AgentStack
Browse Sign in
Browse Why AgentStack Sell Docs
Sign in
MCP verified MIT Self-run

Skillpm

mcp-sbroenne-skillpm · by sbroenne

Package manager for Agent Skills. Built on npm.

No reviews yet
0 installs
40 views
0.0% view→install

Install

$ agentstack add mcp-sbroenne-skillpm

✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • Prompt-injection patterns
  • Secret / credential exfiltration
  • Dangerous shell & filesystem operations
  • Untrusted network calls
  • Known-malicious package signatures

What it can access

  • Network access No
  • Filesystem access No
  • Shell / process execution No
  • Environment & secrets No
  • Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

View the full security report →

Verified badge

Passed review? Show it. Paste this badge into your README, it links to the public security report.

AgentStack Verified badge Links to your public security report.
[![AgentStack Verified](https://agentstack.voostack.com/badges/verified.svg)](https://agentstack.voostack.com/security/report/mcp-sbroenne-skillpm)

Reliability & compatibility

Security review passed
0 installs to date
no reviews yet
2mo ago

Declared compatibility

Claude CodeClaude DesktopCursorWindsurf

Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.

Preview Execution monitoring

We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.

How agent discovery & health will work →
Are you the author of Skillpm? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

skillpm — npm-native package manager for Agent Skills

[](https://www.npmjs.com/package/skillpm) [](https://opensource.org/licenses/MIT) [](https://skillpm.dev)

The Agent Skills spec defines what a skill is, but not how to publish, install, version, or share it through npm. skillpm fills that gap.

skillpm keeps Agent Skills inside the normal npm model: package.json, node_modules, lockfiles, semver, and the npm registry.

For full project-wide agent configuration, use APM.

Quick start

# Install a skill (no global install needed)
npx skillpm install 

# List installed skills
npx skillpm list

# Scaffold a new skill package
npx skillpm init

Or install the CLI globally:

npm install -g skillpm

> Note: Skills are always workspace-local. This installs the skillpm CLI — not skills.

How it works

When you run skillpm install :

  1. npm install — npm handles resolution, download, lockfile, and node_modules/
  2. Scan — skillpm scans node_modules/ for packages containing skills/*/SKILL.md
  3. Link — for each skill found, skillpm calls skills to wire it into supported agent directories

That is the whole scope: package, install, publish, and link reusable skills.

What skillpm adds

| The spec doesn't define... | skillpm adds... | |---|---| | A registry | Publish to npmjs.org with skillpm publish | | An install command | skillpm install resolves the skill dependency tree | | Dependency management | Standard package.json dependencies — npm handles semver, lockfiles, audit | | Versioning | npm semver, package-lock.json, reproducible installs | | Agent wiring | Links installed skills into agent directories via skills |

Commands

| Command | Description | |---|---| | skillpm install [skill...] | Install skill(s) + dependency tree, then wire them into agent dirs | | skillpm uninstall | Remove skill(s) | | skillpm list [--json] | List installed skill packages | | skillpm init | Scaffold a new skill package | | skillpm publish | Publish to npmjs.org (validates the Agent Skills spec) | | skillpm sync | Re-wire agent directories without reinstalling | | skillpm [args] | Any other command is passed through to npm |

Aliases: i/add for install, rm/remove for uninstall, ls for list.

Monorepo / npm workspace support

If your repo is an npm workspace monorepo where each skill is a first-party package, npm installs them as symlinks inside node_modules/.

node_modules/
  @org/
    my-skill → ../../skills/my-skill

skillpm sync (and skillpm install) detects these symlinks and treats them as workspace packages, so contributors can regenerate linked skills after editing local packages.

Creating a skill

mkdir my-skill && cd my-skill
skillpm init

See the full Creating Skills guide for package structure, SKILL.md format, dependencies, and publishing.

What are Agent Skills?

Agent Skills are modular, reusable packages of instructions, scripts, and resources that AI agents can dynamically load to extend their capabilities. They follow an open standard adopted by Claude, Codex, Cursor, Gemini CLI, Augment, and others.

Where APM fits

  • Use skillpm for reusable npm-distributed skills.
  • Use APM for full project agent configuration.

Development

npm install
npm run build
npm test
npm run lint

License

MIT

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet, be the first.

Versions

  • v0.1.0 Imported from the upstream source.