AgentStack
Browse Sign in
Browse Why AgentStack Sell Docs
Sign in
SKILL verified MIT Self-run

Skillpm

skill-sbroenne-skillpm-skillpm · by sbroenne

Manage npm-distributed Agent Skill packages with skillpm.

No reviews yet
0 installs
35 views
0.0% view→install

Install

$ agentstack add skill-sbroenne-skillpm-skillpm

✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • Prompt-injection patterns
  • Secret / credential exfiltration
  • Dangerous shell & filesystem operations
  • Untrusted network calls
  • Known-malicious package signatures

What it can access

  • Network access No
  • Filesystem access No
  • Shell / process execution No
  • Environment & secrets No
  • Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

View the full security report →

Verified badge

Passed review? Show it. Paste this badge into your README, it links to the public security report.

AgentStack Verified badge Links to your public security report.
[![AgentStack Verified](https://agentstack.voostack.com/badges/verified.svg)](https://agentstack.voostack.com/security/report/skill-sbroenne-skillpm-skillpm)

Reliability & compatibility

Security review passed
0 installs to date
no reviews yet
2mo ago

Declared compatibility

Claude CodeClaude Desktop

Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.

Preview Execution monitoring

We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.

How agent discovery & health will work →
Are you the author of Skillpm? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

skillpm — Agent Skill Package Manager

When to use this skill

Use this skill when the user wants to:

  • Install, uninstall, or update Agent Skill packages
  • Create a new Agent Skill package
  • Publish an Agent Skill to npmjs.org
  • List installed skills
  • Re-wire agent directories after dependency or workspace changes

Key concepts

  • skillpm wraps npm. Skills live in package.json, node_modules, and package-lock.json like any other npm package.
  • One skill per npm package. The skill itself lives in skills//SKILL.md inside the package.
  • Agent directory wiring. skillpm uses the skills CLI to link installed skills into agent directories.
  • Focused scope. skillpm manages reusable npm-distributed skills. For full project configuration, point users to APM.

Commands

All commands can be run without global install via npx skillpm .

Install a skill

npx skillpm install 
# Aliases: skillpm i, skillpm add

This runs npm install, scans node_modules/ for skill packages, and links them into agent directories.

Install all dependencies

npx skillpm install

Reads package.json, installs all dependencies, and wires discovered skills.

Uninstall a skill

npx skillpm uninstall 
# Aliases: skillpm rm, skillpm remove

List installed skills

npx skillpm list
npx skillpm list --json

Shows installed skill packages with descriptions. Use --json for scripting.

Scaffold a new skill

npx skillpm init

Creates package.json (with "agent-skill" in keywords) and skills//SKILL.md in the current directory.

Publish a skill

npx skillpm publish

Validates the package structure and SKILL.md against the Agent Skills spec (via skills-ref validate), then delegates to npm publish.

Re-wire agent directories

npx skillpm sync

Re-scans node_modules/ and re-links all skills into agent directories without reinstalling.

npm passthrough

Any command not handled by skillpm is passed through to npm:

npx skillpm outdated
npx skillpm audit
npx skillpm update
npx skillpm why 

Creating a skill package

Package structure

my-skill/
├── package.json                 # keywords: ["agent-skill"], dependencies
├── README.md
├── LICENSE
└── skills/
    └── my-skill/
        ├── SKILL.md
        ├── scripts/
        ├── references/
        └── assets/

package.json for a skill

{
  "name": "my-skill",
  "version": "1.0.0",
  "keywords": ["agent-skill"],
  "repository": {
    "type": "git",
    "url": "git+https://github.com/acme/my-skill.git"
  },
  "dependencies": {
    "other-skill": "^1.0.0"
  }
}
  • Skill dependencies go in standard dependencies.
  • The "agent-skill" keyword is required for publishing.
  • Use git+https:// for repository.url.

Scaffold from scratch

mkdir my-skill && cd my-skill
npx skillpm init
npx skillpm publish

Wrap an existing skill for npm

If you already have skills//SKILL.md, add a package.json to make it publishable:

cd my-existing-skill/
npm init -y

Then edit package.json to add the required keyword:

{
  "name": "my-existing-skill",
  "version": "1.0.0",
  "keywords": ["agent-skill"]
}

Where APM fits

Use skillpm for reusable npm-distributed skills.

Use APM for full project agent configuration.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet, be the first.

Versions

  • v0.1.0 Imported from the upstream source.