Skrills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Skrills (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
Aggregate score unchanged between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <img src="assets/icon.png" alt="Skrills Icon"> </p>
Write a skill once, use it everywhere. Skrills validates and syncs skills, commands, agents, MCP servers, and hooks across Claude Code, Codex CLI, GitHub Copilot CLI, and Cursor, all from a single Rust binary.
Install · User Guide · CLI Reference · FAQ · Changelog
macOS / Linux:
curl -LsSf https://raw.githubusercontent.com/athola/skrills/HEAD/scripts/install.sh | shWindows PowerShell:
powershell -ExecutionPolicy Bypass -NoLogo -NoProfile -Command ^
"Remove-Item alias:curl -ErrorAction SilentlyContinue; iwr https://raw.githubusercontent.com/athola/skrills/HEAD/scripts/install.ps1 -UseBasicParsing | iex"Or cargo install skrills. See the installation guide for HTTP transport and service setup.
Skrills handles the loop of writing skills and keeping every CLI current. The common jobs:
Make your Claude skills work everywhere. Codex and Copilot are strict about frontmatter, and Cursor uses its own rule format. Detect and fix the incompatibilities, then push to the other CLIs:
skrills validate --target both --autofix # fix missing/invalid frontmatter and body
skrills sync-all # mirror everything to all four CLIsKeep two environments in sync. Edit in one, mirror to another. File hashing preserves manual edits on both sides:
skrills sync-all --from cursor --to claudeTrim context-window cost. Surface your token-heaviest skills with reduction suggestions:
skrills analyze --min-tokens 1000 --suggestionsWatch what's loaded, live. cold-window continuously re-reads your plugins, skills, commands, and subagents, applying per-source token attribution and tiered alerts. Render it as a terminal TUI or a browser dashboard (or both):
skrills cold-window --tui # live TUI in this terminal (q / Ctrl-C to quit)
skrills cold-window --browser --port 8888 # same engine, browser dashboard at /dashboard
skrills cold-window --tui --demo # invented data that walks every alert tier, as in the GIFTo keep the TUI always-on in a Zellij pane, see Cold-Window: always-on in Zellij.
Skrills cold-window TUI
Let other tools call Skrills. The MCP server exposes its tools (validation, sync, intelligence, research, subagents) over stdio or HTTP:
skrills serve --http 127.0.0.1:3000 --openSee the quickstart tutorial for a full walkthrough and the CLI reference for every command, including skill lifecycle tools (skill-deprecate, skill-rollback, skill-import, skill-score, skill-catalog).
Skrills Demo
Skrills syncs eight asset types across four CLIs. Each cell reflects what the adapter reads or writes today:
| Asset | Claude Code | Codex CLI | Copilot CLI | Cursor |
|---|---|---|---|---|
| Skills | Y | Y | Y | Y |
| Commands | Y | Y | -- | Y |
| Agents | Y | -- | Y | Y |
| MCP Servers | Y | Y | Y | Y |
| Hooks | Y | -- | -- | Y |
| Instructions / Rules | Y | -- | Y | Y |
| Preferences | Y | Y | Y | -- |
| Plugin Assets | Y | -- | -- | Y |
A dash means that asset doesn't sync to that CLI, either because the CLI has no equivalent (Copilot CLI has no slash commands) or because the mapping isn't built yet (Cursor preferences). Plugin assets flow one way, from Claude Code to Cursor: the whole plugin tree is mirrored into Cursor's plugins/local/, carrying skill bodies and runtime scripts, and stale entries are pruned automatically. A sync in the other direction reports plugin assets as skipped. See the sync guide for details.
Validate skills on every pull request with the reusable GitHub Action:
- uses: athola/skrills/.github/actions/[email protected]
with:
targets: all
strict: true
path: skills/Persistent settings are in ~/.skrills/config.toml (precedence: CLI flags > environment variables > config file):
[serve]
auth_token = "your-secret-token"
tls_auto = true
cors_origins = "https://app.example.com"
allowed_hosts = "skrills.internal:8080" # needed when binding a non-loopback address
project_roots = ["~/src"] # project_dir a client may have analyzedSee security docs for TLS setup and the FAQ for environment variables.
| Resource | Description |
|---|---|
| User Guide | Primary documentation (mdBook) |
| CLI Reference | All commands with examples |
| Sync Guide | Cross-CLI sync workflows |
| MCP Tutorial | Server setup and tool reference |
| Architecture | Crate graph and runtime flow |
| Security | Auth, TLS, threat model |
| Changelog | Release history |
prompts at runtime.
versions.
create-skill) runs the claude or codexCLI found on PATH (override with SKRILLS_CLI_BINARY) and uses that CLI's own login. skrills reads no model API key for it. The API-backed subagent backends are separate and read SKRILLS_CLAUDE_API_KEY or SKRILLS_CODEX_API_KEY.
make lint test --quietBuilds on stable Rust. See the development guide and process guidelines. Update docs and tests with code. Report bugs with your OS, skrills --version, and logs (--trace-wire for MCP). For security, see the security policy.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.