Install
$ agentstack add skill-sbroenne-skillpm-skillpm ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
skillpm — Agent Skill Package Manager
When to use this skill
Use this skill when the user wants to:
- Install, uninstall, or update Agent Skill packages
- Create a new Agent Skill package
- Publish an Agent Skill to npmjs.org
- List installed skills
- Re-wire agent directories after dependency or workspace changes
Key concepts
- skillpm wraps npm. Skills live in
package.json,node_modules, andpackage-lock.jsonlike any other npm package. - One skill per npm package. The skill itself lives in
skills//SKILL.mdinside the package. - Agent directory wiring. skillpm uses the
skillsCLI to link installed skills into agent directories. - Focused scope. skillpm manages reusable npm-distributed skills. For full project configuration, point users to APM.
Commands
All commands can be run without global install via npx skillpm .
Install a skill
npx skillpm install
# Aliases: skillpm i, skillpm add
This runs npm install, scans node_modules/ for skill packages, and links them into agent directories.
Install all dependencies
npx skillpm install
Reads package.json, installs all dependencies, and wires discovered skills.
Uninstall a skill
npx skillpm uninstall
# Aliases: skillpm rm, skillpm remove
List installed skills
npx skillpm list
npx skillpm list --json
Shows installed skill packages with descriptions. Use --json for scripting.
Scaffold a new skill
npx skillpm init
Creates package.json (with "agent-skill" in keywords) and skills//SKILL.md in the current directory.
Publish a skill
npx skillpm publish
Validates the package structure and SKILL.md against the Agent Skills spec (via skills-ref validate), then delegates to npm publish.
Re-wire agent directories
npx skillpm sync
Re-scans node_modules/ and re-links all skills into agent directories without reinstalling.
npm passthrough
Any command not handled by skillpm is passed through to npm:
npx skillpm outdated
npx skillpm audit
npx skillpm update
npx skillpm why
Creating a skill package
Package structure
my-skill/
├── package.json # keywords: ["agent-skill"], dependencies
├── README.md
├── LICENSE
└── skills/
└── my-skill/
├── SKILL.md
├── scripts/
├── references/
└── assets/
package.json for a skill
{
"name": "my-skill",
"version": "1.0.0",
"keywords": ["agent-skill"],
"repository": {
"type": "git",
"url": "git+https://github.com/acme/my-skill.git"
},
"dependencies": {
"other-skill": "^1.0.0"
}
}
- Skill dependencies go in standard
dependencies. - The
"agent-skill"keyword is required for publishing. - Use
git+https://forrepository.url.
Scaffold from scratch
mkdir my-skill && cd my-skill
npx skillpm init
npx skillpm publish
Wrap an existing skill for npm
If you already have skills//SKILL.md, add a package.json to make it publishable:
cd my-existing-skill/
npm init -y
Then edit package.json to add the required keyword:
{
"name": "my-existing-skill",
"version": "1.0.0",
"keywords": ["agent-skill"]
}
Where APM fits
Use skillpm for reusable npm-distributed skills.
Use APM for full project agent configuration.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: sbroenne
- Source: sbroenne/skillpm
- License: MIT
- Homepage: https://skillpm.dev
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.