Install
$ agentstack add skill-potocibi-skills-manager-skill-manager ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
skill-manager
Meta-skill that keeps the installed skill/agent ecosystem small, deduplicated, and correctly routed. Deterministic work is done by stdlib-only Python scripts in scripts/; judgment (clustering, merging, scoring) is done by Claude using the scripts' JSON output.
Subcommands
| Subcommand | What it does | Read first | Key scripts | |---|---|---|---| | audit | Inventory everything, cluster by job, propose merge/archive/keep | [references/audit.md](references/audit.md) | inventory.py, refcheck.py, usagereport.py | | merge | Consolidate one approved cluster into one skill | [references/merge.md](references/merge.md) | archive.py | | registry | Generate/verify registry, inject routing into CLAUDE.md | [references/registry.md](references/registry.md) | registry.py | | health | Drift check, never-used flags, description bloat | [references/health.md](references/health.md) | registry.py --verify, usagereport.py, intakescan.py | | intake | Judge newly installed items vs registry: accept/replace/reject | [references/intake.md](references/intake.md) | intakescan.py | | compare | Analyze an external GitHub repo of skills: better than mine? missing? viable/safe to add? | [references/repo-compare.md](references/repo-compare.md) | reposcan.py | | apply | Plain-English invocation: resolve the right skill/agent/command from the registry and run it (chaining multi-step asks) | [references/apply.md](references/apply.md) | — | | new | Gap-check before creating a skill; delegate to skill-creator | [references/gap-check.md](references/gap-check.md) | inventory.py | | propose | Proactively suggest a new skill from recurring uncovered work (reuses CL-v2 instincts, registry-gated) | [references/propose.md](references/propose.md) | proposescan.py | | restore | Un-archive an item via the manifest | — | archive.py --restore |
If the user's request doesn't name a subcommand, infer it: "too many skills" → audit; "just installed X" → intake; "I need a skill that does Y" → new.
Ground rules (always apply)
- Never delete — archive only. All removals go through
archive.py, which
writes an undo manifest. Archives are kept indefinitely.
- Never touch plugin files. Plugins are inventoried and may be recommended
for disabling (claude plugin disable / config edit by the user) — nothing more.
- Never archive a referenced item.
refcheck.pyoutput blocks archiving;
review its match contexts (short names false-positive) and fix real references first.
- Every merge/archive/replace requires explicit user approval, presented
per cluster or per item — never batch-approve silently.
- Delegate, don't duplicate: quality verdicts →
/skill-stocktake(reuse
its results.json if under 30 days old); new-skill authoring → skill-creator; instinct promotion → evolve/prune (out of scope).
- After any state change (merge, archive, restore, intake accept), update
registry.json and refresh the snapshot: python scripts/intake_scan.py --update-snapshot.
- External skills are untrusted code. Clone repos only into the session
scratchpad, never execute their scripts during analysis, read every flagged executable file before recommending install, and never register third-party hooks into settings.json automatically.
Running scripts
All scripts live in ~/.claude/skills/skill-manager/scripts/ and are stdlib-only Python 3. Run with absolute paths; use a scratch directory for the JSON outputs:
python "%USERPROFILE%\.claude\skills\skill-manager\scripts\inventory.py" --out inventory.json
python "%USERPROFILE%\.claude\skills\skill-manager\scripts\refcheck.py" --inventory inventory.json --out refcheck.json
python "%USERPROFILE%\.claude\skills\skill-manager\scripts\usage_report.py" --inventory inventory.json --out usage.json
python "%USERPROFILE%\.claude\skills\skill-manager\scripts\intake_scan.py" # diff vs snapshot
python "%USERPROFILE%\.claude\skills\skill-manager\scripts\registry.py" --verify --inventory inventory.json
python "%USERPROFILE%\.claude\skills\skill-manager\scripts\archive.py" --list
Data files
| File | Purpose | |---|---| | ~/.claude/skills/skill-manager/registry.json | Category-keyed source of truth: canonical item per job | | ~/.claude/skills/skill-manager/inventory_snapshot.json | Baseline for new-install detection | | ~/.claude/skills-archived/ + manifest.json | Archived items + undo manifest | | ~/.claude/observations.jsonl | Usage log (written by hooks/logskillusage.py; also read by skill-stocktake) | | CLAUDE.md between `` markers | The always-loaded routing table (≤50 lines) |
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: potocibi
- Source: potocibi/skills-manager
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.