CLI package manager for Claude AI agent skills
SaferSkills independently audited agentkit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A package manager for Claude AI skills. Share and manage custom AI capabilities—without copy-paste.
Your team builds custom Claude skills: code reviewers, testing agents, documentation generators, etc. Right now, sharing these across projects is a mess:
AgentKit is like npm for Claude skills. Define your skills once, share via GitHub, install anywhere.
# Team builds a code review skill
agk add your-org/code-review
# Everyone installs the same version
agk install
# Update one place, everyone gets the fix
agk updateThat's it. Lock files ensure reproducibility. Semantic versioning prevents breaking changes.
| Problem | AgentKit Solution |
|---|---|
| Skills scattered across projects | Single source of truth on GitHub |
| Manual version management | Semantic versioning + lock files |
| No way to share skills with teammates | One command: agk add org/repo |
| Uncertain what versions are used | Lock file pins exact versions |
| Hard to update skills safely | Update once, control versions carefully |
npm install -g @fagom174/agentkitOr use directly:
npx @fagom174/agentkit <command>agk init -yCreates an agentkit.json:
{
"name": "my-project",
"version": "1.0.0",
"skills": {}
}agk add your-org/code-review
agk add your-org/testing-agentAgentKit downloads the skills and creates agentkit-lock.json with exact versions.
Commit both files. Team members run:
agk installEveryone gets the exact same versions in .claude/skills/. 🎉
Your team's code review skill lives at github.com/your-org/code-review:
# You: Build and publish the skill
git push your-org/code-review
# Teammate: Install in seconds
agk add your-org/code-review
# New team member: Get everything set up
agk installNo documentation needed. Everyone's in sync with Claude Code.
agk init # Start a new project
agk add <org/repo> # Add a skill
agk add <org/repo> --skill <name> # Add from multi-skill repo
agk install # Install all skills
agk update # Update to latest versions
agk remove <org/repo> # Remove a skill
agk list # Show installed skills
agk clean # Refresh cacheagentkit.json — Your manifest (like package.json)
{
"name": "my-project",
"skills": {
"your-org/code-review": "^1.2.0",
"your-org/testing-agent": "^2.0.0"
}
}agentkit-lock.json — Exact versions (like package-lock.json)
{
"skills": {
"your-org/code-review": {
"version": "1.2.3",
"resolved": "github:your-org/code-review#v1.2.3"
}
}
}Skills are synced to .claude/skills/ where Claude Code automatically discovers them.
Create a GitHub repo with your skill:
my-code-review-skill/
├── README.md
├── SKILL.md (skill prompt/definition)
└── tools.js (optional: tools for the skill)Push to GitHub. Done. Others can install with:
agk add your-org/my-code-review-skillIf you have multiple skills in one repo:
my-skills/
├── skills/
│ ├── code-review/
│ │ ├── SKILL.md
│ │ └── tools.js
│ └── testing-agent/
│ └── SKILL.md
└── README.mdInstall specific skills:
agk add your-org/my-skills --skill code-review
agk add your-org/my-skills --skill testing-agentAgentKit uses semantic versioning:
{
"skills": {
"org/skill": "^1.0.0", // Allow 1.x.x, not 2.x.x
"org/skill": "~1.2.0", // Allow 1.2.x, not 1.3.x
"org/skill": "1.0.0", // Exact version only
"org/skill": "*" // Any version
}
}Update safely:
agk update # Updates to latest compatible versions
agk install # Installs exactly what's in lock fileBy default, AgentKit uses GitHub's public API (60 requests/hour per IP).
For higher limits, set a personal access token:
export GITHUB_TOKEN=ghp_xxxxxxxxxxxx
agk add org/repoA simple repository containing one skill:
my-skill/
├── README.md
├── SKILL.md (skill definition/prompt)
└── tools.js (optional: tool definitions)A repository with multiple skills in subdirectories:
my-skills/
├── skills/
│ ├── skill-1/
│ │ └── SKILL.md
│ └── skill-2/
│ └── SKILL.md
└── README.mdMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.