A CLI to manage, synchronize, and deploy AI agent skills across IDEs
SaferSkills independently audited skillctrl (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Helps you import, update, and deploy AI agent skills.
owner/repo, then check/update later from GitHub upstream using local import metadata.ownSkillsDir in ~/.skillctrl/config.json.Required Node.js version: 22+.
npm i -g skillctrl
skillctrlnpx skillctrl@latestTo expand your local toolkit:
.../skills/development/my-new-skill/).SKILL.md with standard YAML frontmatter (name and description).skillctrl via Own Skills Dir (saved in ~/.skillctrl/config.json).skillctrl to verify and deploy.The CLI manages and deploys skills to your local environment.
npm install
npm run build
# If you previously used a local linked dev build:
npm unlink -g skillctrl
npm linkThe easiest way to manage your skills is via the guided terminal wizard. Simply run the tool without arguments:
# Global command (if linked)
skillctrl
# Or local development run
npm startFor advanced users, CI/CD scripts, or AI agents, skillctrl provides a deterministic, headless CLI.
All commands support the --json global flag. When enabled, stdout is guaranteed to be exclusively parseable JSON.
skillctrl list
# View global installations across all supported IDEs
skillctrl list --global# Deploy to global IDE paths
skillctrl deploy global --skill tools/safe-bash-scripting --ide claude,cursor
# Deploy to a specific project workspace
skillctrl deploy project --skill development/writing-junit-tests --path /path/to/project --ide windsurf
### Import from GitHubskillctrl import owner/repo --yes
### Update Imported Skillsskillctrl update <ref>
### Global Optionsskillctrl --help
---
## 🔁 Configuration
If your own skills were moved to another path/repository, update `ownSkillsDir`:
skillctrl
---
## 📥 Import & Update from GitHub
From the interactive menu or via the CLI:
- **Import skill from GitHub**: accepts full GitHub URLs (`https://github.com/owner/repo`), short format (`github.com/owner/repo`), or owner/repo shorthand (`owner/repo`).
- **Check & update imported skills**: checks imported skills listed in `~/.skillctrl/skill-imports.json` against their GitHub source.
- **Delete skill(s)** opens the deletion submenu:
- **Delete imported skill(s)**: remove one, many, or all imported skills. This deletes both:
- imported local files under `~/.skillctrl/imported/`,
- matching entries in `~/.skillctrl/skill-imports.json`.
- **Delete globally installed skill(s)**: remove one, many, or all known skills from selected IDE global paths.
Imported skills are stored outside this repo:
- `~/.skillctrl/imported/{category}/{skill}/`
What an import does (and does not) do:
- It copies **only the skill folder** (`SKILL.md`, `references/`, `scripts/`, assets). Hooks, plugin manifests and project installers that some repositories ship alongside the skill (for example `npx impeccable install`) are not run or installed.
- Scripts keep their executable bit. The confirmation step lists the executable files, so review them before importing a repository you do not trust.
- When a source directory has no skill at the top, discovery looks for `SKILL.md` files up to 6 levels deep. Per-tool copies such as `.claude/skills/` and test fixtures are ignored unless nothing else is found; `.agents/skills`, `.curated`, `.system` and `.experimental` are always scanned. Same-named skills are shown with their repository path so you can pick the right build.
Optional token for higher GitHub API limits:export GITHUB_TOKEN="your_token"
---
## 🧩 IDE Compatibility Paths
See [IDE_COMPATIBILITY.md](./IDE_COMPATIBILITY.md).
---
## 🔗 References
- Format specification for Agent Skills: https://agentskills.io/specification.md
- Skill authoring best practices: https://platform.claude.com/docs/en/agents-and-tools/agent-skills/best-practices.md
- Validate skills tool: https://github.com/agentskills/agentskills/tree/main/skills-ref
- Skill creator: https://github.com/anthropics/skills/blob/main/skills/skill-creator/SKILL.md
- Agent skills tool: https://github.com/vercel-labs/skills~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.