. Its package types reference describes how those formats are handled.
Install globally from the setup repository
On macOS, install APM with Homebrew. You also need Git and the agent tools you intend to use.
brew install apm
apm --version
Clone the configuration repository and copy its manifest into APM’s global location:
git clone https://github.com/thomast1906/agent-setup.git
cd agent-setup
mkdir -p ~/.apm
cp -i ./apm.yml ~/.apm/apm.yml
apm install --global
--global reads ~/.apm/apm.yml. Without that flag, apm install configures the current project. Listing several agents in targets does not change the installation scope.
The cp -i command prompts before replacing an existing manifest. Merge any global dependencies you want to retain before overwriting it.
After a successful installation, copy the generated lockfile back:
cp ~/.apm/apm.lock.yaml ./apm.lock.yaml
The repository and global manifests are separate files. When I edit the repository copy, I repeat the copy and install steps. APM does not synchronise them for me.
Select one skill from a larger repository
I do not need my entire skills collection installed globally. This entry selects only the directory containing Skill Creator:
- thomast1906/github-copilot-agent-skills/.github/skills/skill-creator
I can use the same approach for another skill, such as Terraform provider upgrades:
- thomast1906/github-copilot-agent-skills/.github/skills/terraform-provider-upgrade
A direct skill reference does not include tooling dependencies declared in a separate bundle. For example, I need to check the Terraform MCP configuration when selecting that skill on its own. APM supports these paths as repository subdirectory references.
Update the global dependencies and commit the lockfile
From my setup repository, I update the global dependencies and save the resulting lockfile:
apm update --global
cp ~/.apm/apm.lock.yaml ./apm.lock.yaml
git add apm.lock.yaml
git commit -m "Update APM lock file"
I only copy the lockfile after the update succeeds. APM presents the dependency changes before applying them. If it also changes declarations in ~/.apm/apm.yml, I copy those changes back and commit both files.
This updates dependencies managed by the global manifest. Native plugin installations and project-specific APM configurations remain separate.
To upgrade the Homebrew-managed APM CLI itself:
brew update
brew upgrade apm
The APM update reference covers dependency updates and how they differ from CLI upgrades.
Restore the recorded package versions
On a new machine, or after checking out an earlier commit of the setup repository, I copy both the manifest and lockfile into the global location:
mkdir -p ~/.apm
cp -i ./apm.yml ~/.apm/apm.yml
cp -i ./apm.lock.yaml ~/.apm/apm.lock.yaml
apm install --global --frozen
--frozen requires the lockfile and rejects relevant manifest or lock-state mismatches instead of resolving newer revisions. It can still download missing locked packages. The install reference documents those checks.
This restores dependency versions, not the entire machine configuration. Credentials and agent executables are separate, and it does not undo actions a plugin has already run.
Check hooks as well as skill discovery
APM reports different levels of user-scope support across agents. I check that output, then verify skill discovery, required MCP connections and hook behaviour in a fresh session for each tool.
Ponytail and Superpowers both influence the development workflow, so I would test their interaction on a small change before relying on the combined setup. Once an APM-managed replacement is verified, I would disable any duplicate native installation of the same components.
The manifest and lockfile are in agent-setup. Change the dependency list to suit your workflow, install it globally and commit the generated lockfile after a successful run.