# Skillpm

> Package manager for Agent Skills. Built on npm.

- **Type:** MCP server
- **Install:** `agentstack add mcp-sbroenne-skillpm`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [sbroenne](https://agentstack.voostack.com/s/sbroenne)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [sbroenne](https://github.com/sbroenne)
- **Source:** https://github.com/sbroenne/skillpm
- **Website:** https://skillpm.dev

## Install

```sh
agentstack add mcp-sbroenne-skillpm
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# skillpm — npm-native package manager for Agent Skills

[](https://www.npmjs.com/package/skillpm)
[](https://opensource.org/licenses/MIT)
[](https://skillpm.dev)

The [Agent Skills spec](https://agentskills.io) defines what a skill is, but not how to publish, install, version, or share it through npm. `skillpm` fills that gap.

**skillpm** keeps Agent Skills inside the normal npm model: `package.json`, `node_modules`, lockfiles, semver, and the npm registry.

For full project-wide agent configuration, use [APM](https://github.com/microsoft/apm).

## Quick start

```bash
# Install a skill (no global install needed)
npx skillpm install 

# List installed skills
npx skillpm list

# Scaffold a new skill package
npx skillpm init
```

Or install the CLI globally:

```bash
npm install -g skillpm
```

> **Note:** Skills are always workspace-local. This installs the `skillpm` CLI — not skills.

## How it works

When you run `skillpm install `:

1. **npm install** — npm handles resolution, download, lockfile, and `node_modules/`
2. **Scan** — skillpm scans `node_modules/` for packages containing `skills/*/SKILL.md`
3. **Link** — for each skill found, skillpm calls [`skills`](https://www.npmjs.com/package/skills) to wire it into supported agent directories

That is the whole scope: package, install, publish, and link reusable skills.

## What skillpm adds

| The spec doesn't define... | skillpm adds... |
|---|---|
| A registry | Publish to npmjs.org with `skillpm publish` |
| An install command | `skillpm install` resolves the skill dependency tree |
| Dependency management | Standard `package.json` `dependencies` — npm handles semver, lockfiles, audit |
| Versioning | npm semver, `package-lock.json`, reproducible installs |
| Agent wiring | Links installed skills into agent directories via [`skills`](https://www.npmjs.com/package/skills) |

## Commands

| Command | Description |
|---|---|
| `skillpm install [skill...]` | Install skill(s) + dependency tree, then wire them into agent dirs |
| `skillpm uninstall ` | Remove skill(s) |
| `skillpm list [--json]` | List installed skill packages |
| `skillpm init` | Scaffold a new skill package |
| `skillpm publish` | Publish to npmjs.org (validates the Agent Skills spec) |
| `skillpm sync` | Re-wire agent directories without reinstalling |
| `skillpm  [args]` | Any other command is passed through to npm |

Aliases: `i`/`add` for `install`, `rm`/`remove` for `uninstall`, `ls` for `list`.

## Monorepo / npm workspace support

If your repo is an **npm workspace monorepo** where each skill is a first-party package, npm installs them as symlinks inside `node_modules/`.

```text
node_modules/
  @org/
    my-skill → ../../skills/my-skill
```

`skillpm sync` (and `skillpm install`) detects these symlinks and treats them as workspace packages, so contributors can regenerate linked skills after editing local packages.

## Creating a skill

```bash
mkdir my-skill && cd my-skill
skillpm init
```

See the full [Creating Skills](https://skillpm.dev/creating-skills/) guide for package structure, SKILL.md format, dependencies, and publishing.

## What are Agent Skills?

Agent Skills are modular, reusable packages of instructions, scripts, and resources that AI agents can dynamically load to extend their capabilities. They follow an [open standard](https://agentskills.io) adopted by Claude, Codex, Cursor, Gemini CLI, Augment, and others.

## Where APM fits

- Use `skillpm` for reusable npm-distributed skills.
- Use [APM](https://github.com/microsoft/apm) for full project agent configuration.

## Development

```bash
npm install
npm run build
npm test
npm run lint
```

## License

MIT

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [sbroenne](https://github.com/sbroenne)
- **Source:** [sbroenne/skillpm](https://github.com/sbroenne/skillpm)
- **License:** MIT
- **Homepage:** https://skillpm.dev

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-sbroenne-skillpm
- Seller: https://agentstack.voostack.com/s/sbroenne
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.