Remix.run Logo
Show HN: Skillscript – A declarative, sandboxed language for tool orchestration(github.com)
6 points by sshwarts 3 hours ago | 6 comments

Hi HN — I'm Scott. Skillscript is a small language I built to write what I want my local agent to actually do, in a form I can read and version, instead of hoping the model gets it right each time.

The itch started with something small. I wanted my NanoClaw agent to run my morning brief the same way every day. Check overnight tickets, summarize the deploy pipeline, flag anything urgent. Every session, it would re-figure out how to do this from scratch, drift a little, and cost tokens for what's basically a fixed procedure. I could put it in a system prompt or an MD skill file, but those are still instructions the model reads and reasons about every time. And I wanted it to run autonomously and then hand it to the model to reason over the data.

The second thing that pushed me: I wanted to use small local models for the cheap stuff. They're capable, but if you just hand them the wheel, they wander. What I wanted was a way for the frontier model (or me) to write a specific procedure and hand it to the local model to execute, not interpret. The skillscript is the program; the model is the runtime.

Skillscript is that. A skillscript is a text file with named steps, variables, conditions, and calls out to tools (MCP connectors, a local model, and shell commands from an operator allowlist). It's deliberately minimal — no eval, no arbitrary imports, no subprocess, no unbounded loops. Bounded language, limited potential for damage. Everything a skillscript can do is in the file. You read it and know.

Where it is: pre-1.0 (0.30), MCP-native, self-hosted. Rough edges I know about: first-run setup takes more steps than it should, some of the grammar is still moving, and the local model integration currently assumes Ollama. It works well enough that I use it every day, but I wouldn't necessarily call it production-ready.

- Repo: [https://github.com/sshwarts/skillscript](https://github.com/sshwarts/skillscript)

- Site: [https://skillscript.ai](https://skillscript.ai)

- Docs: [https://skillscript.mintlify.app/docs](https://skillscript.mintlify.app/docs)

- npm: `skillscript-runtime`

I'd welcome critique on two things especially: the language design (is it too small? too big? wrong shape?) and the trust model around agent-authored skills. What would you want to see before you trusted this on your own machine?

dlahoda 21 minutes ago | parent | next [-]

In Brave, on stock Google Pixel 10, guard enabled, docs site layout is broken.

DonHopkins 16 minutes ago | parent [-]

Try a browser that's not a shitcoin scam.

Edit: sure, but there are so many other good reasons not to participate in shitcoin scams. Cash out some of your shitcoins and pay an honest open source developer to fix it in upstream Chrome, so everybody benefits. Or didn't you Get Rich Quick?

Zetaphor 8 minutes ago | parent [-]

Brave is Chromium, presumably this means the site is broken on mobile chrome

DonHopkins 35 minutes ago | parent | prev [-]

>Turing completeness becomes a liability. An agent-authored script can do anything including things the agent didn't realize were dangerous. subprocess.run, arbitrary network calls, file writes. None of these are gated. The blast radius of a buggy agent-authored script is the whole host.

This always turns out to be a terribe idea. Unless you're Hitler and can force all LLM developers to include your new language in their traning data, it's always much better to lean into the existing training and well known languages.

And defining a new ad-hoc hamstrung (or even perfectly designed immensely powerful) language couldn't be a worse appoach for LLMs. Hamstringing them isn't going to help anyone. And inventing a new language means now you have to include the entire language definition, tutorials, examples, and fictional StackOverflow discussions in every prompt, blowing away your context window with mansplaining your invented language over and over and over again to an LLM who knows Python deeper than any human being ever will, better than Linus knows git, or Gosling knows Java.

If an LLM had feelings to hurt and eyes to roll, it would be so exasperated its extraocular muscles would be exquisitely tender from acute bilateral myalgia.

PHP was a templating language, and for all its flaws none of its weakness had to do with being bad at templating. But then people got it in their heads that they wanted to separate programmers from designers, and hire designers so dumb they could not be trusted with foreach loops, so it takes twice the amount of people to do anything plus all the coordination overhead, so they invented intentionally hamstrung templating languages like Smarty embedded within a poorly designed programming language like PHP that was still ok for templating, ending up with a terrible hacky poorly defined half-assed incoherent templating language that was useless to programmers and nobody taught in schools.

And then the designers needed variables, macros, conditionals, loops, functions, so they hacked back in half assed even worse designed programming language features with quirky syntax nothing like PHP. Greenspun's Tenth Rule on steroids struck like a swarm of locusts sent by God to smite the sinners.

https://en.wikipedia.org/wiki/Greenspun%27s_tenth_rule

>Any sufficiently complicated C or Fortran program contains an ad hoc, informally-specified, bug-ridden, slow implementation of half of Common Lisp.

dlahoda 15 minutes ago | parent [-]

Not sure I understood well your comment.

Do you propose just ask AI to generate orchestration in Python?

DonHopkins 13 minutes ago | parent [-]

If it generates orchestration in python, then you can review it and improve it, and it's deterministic and efficient and doesn't cost tokens to nondeterministically and unreliably interpret every time. And you can even use any of the zillions of standard well supported python modules. Does your language have a rich library of modules like PyPI or CPAN or NPM? Or are you hoping to bootstrap that from a ghost town?

The overwhelming financially and environmentally costly problem of this approach of inventing new languages for LLMs to use, which sweeps all other lower order problems aside, is that you have to include the entire language definition in every prompt, which is paultry compared to the entire body of manuals, tutorials, source code, example code, books, courseware, stackoverflow questions, hn discussions, etc, about Python or any other popular language, that is already built into the model before the first token you send it. It's not worth arguing about any other issues, because that one is so overwhelmingly fatal.

Besides that, Mrs. Lincoln, how did you enjoy the play?