Skillmd

SkillMD

The registry that lints.

Search, install, lint and publish Agent Skills ( SKILL.md ) for Claude Code, Cursor, Codex and 60+ other agents.

This repo is the open-source toolchain behind skillmd.com : the CLI, the MCP server, the GitHub Action and the SKILL.md engine they share.

Browse skills · Categories · Publishers · Install guides · Docs · Blog · Stats

What this is

An Agent Skill is a folder with a SKILL.md file: YAML frontmatter (name, description) plus Markdown instructions an agent loads on demand. Claude Code, Cursor, Codex, Gemini CLI, GitHub Copilot, Windsurf and dozens of other agents read the same format, which is what makes a shared registry worth having. If the format is new to you, start with What is an Agent Skill? and the anatomy of a SKILL.md file.

[skillmd.com](https://skillmd.com) is the open registry of those skills: 1,000,000+ skills from 30,000+ publishers, every one of them linted against the format, security-scanned for what it can do, and pinned to a commit. Verdicts, capability flags and independent scanner results sit on every skill page. Installing writes files and does nothing else.

This repository is everything that runs on your machine or in your CI, MIT-licensed:

The registry applies the same engine, so a skill that passes locally passes on publish.

Quick start

# Search the registry and install a skill into every agent on your machine

npx skillmds search "pdf" npx skillmds add anthropic/pdf

Lint your own skill before you share it

npx skillmds lint ./my-skill

Plugins

A plugin is a bundle of skills that installs as one unit. In Claude Code it becomes a real plugin — /plugin lists it, and enable, disable and uninstall work on the whole set — and on every other agent the skills are installed individually.

npx skillmds add plugin:skillmd/design

To browse them inside Claude Code's Plugins tab instead, add this repository as a marketplace: skillmds/skillmd. It carries the flagship plugins as real directories under plugins/, listed in .claude-plugin/marketplace.json and refreshed weekly. The tab only understands plugins that live in git, which is why the whole registry is not in there — every other plugin installs with the command above.

No account needed for any of the above. Skills land in each detected agent's own directory (.claude/skills/, .cursor/skills/, .agents/skills/, …). Per-agent walkthroughs: Claude Code · Cursor · Codex · Gemini CLI · GitHub Copilot · Windsurf · all agents.

The CLI: skillmd

npm i -g skillmds

skillmd lint . --format sarif > skillmd.sarif   # GitHub Code Scanning

skillmd lint . --strict # warnings fail too skillmd add owner/repo -a claude-code -g # one agent, global scope skillmd add some/skill --deny executes_scripts # refuse skills that run code

skillmd add detects 68 agents by their config directories: Claude Code, Cursor, Codex, Windsurf, OpenCode, Gemini CLI, Antigravity, Kiro, Warp, GitHub Copilot, Cline, Roo Code, Goose, Trae, Qwen Code, Amp, Zed, Continue, Devin, OpenHands, Replit and more. Agents that share the .agents/skills convention are written once. Running plain skillmd opens a guided menu.

Full reference: docs/cli.md · CLI docs on skillmd.com · How one SKILL.md works in every agent

The MCP server: skillmds

Give any MCP-capable agent the whole registry. It can search, inspect, lint and install skills mid-conversation.

# Claude Code

claude mcp add skillmd -- npx -y skillmds

// Claude Desktop, Cursor, VS Code, Windsurf, … (examples/mcp/ has per-client files)

{ "mcpServers": { "skillmd": { "command": "npx", "args": ["-y", "skillmds"] } } }

Or use the hosted remote server, zero install, streamable HTTP:

https://api.skillmd.com/mcp

Full reference: docs/mcp.md · MCP docs on skillmd.com · Using SkillMD over MCP · MCP registry entry: com.skillmd/skillmd

The engine: @skillmds/core

npm i @skillmds/core

import { lint } from "@skillmds/core";

const { ok, score, diagnostics, security } = lint(rawSkillMd, { slug: "my-skill" });

Nine lint rules, a line-aware security scanner, a 0–100 quality score and SARIF / JSON / GitHub-annotation formatters. ESM, typed, no runtime dependency beyond yaml, runs in Node, browsers and edge runtimes.

The scanner classifies every skill into capability flags you can filter or deny on install:

Rules and scoring: docs/rules.md · Debugging skills: lint, scan, score · Common SKILL.md mistakes

CI for your skills

- uses: skillmds/skillmd/action@v1

with: path: .

Lints every skill in the repo and uploads SARIF to GitHub Code Scanning, so findings show up in pull requests. Full example: examples/github-action.yml · action/README.md

Publishing a skill

skillmd login                   # token from your skillmd.com account

skillmd publish ./my-skill # blocked on lint errors skillmd publish ./my-skill --dry-run

Published skills get a page at skillmd.com/skills/ / , a safety verdict, an install command for every agent, and a live README badge:

[![SkillMD](https://skillmd.com/badge/<you>/<name>.svg)](https://skillmd.com/skills/<you>/<name>)

Guides: Publishing a skill to the registry · Writing skills that get used · What a verified badge means · Skill packs

The registry API

Everything here is a thin client over the public API at api.skillmd.com (GET /v1/search?q=…, GET /v1/skills/ / , …). Described by docs/registry-api.md, skillmd.com/openapi.json and, for AI systems, skillmd.com/llms.txt. Every skill page also has a Markdown twin at …/ .md.

What's in the registry

Browse by category: Coding & Dev Tools · AI & ML · DevOps & Infra · Integrations & APIs · Security · Data & Analytics · Web & Frontend · Productivity · Docs & Writing · Design & Media

Or by publisher, official skills from verified publishers, the leaderboard, or what's new. Live counts: skillmd.com/stats.

Security model

Installing a skill writes files and does nothing else. No script execution, strict path containment (slug validation plus zip-slip guards), SHA-256 integrity verification against the registry's content-addressed store, and companion files pinned to GitHub raw hosts. Publishing runs the same lint and scan the CLI does, and every listed skill shows its verdict, capability flags and independent scanner results.

Details in SECURITY.md. Report vulnerabilities to **hi@skil