Skillmd

Name: Skillmd
Author: skillmds

by skillmdsversion 1.2.0i★ –iComputer or cloud

Registry namecom.skillmd/skillmd

Install

Overview

Description from the maker (original English)

Search, fetch, lint, and install Agent Skills (SKILL.md) from the SkillMD registry.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Computer or cloud
Transport: stdio, Streamable HTTP
Category: Search & AI memory
You need to fill in: SKILLMD_TOKEN

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on the maker’s server: what you ask it goes through their server.
You fill in yourself: SKILLMD_TOKEN, SKILLMD_API

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

Runs in the cloudNothing to install; it connects over the internet
npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Works in Claude on the web, desktop and mobile:

Open Settings → Connectors
Press Add custom connector
Paste the address below and press Add
If it asks you to sign in, sign in with the maker

https://api.skillmd.com/mcp

Or run it on your computer

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "skillmd": {
      "command": "npx",
      "args": [
        "-y",
        "skillmds"
      ],
      "env": {
        "SKILLMD_TOKEN": "your-value",
        "SKILLMD_API": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add --transport http skillmd https://api.skillmd.com/mcp

Or run it on your computer

claude mcp add skillmd --env SKILLMD_TOKEN=your-value --env SKILLMD_API=your-value -- npx -y skillmds

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "skillmd": {
      "url": "https://api.skillmd.com/mcp"
    }
  }
}

Or run it on your computer

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "skillmd": {
      "command": "npx",
      "args": [
        "-y",
        "skillmds"
      ],
      "env": {
        "SKILLMD_TOKEN": "your-value",
        "SKILLMD_API": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "skillmd": {
      "type": "http",
      "url": "https://api.skillmd.com/mcp"
    }
  }
}

Or run it on your computer

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "skillmd": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "skillmds"
      ],
      "env": {
        "SKILLMD_TOKEN": "your-value",
        "SKILLMD_API": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

ChatGPT connects only to servers on the internet:

Open ChatGPT on the web → Settings → Connectors (Apps)
Press Create or Add (some plans need Developer mode under Advanced first)
Paste the address below, give it a name and save
If it asks you to sign in, sign in with the maker

https://api.skillmd.com/mcp

Menu names can differ slightly by plan and over time.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

SKILLMD_TOKEN secret env
SkillMD personal access token (enables skillmd_list_saved and personalized recommendations)
SKILLMD_API env
Override the registry API base URL

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

We have not read this server’s tool list yet; we check endpoints in rotation.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 6, 2026

✓ Pass
Maker matches the repo
The registry name was verified against the domain skillmd.com (the registry checks domain ownership)
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
… Not checked yet
Endpoint responds
Not checked yet; we check endpoints in rotation
… Not checked yet
Sign-in with OAuth
Not checked yet; we check endpoints in rotation
… Not checked yet
No hidden instructions in tool descriptions
Not checked yet; we read the tool list when we check the endpoint

Compared with others in Search & AI memoryi

More stars than 0% of the other 7220 servers in this category
Published to the registry more recently than 42% of the other 7220 servers in this category
Basic checks equal to or better than 100% of the other 7220 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Skillmd safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: SKILLMD_TOKEN

Does it run on my computer or in the cloud?

Either way works: install it on your computer or connect to the cloud version.

Is it still maintained?

The GitHub repo last changed –, and the latest version (1.2.0) reached the registry 2 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: Context7, Codebase Memory, Exa

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Context7

by upstash

Feeds AI the latest docs for libraries and frameworks before it answers, so code it writes does not use outdated, removed functions.

Computer or cloud★ 64,224MITUpdated 3 days ago

Install

Codebase Memory

by DeusData

Codebase knowledge graph for AI agents — 162 languages, sub-ms queries, 99% fewer tokens.

Runs on your computer★ 48,148MITUpdated 20 days ago

Install

Exa

by exa-labs

Connect AI agents to Exa for web search, content fetching, and multi-step research.

Runs in the cloud★ 5,213MITUpdated 44 days ago

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

SkillMD

The registry that lints.

Search, install, lint and publish Agent Skills ( SKILL.md ) for Claude Code, Cursor, Codex and 60+ other agents.

This repo is the open-source toolchain behind skillmd.com : the CLI, the MCP server, the GitHub Action and the SKILL.md engine they share.

