Skill-kits CLI
A Rust tool with its own window: scans Codex, Claude Code and Gemini CLI skills, checks risks and enables or disables them
- 202 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Renames `SKILL.md` files and copies skills into projects, and with `--overwrite` and `--force` overwrites and removes copies
- Reads the skill directories of all agents and writes data to `~/.skill-kits/`
Install
- Works in
Manual install
cargo install --path .From the cloned repository folder, needs Rust 1.80 or newer. A trial run without installing: `cargo run -- scan`.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Renames `SKILL.md` files and copies skills into projects, and with `--overwrite` and `--force` overwrites and removes copies
- Reads the skill directories of all agents and writes data to `~/.skill-kits/`
This is third-party code. Review the repository files before installing.
What it does
Skill-kits is a single Rust binary with a command line and a graphical window on a shared core. It scans the directories agents really read: `~/.codex/skills`, `~/.claude/skills`, `~/.gemini/skills` and project-level `.agents/skills`, `.claude/skills`, `.gemini/skills`. Found skills are split into agent-native, project-level, Codex plugin cache and vendor read-only ones. A skill is toggled reversibly: `SKILL.md` is renamed to `SKILL.md.disabled` and the folder is never deleted. For projects the tool adopts existing skills under management, copies them into a chosen project and agent and notices drift between copies as well as outdated and missing sources. For Codex it shows plugins and their capabilities through `skill-kits plugin list` and `skill-kits list --kind runtime-capability`. The built-in scan flags risky lines in skills: `curl | sh`, `rm -rf`, `sudo`, access to tokens and keys, network downloads.
Who it is for. People whose skills are scattered across several agents and projects and who want to see which ones an agent actually reads and what can safely be done with them.
Good fit when
- Skills sit in `~/.codex/skills`, `~/.claude/skills` and projects and it is unclear which ones the agent reads
- A skill has to be disabled without deleting its folder: renaming to `SKILL.md.disabled` is reversible
- A project copy of a skill drifted from the managed one and you need to find the difference and decide to overwrite or accept
- Before installing someone else's skill you want a quick look at lines like `curl | sh` and token access
Not a fit when
- You want a cloud skill catalog: the tool is local and moves nothing to the cloud
- Skills have to sync globally across agents: version 0.1 has no global sync
- You need a security guarantee for a skill: the scan is advisory and does not block installation
- There is no Rust 1.80 or newer: no prebuilt package yet, so it builds from source
Example request
Scan the skills of all agents on this machine with skill-kits and show which ones contain curl | sh or token accessLimitations
- Version 0.1: there is no prebuilt package, and a macOS arm64 build is on the roadmap. For now it installs from source with `cargo install --path .` on Rust 1.80 or newer.
- The window targets macOS first, while the command line works without it.
- The risk scan is advisory. It does not replace your judgment and does not stop installation.
- Version 0.1 has no global skill sync across agents, and the README is in Chinese.
How to disable. Remove the binary with `cargo uninstall skill-kits`. Configuration, registry and managed copies live in `~/.skill-kits/` and are deleted by hand. Skills disabled by the tool come back by renaming `SKILL.md.disabled` to `SKILL.md`.
FAQ
How do I install Skill-kits?
You need Rust 1.80 or newer. Clone the repository and run `cargo install --path .`, then `skill-kits status` and `skill-kits scan`. `skill-kits --gui` opens the window.
How do I disable a skill without deleting it?
With `skill-kits disable <skill>`: `SKILL.md` becomes `SKILL.md.disabled`. Enabling restores the name. If both files exist or neither does, the tool marks the state invalid and does nothing.
What does the risk scanner check?
Lines in skill docs and shell files: `curl | sh`, `wget | sh`, `rm -rf`, `sudo`, `chmod +x`, access to tokens, keys and environment variables, network downloads and unknown binaries.
Where does the tool store its data?
In `~/.skill-kits/`: `config.toml`, the registry, managed skill copies, cache and locks. The index is only a cache and the real state comes from disk.
Which agents are supported?
Codex, Claude Code, Gemini CLI and a custom agent with paths in the settings. For each, the tool knows the global and project skill directories.
Discussion
No questions or reviews yet.
Related
CLI toolsA Go terminal UI for agent skills: list, check, update and find new ones in a single window
A desktop app and CLI to install, sync and organize agent skills across Claude Code, Codex, Cursor and other tools
Meta Skill (ms)
Meta Skill
Meta Skill (ms) keeps skills locally in SQLite and Git, searches them with a hybrid index and serves agents over MCP
A command-line skill manager: installs skills from a marketplace, GitHub, private Git and npm into 45 agents' folders and scans them first
The command-line client of the skilld.dev registry that installs agent skills into a project and tracks their changes
A universal loader for Anthropic-format skills (SKILL.md) in any coding agent: install, sync and load on demand
README in short
The README starts with the question of which scattered skills an agent really reads. Then come the features: the Agent Space index, safe enabling and disabling, project operations, Codex plugins with capabilities, the risk scan and the window. It ends with a quick start, a command list, data storage, a roadmap and contribution needs.