Install
$ agentstack add mcp-sbroenne-skillpm ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
skillpm — npm-native package manager for Agent Skills
[](https://www.npmjs.com/package/skillpm) [](https://opensource.org/licenses/MIT) [](https://skillpm.dev)
The Agent Skills spec defines what a skill is, but not how to publish, install, version, or share it through npm. skillpm fills that gap.
skillpm keeps Agent Skills inside the normal npm model: package.json, node_modules, lockfiles, semver, and the npm registry.
For full project-wide agent configuration, use APM.
Quick start
# Install a skill (no global install needed)
npx skillpm install
# List installed skills
npx skillpm list
# Scaffold a new skill package
npx skillpm init
Or install the CLI globally:
npm install -g skillpm
> Note: Skills are always workspace-local. This installs the skillpm CLI — not skills.
How it works
When you run skillpm install :
- npm install — npm handles resolution, download, lockfile, and
node_modules/ - Scan — skillpm scans
node_modules/for packages containingskills/*/SKILL.md - Link — for each skill found, skillpm calls
skillsto wire it into supported agent directories
That is the whole scope: package, install, publish, and link reusable skills.
What skillpm adds
| The spec doesn't define... | skillpm adds... | |---|---| | A registry | Publish to npmjs.org with skillpm publish | | An install command | skillpm install resolves the skill dependency tree | | Dependency management | Standard package.json dependencies — npm handles semver, lockfiles, audit | | Versioning | npm semver, package-lock.json, reproducible installs | | Agent wiring | Links installed skills into agent directories via skills |
Commands
| Command | Description | |---|---| | skillpm install [skill...] | Install skill(s) + dependency tree, then wire them into agent dirs | | skillpm uninstall | Remove skill(s) | | skillpm list [--json] | List installed skill packages | | skillpm init | Scaffold a new skill package | | skillpm publish | Publish to npmjs.org (validates the Agent Skills spec) | | skillpm sync | Re-wire agent directories without reinstalling | | skillpm [args] | Any other command is passed through to npm |
Aliases: i/add for install, rm/remove for uninstall, ls for list.
Monorepo / npm workspace support
If your repo is an npm workspace monorepo where each skill is a first-party package, npm installs them as symlinks inside node_modules/.
node_modules/
@org/
my-skill → ../../skills/my-skill
skillpm sync (and skillpm install) detects these symlinks and treats them as workspace packages, so contributors can regenerate linked skills after editing local packages.
Creating a skill
mkdir my-skill && cd my-skill
skillpm init
See the full Creating Skills guide for package structure, SKILL.md format, dependencies, and publishing.
What are Agent Skills?
Agent Skills are modular, reusable packages of instructions, scripts, and resources that AI agents can dynamically load to extend their capabilities. They follow an open standard adopted by Claude, Codex, Cursor, Gemini CLI, Augment, and others.
Where APM fits
- Use
skillpmfor reusable npm-distributed skills. - Use APM for full project agent configuration.
Development
npm install
npm run build
npm test
npm run lint
License
MIT
Source & license
This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: sbroenne
- Source: sbroenne/skillpm
- License: MIT
- Homepage: https://skillpm.dev
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.