Browse skills · Categories · Publishers · Install guides · Docs · Blog · Stats

What this is

An Agent Skill is a folder with a SKILL.md file: YAML frontmatter (name, description) plus Markdown instructions an agent loads on demand. Claude Code, Cursor, Codex, Gemini CLI, GitHub Copilot, Windsurf and dozens of other agents read the same format, which is what makes a shared registry worth having. If the format is new to you, start with What is an Agent Skill? and the anatomy of a SKILL.md file.

[skillmd.com](https://skillmd.com) is the open registry of those skills: 1,000,000+ skills from 30,000+ publishers, every one of them linted against the format, security-scanned for what it can do, and pinned to a commit. Verdicts, capability flags and independent scanner results sit on every skill page. Installing writes files and does nothing else.

This repository is everything that runs on your machine or in your CI, MIT-licensed:

Package	What it is	Install
`skillmds`	One npm package, two binaries: the `skillmd` CLI and the `skillmds` MCP server	`npm i -g skillmds`
`@skillmds/core`	The SKILL.md engine: parser, lint rules, security scanner, quality score, SARIF / JSON / GitHub formatters	`npm i @skillmds/core`
`skillmds/skillmd/action`	GitHub Action: lint every skill in a repo, results in GitHub Code Scanning	`uses: skillmds/skillmd/action@v1`

The registry applies the same engine, so a skill that passes locally passes on publish.

Quick start

# Search the registry and install a skill into every agent on your machine

npx skillmds search "pdf" npx skillmds add anthropic/pdf

Lint your own skill before you share it

npx skillmds lint ./my-skill

Plugins

A plugin is a bundle of skills that installs as one unit. In Claude Code it becomes a real plugin — /plugin lists it, and enable, disable and uninstall work on the whole set — and on every other agent the skills are installed individually.

npx skillmds add plugin:skillmd/design

To browse them inside Claude Code's Plugins tab instead, add this repository as a marketplace: skillmds/skillmd. It carries the flagship plugins as real directories under plugins/, listed in .claude-plugin/marketplace.json and refreshed weekly. The tab only understands plugins that live in git, which is why the whole registry is not in there — every other plugin installs with the command above.

No account needed for any of the above. Skills land in each detected agent's own directory (.claude/skills/, .cursor/skills/, .agents/skills/, …). Per-agent walkthroughs: Claude Code · Cursor · Codex · Gemini CLI · GitHub Copilot · Windsurf · all agents.

The CLI: `skillmd`

npm i -g skillmds

Command	What it does
`skillmd lint [path]`	Validate `SKILL.md` files. Diagnostics, a 0–100 quality score, `--fix` for the mechanical ones.
`skillmd scan [path]`	What would this skill do? Reports scripts, network calls and secret access.
`skillmd rules [id]`	List the lint rules, or explain one.
`skillmd init [name]`	Scaffold a new skill from a template.
`skillmd search`	Search the registry from the terminal.
`skillmd add`	Install from a registry slug, a GitHub repo or a local path. Lints first, never executes scripts.
`skillmd list` / `remove` / `update`	Manage installed skills across agents.
`skillmd publish [path]`	Publish to skillmd.com. Blocked on lint errors.

skillmd lint . --format sarif > skillmd.sarif   # GitHub Code Scanning

skillmd lint . --strict # warnings fail too skillmd add owner/repo -a claude-code -g # one agent, global scope skillmd add some/skill --deny executes_scripts # refuse skills that run code

skillmd add detects 68 agents by their config directories: Claude Code, Cursor, Codex, Windsurf, OpenCode, Gemini CLI, Antigravity, Kiro, Warp, GitHub Copilot, Cline, Roo Code, Goose, Trae, Qwen Code, Amp, Zed, Continue, Devin, OpenHands, Replit and more. Agents that share the .agents/skills convention are written once. Running plain skillmd opens a guided menu.

Full reference: docs/cli.md · CLI docs on skillmd.com · How one SKILL.md works in every agent

The MCP server: `skillmds`

Give any MCP-capable agent the whole registry. It can search, inspect, lint and install skills mid-conversation.

