# Ai Community Skills

> Skills for Claude Code, Codex, and Grok are scattered across dozens of GitHub repositories. ai-community-skills pulls them into one local catalog you can search, browse, and install from, with a risk check on every skill as a bonus.

- **Type:** MCP server
- **Install:** `agentstack add mcp-xm1k3-ai-community-skills`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [xm1k3](https://agentstack.voostack.com/s/xm1k3)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [xm1k3](https://github.com/xm1k3)
- **Source:** https://github.com/xm1k3/ai-community-skills
- **Website:** https://xm1k3.github.io/ai-community-skills/

## Install

```sh
agentstack add mcp-xm1k3-ai-community-skills
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

ai-community-skills

  All the community Agent Skills scattered across GitHub, in one local catalog. Search them, browse them, and install them into Claude Code, Codex, or Grok, with a risk check on every skill as a bonus.

  
  
  

  

- [Sources](#sources)
- Getting started
  - [Installation](#installation)
  - [Commands](#commands)
  - [Usage](#usage)
- [Web dashboard](#web-dashboard)
- [Risk analysis](#risk-analysis)
- Reference
  - [Config](#config)
  - [Updates](#updates)
- [Disclaimer](#disclaimer)
- [License](#license)

## Sources

The curated list of community repositories lives in [`config.json`](config.json) at the root of this repository. `acs init` downloads the latest version of that file and writes it to `~/.acs/config.json`, so a fresh install always starts from the current list (pass `--offline` to use the copy bundled with the package instead).

| Source | Repository | Enabled |
| --- | --- | --- |
| anthropic-skills | [anthropics/skills](https://github.com/anthropics/skills) | yes |
| superpowers | [obra/superpowers](https://github.com/obra/superpowers) | yes |
| composio-awesome-claude-skills | [ComposioHQ/awesome-claude-skills](https://github.com/ComposioHQ/awesome-claude-skills) | yes |
| sickn33-agentic-awesome-skills | [sickn33/agentic-awesome-skills](https://github.com/sickn33/agentic-awesome-skills) | yes |
| alirezarezvani-claude-skills | [alirezarezvani/claude-skills](https://github.com/alirezarezvani/claude-skills) | yes |
| behisecc-awesome-claude-skills | [BehiSecc/awesome-claude-skills](https://github.com/BehiSecc/awesome-claude-skills) | yes |
| travisvn-awesome-claude-skills | [travisvn/awesome-claude-skills](https://github.com/travisvn/awesome-claude-skills) | yes |
| humanlayer-skills | [humanlayer/skills](https://github.com/humanlayer/skills) | yes |
| mattpocock-skills | [mattpocock/skills](https://github.com/mattpocock/skills) | yes |
| k-dense-scientific-agent-skills | [K-Dense-AI/scientific-agent-skills](https://github.com/K-Dense-AI/scientific-agent-skills) | yes |

Know a good repository of skills that is missing? Open a pull request that adds it to `config.json`:

```json
{ "name": "owner-repo", "repo": "https://github.com/owner/repo", "enabled": true }
```

`name` is the folder the repository is cloned into and the label used everywhere in the catalog, `repo` accepts https URLs, `owner/name` GitHub shorthand, ssh URLs, or local `file://` URLs. `trust` (0-100, default 50) says how much the copy from that repository should win when the same skill exists in more than one source.

## Installation

```
npm install -g ai-community-skills
```

Or run it without installing anything:

```
npx ai-community-skills init
```

The binary is available as `ai-community-skills` and as the short alias `acs`. Node.js 20 or newer and `git` on PATH are required. After installing, run `acs init` to write the default config to `~/.acs/config.json`, then `acs sync` to build the catalog.

## Commands

| Command | Description |
| --- | --- |
| `acs init` | Download the curated source list and write `~/.acs/config.json`. `--offline` uses the bundled copy. |
| `acs sync` | Clone or update every enabled source and rebuild the index. |
| `acs list` | List indexed skills with filters for category, risk, source, and findings. |
| `acs search ` | Search skills by name, description, category, and tags. |
| `acs info ` | Full metadata, risk flags, findings, source reputation, and install state. |
| `acs validate [skill]` | Check frontmatter, referenced paths, and description quality. |
| `acs install ` | Install a skill after a risk summary and a confirmation. |
| `acs uninstall ` | Remove an installed skill. |
| `acs dedupe` | Remove duplicate copies of the same skill across sources. |
| `acs stats` | Counts by category, source, risk level, and finding. |
| `acs export-awesome-list` | Generate an awesome-list style markdown file from the catalog. |
| `acs ui` | Start the local web dashboard on port 8080. |

Every command that writes to disk has a `--dry-run` flag or asks for confirmation unless `--yes` is passed. Run `acs  --help` for the full list of flags.

## Usage

Build the catalog:

