SkillMD CLI
CLI and MCP tools for finding and installing skills, with SKILL.md linting and flags for network use, scripts and secrets
- 142 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Installation writes files to the shared skills directory and links them to selected agents
- Search and skill details go to the external skillmd.com registry
- A skill from the registry enters the agent's context, and the scanner only describes its capabilities
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/skillmdDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Installation writes files to the shared skills directory and links them to selected agents
- Search and skill details go to the external skillmd.com registry
- A skill from the registry enters the agent's context, and the scanner only describes its capabilities
This is third-party code. Review the repository files before installing.
What it does
SkillMD is the open toolchain around the skillmd.com registry. One npm package, skillmds, provides two executables: the skillmd command-line program and the skillmds MCP server. skillmd lint checks SKILL.md files, gives a quality score from 0 to 100 and fixes mechanical errors with --fix. skillmd scan flags actions described in the skill: run scripts, use the network or read secrets. skillmd add installs a skill from the registry, a GitHub repository or a local folder. It runs the linter first and never executes scripts itself. The program supports Claude Code, Cursor, Codex and other agent directories. It stores skills in .agents/skills and links them to selected clients. There are also search, list, update, remove, init for a new skill template and publish for publishing to skillmd.com. The MCP server gives an agent the tools skillmd_search, skillmd_get, skillmd_install, skillmd_trending, skillmd_recommend, skillmd_list_saved and skillmd_lint. It runs locally through npx or remotely at https://api.skillmd.com/mcp. The repository also holds the @skillmds/core engine, a GitHub Action that checks skills in CI and bundles of plugins.
Who it is for. For skill authors who need a check before publishing and for people who install other people's skills and want to know in advance what they do.
Good fit when
- You write your own SKILL.md and want a score, a list of findings and automatic fixes before publishing
- Before installing someone else's skill you want to see whether it runs scripts, uses the network or reads tokens
- You need to put one skill into every agent installed on the machine with skillmd add
- You want to check skills in a repository on every pull request and see results in GitHub Code Scanning
- You want to search for and install skills from a chat with the agent through MCP
Not a fit when
- You need a self-hosted corporate registry: SkillMD works around the public skillmd.com
- You need a full security audit: the scanner classifies a skill's capabilities and does not replace reading the code
- You do not want search queries to leave for an external server: search and details go through the registry
Example request
Check the ./my-skill folder with skillmd lint and show what the skill does from the skillmd scan resultLimitations
Node.js 18 or later and npm are required. Linting and scanning analyze local files, but search and download contact skillmd.com. Publishing sends skill sources to the registry and requires authentication. Saved MCP collections use SKILLMD_TOKEN; do not pass the secret as a command-line argument.
Scanner flags describe detected capabilities, not author intent. They do not replace reading the instructions and code. An installed skill later influences the agent and may request command execution. MIT covers the local tool; the registry operator controls its availability and terms.
How to disable. Skills installed with skillmd add are removed with skillmd remove. The program itself is removed with npm uninstall -g skillmds. Remove the MCP server with claude mcp remove skillmd or by deleting its entry from the client configuration.
FAQ
How do I connect the SkillMD MCP server to Claude Code?
Run claude mcp add skillmd -- npx -y skillmds. For Claude Desktop, Cursor, VS Code and Windsurf add an mcpServers entry with the npx command and the arguments -y and skillmds. There is also a hosted option at https://api.skillmd.com/mcp with no install.
Does skillmd add execute a skill's scripts?
The installer is documented as copying files after linting and checksum verification. That does not guarantee the safety of the agent later following those instructions. Use `--deny executes_scripts` to filter skills with detected script-execution capabilities.
What is a plugin in SkillMD terms?
A bundle of skills installed with one command, for example npx skillmds add plugin:skillmd/design. In Claude Code it becomes a real plugin that you enable and remove as a whole; in other agents the skills are installed individually.
How do I check skills in CI?
Use the GitHub Action skillmds/skillmd/action@v1, or run skillmd lint . --format sarif and upload the file to GitHub Code Scanning. The --strict flag turns warnings into errors.
What do the scanner flags show?
Five classes: docs_only for skills with no executable code, network_calls for network access, executes_scripts for running commands and scripts, reads_secrets for touching environment variables, tokens and credential files, and untrusted_install for fetch-and-execute from a nonstandard source.
Discussion
No questions or reviews yet.
Related
CLI toolsOver 1,100 ready-made skills for Claude Code, Codex, Gemini CLI and Cursor, plus an MCP server that picks a skill for the task
skill-creator: skills from OpenAPI, GraphQL and MCP
@asnd/skill-creator
The /skill-creator command turns a link to an OpenAPI spec, GraphQL schema or MCP server into a ready skill with wrappers.
Tech Leads Club Agent Skills
Agent Skills
A vetted skill registry with a CLI that installs into twenty-plus agents and an MCP server for on-demand skill lookup
Dozens of mizchi's agent skills: frontend audits, AWS, Cloudflare, SQL, Playwright and OpenTelemetry, installed one by one
skills-npm links agent skills shipped in your dependencies in node_modules and listed in the skills field of package.json
dotnet-skills: a skill installer for .NET
dotnet-skills
An installer for a .NET skill catalog that picks skills from project files for Claude Code, Codex, Copilot and Gemini CLI
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| SkillMD (this card) | no | 142 | |
| SkillSpector | no | 24,656 | NVIDIA's security scanner for skills and MCP, looking for prompt injections and data leaks |
| SkillHub (iFlytek) | no | 5,375 | a self-hosted corporate skill registry with publishing and versions |
README in short
The analysis engine is available as a separate package for integration into other tools. A GitHub Action and SARIF output support repository checks and GitHub Code Scanning.