# Claude Code

claude mcp add skillmd -- npx -y skillmds

// Claude Desktop, Cursor, VS Code, Windsurf, … (examples/mcp/ has per-client files)

{ "mcpServers": { "skillmd": { "command": "npx", "args": ["-y", "skillmds"] } } }

Or use the hosted remote server, zero install, streamable HTTP:

https://api.skillmd.com/mcp

Tool	What the agent gets
`skillmd_search`	Registry search with categories, ratings and install snippets
`skillmd_get`	Full skill detail: body, provenance, license, security flags
`skillmd_install`	Safe install: validated, SHA-256-verified, zip-slip-guarded, never executes scripts
`skillmd_trending` / `skillmd_recommend`	Leaderboard and similar-skill suggestions
`skillmd_list_saved`	Your saved skills (with `SKILLMD_TOKEN`)
`skillmd_lint`	Validate any SKILL.md content on the spot

Full reference: docs/mcp.md · MCP docs on skillmd.com · Using SkillMD over MCP · MCP registry entry: com.skillmd/skillmd

The engine: `@skillmds/core`

npm i @skillmds/core

import { lint } from "@skillmds/core";

const { ok, score, diagnostics, security } = lint(rawSkillMd, { slug: "my-skill" });

Nine lint rules, a line-aware security scanner, a 0–100 quality score and SARIF / JSON / GitHub-annotation formatters. ESM, typed, no runtime dependency beyond yaml, runs in Node, browsers and edge runtimes.

The scanner classifies every skill into capability flags you can filter or deny on install:

Flag	Meaning
`docs_only`	Nothing executable found. Pure instructions.
`network_calls`	Fetches, curls or otherwise talks to the network.
`executes_scripts`	Runs commands or bundled scripts.
`reads_secrets`	Touches env vars, tokens or credential files.
`untrusted_install`	Fetch-and-execute from a non-standard source.

Rules and scoring: docs/rules.md · Debugging skills: lint, scan, score · Common SKILL.md mistakes

CI for your skills

- uses: skillmds/skillmd/action@v1

with: path: .

Lints every skill in the repo and uploads SARIF to GitHub Code Scanning, so findings show up in pull requests. Full example: examples/github-action.yml · action/README.md

Publishing a skill

skillmd login                   # token from your skillmd.com account

skillmd publish ./my-skill # blocked on lint errors skillmd publish ./my-skill --dry-run

Published skills get a page at skillmd.com/skills/ / , a safety verdict, an install command for every agent, and a live README badge:

[![SkillMD](https://skillmd.com/badge/<you>/<name>.svg)](https://skillmd.com/skills/<you>/<name>)

Guides: Publishing a skill to the registry · Writing skills that get used · What a verified badge means · Skill packs

The registry API

Everything here is a thin client over the public API at api.skillmd.com (GET /v1/search?q=…, GET /v1/skills/ / , …). Described by docs/registry-api.md, skillmd.com/openapi.json and, for AI systems, skillmd.com/llms.txt. Every skill page also has a Markdown twin at …/ .md.

What's in the registry

Browse by category: Coding & Dev Tools · AI & ML · DevOps & Infra · Integrations & APIs · Security · Data & Analytics · Web & Frontend · Productivity · Docs & Writing · Design & Media

Or by publisher, official skills from verified publishers, the leaderboard, or what's new. Live counts: skillmd.com/stats.

Security model

Installing a skill writes files and does nothing else. No script execution, strict path containment (slug validation plus zip-slip guards), SHA-256 integrity verification against the registry's content-addressed store, and companion files pinned to GitHub raw hosts. Publishing runs the same lint and scan the CLI does, and every listed skill shows its verdict, capability flags and independent scanner results.

Details in SECURITY.md. Report vulnerabilities to **hi@skil

Only the beginning is shown; read the rest in the repo

Skillmd

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Or run it on your computer

Or run it on your computer

Or run it on your computer

Or run it on your computer

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Search & AI memoryi

Common questions

Alternatives

Context7

Codebase Memory

Exa

README from the maker

What this is

Quick start

Lint your own skill before you share it

Plugins

The CLI: skillmd

The MCP server: skillmds

The engine: @skillmds/core

CI for your skills

Publishing a skill

The registry API

What's in the registry

Security model

The CLI: `skillmd`

The MCP server: `skillmds`

The engine: `@skillmds/core`