```
$ acs sync
Syncing anthropic-skills (https://github.com/anthropics/skills) ... updated, 19 skills indexed, 1 skipped
Syncing superpowers (https://github.com/obra/superpowers) ... unchanged, 14 skills kept
...
Index rebuilt with 3315 skills from 5 source(s).
```

A source whose repository did not change since the last sync keeps its index entries instead of being rescanned, so a routine sync takes a few seconds. The index is rebuilt anyway after upgrading acs, or on demand with `acs sync --force`.

Search and inspect:

```
$ acs search "frontend design"
$ acs info frontend-design
```

Install into Claude Code (personal scope, `~/.claude/skills/`), into the current project, into Codex, or into Grok Build:

```
$ acs install frontend-design
$ acs install frontend-design --project
$ acs install frontend-design --target codex
$ acs install frontend-design --target grok
$ acs install frontend-design --target web
```

`--target web` produces a zip in `./acs-exports/` for manual upload to claude.ai. When a skill name exists in more than one source, add `--source `. Installed copies are never updated automatically: `acs sync` warns when the upstream copy changed, and you decide whether to reinstall.

## Web dashboard

```
acs ui
```

Opens a local dashboard on http://127.0.0.1:8080 with the same catalog: search and filters, skill pages with rendered SKILL.md and a file browser, every risk finding with a link to the exact line, favorites and groups that can be installed in one go and shared as JSON, source management with a trust level per repository, and duplicate cleanup. Every view has a shareable URL.

  

  

  

## Risk analysis

Every skill is analyzed statically, nothing found in a skill is ever executed. Each entry records whether it ships scripts, references network calls, contains destructive operations and whether they are paired with a confirmation, uses Claude Code specific frontmatter, contains prompt injection patterns, or references secrets and credential files. The result is a `low`, `medium`, or `high` risk level plus the list of findings, each with file, line, and excerpt, so you can judge false positives yourself before installing.

Duplicates across sources are detected with a normalized content hash that ignores catalog metadata and whitespace, and the copy from the most trusted source is kept.

## Config

Your local `~/.acs/config.json` is yours to edit, from the file or from the Sources page of the dashboard:

```json
{
  "sources": [
    { "name": "anthropic-skills", "repo": "https://github.com/anthropics/skills", "enabled": true, "trust": 100 },
    ...
  ],
  "dedupeAfterSync": true
}
```

All data lives under `~/.acs/` (config, index, install records, favorites and groups, cloned sources). Set `ACS_HOME` to use a different directory.

## Updates

Once a day (once an hour while `acs ui` is running) acs asks the npm registry for the latest published version. When a newer one exists, every command prints a short notice on stderr and the dashboard footer shows an upgrade button with the command to run:

```
npm install -g ai-community-skills@latest
```

The check never blocks a command for more than a moment, the result is cached in `~/.acs/update-check.json`, and nothing else is sent. Set `ACS_NO_UPDATE_CHECK=1` to turn it off.

## Disclaimer

Skills are community content pulled from third-party repositories. The risk analysis is heuristic and static: it will produce false positives and can miss real problems. Read a skill before installing it, especially anything rated high. The author is not responsible for what an installed skill does in your environment.

## License

ai-community-skills is distributed under the MIT License.

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [xm1k3](https://github.com/xm1k3)
- **Source:** [xm1k3/ai-community-skills](https://github.com/xm1k3/ai-community-skills)
- **License:** MIT
- **Homepage:** https://xm1k3.github.io/ai-community-skills/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-xm1k3-ai-community-skills
- Seller: https://agentstack.voostack.com/s/xm1k3
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.