skills 1.7.2 → 1.7.4

package/docs/commands.md

@@ -0,0 +1,345 @@
+# CLI reference
+
+[Back to the README](../README.md)
+
+Run commands with `npx skills <command>`. For all available options, run `npx skills --help`.
+
+## `skills add`
+
+Install skills from a repository, URL, or local directory:
+
+```bash
+npx skills add vercel-labs/agent-skills
+```
+
+### Source Formats
+
+```bash
+# GitHub shorthand (owner/repo)
+npx skills add vercel-labs/agent-skills
+
+# Full GitHub URL
+npx skills add https://github.com/vercel-labs/agent-skills
+
+# Direct path to a skill in a repo
+npx skills add https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines
+
+# GitLab URL
+npx skills add https://gitlab.com/org/repo
+
+# Azure Repos (Azure DevOps Services or Server)
+npx skills add https://dev.azure.com/org/project/_git/repo
+npx skills add https://dev.azure.com/org/project/_git/repo?path=/skills/web-design&version=GBmain
+
+# Any git URL
+npx skills add git@github.com:vercel-labs/agent-skills.git
+
+# Local path
+npx skills add ./my-local-skills
+```
+
+### Private Repositories
+
+Use the same command for public and private repositories. The CLI uses the authentication already configured for the repository URL:
+
+```bash
+# GitHub shorthand or HTTPS (Git credential helper, GitHub CLI, then SSH fallback)
+npx skills add acme/private-skills
+
+# SSH on GitHub, GitLab, or another Git host
+npx skills add git@github.com:acme/private-skills.git
+npx skills add ssh://git@git.example.com/acme/private-skills.git
+
+# HTTPS on any Git host (uses your configured Git credential helper)
+npx skills add https://git.example.com/acme/private-skills.git
+npx skills add https://dev.azure.com/org/project/_git/private-skills
+```
+
+For GitHub HTTPS and shorthand sources, `skills` first uses normal Git credentials. If that fails and GitHub CLI is authenticated, it tries `gh repo clone`, followed by SSH. It does not execute `gh auth token` or copy the stored GitHub CLI credential into the Node.js process.
+
+For GitHub tree lookups, `skills` first tries the API anonymously, then an explicitly supplied environment token, then `gh api`. GitHub CLI applies its own stored authentication and returns only the API response; the credential is never printed to or read by `skills`. If API access still fails, update checks fall back to an authenticated Git clone.
+
+`GITHUB_TOKEN` or `GH_TOKEN` can be set explicitly for GitHub API access, including private repository downloads and update checks. They are optional for installs when Git, GitHub CLI, or SSH authentication is already configured.
+
+### Options
+
+| Option                    | Description                                                                                                                                                 |
+| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `-g, --global`            | Install to user directory instead of project                                                                                                                |
+| `-a, --agent <agents...>` | <!-- agent-names:start -->Target specific agents (e.g., `claude-code`, `codex`). See [Supported Agents](agents.md#supported-agents)<!-- agent-names:end --> |
+| `-s, --skill <skills...>` | Install specific skills by name (use `'*'` for all skills)                                                                                                  |
+| `-l, --list`              | List available skills without installing                                                                                                                    |
+| `--copy`                  | Copy files instead of symlinking to agent directories                                                                                                       |
+| `-y, --yes`               | Skip all confirmation prompts                                                                                                                               |
+| `--all`                   | Install all skills to all agents without prompts                                                                                                            |
+
+### Examples
+
+```bash
+# List skills in a repository
+npx skills add vercel-labs/agent-skills --list
+
+# Install specific skills
+npx skills add vercel-labs/agent-skills --skill frontend-design --skill skill-creator
+
+# Install a skill with spaces in the name (must be quoted)
+npx skills add owner/repo --skill "Convex Best Practices"
+
+# Install to specific agents
+npx skills add vercel-labs/agent-skills -a claude-code -a opencode
+
+# Non-interactive installation (CI/CD friendly)
+npx skills add vercel-labs/agent-skills --skill frontend-design -g -a claude-code -y
+
+# Install all skills from a repo to all agents
+npx skills add vercel-labs/agent-skills --all
+
+# Install all skills to specific agents
+npx skills add vercel-labs/agent-skills --skill '*' -a claude-code
+
+# Install specific skills to all agents
+npx skills add vercel-labs/agent-skills --agent '*' --skill frontend-design
+
+# Install from a direct SKILL.md or archive download URL
+npx skills add https://example.com/download/my-skill
+```
+
+Direct download URLs are tried after well-known discovery. They may point to a single valid `SKILL.md` file or a `.zip`, `.tar`, `.tar.gz`, or `.tgz` archive; the URL does not need to include a file extension. Downloads are limited to 10 MiB, extracted content to 25 MiB, and archives to 1000 files by default. Override with `SKILLS_DOWNLOAD_MAX_BYTES`, `SKILLS_EXTRACT_MAX_BYTES`, and `SKILLS_EXTRACT_MAX_FILES` when you trust the source.
+
+### Installation Scope
+
+| Scope       | Flag      | Location            | Use Case                                      |
+| ----------- | --------- | ------------------- | --------------------------------------------- |
+| **Project** | (default) | `./<agent>/skills/` | Committed with your project, shared with team |
+| **Global**  | `-g`      | `~/<agent>/skills/` | Available across all projects                 |
+
+### Installation Methods
+
+When installing interactively, you can choose:
+
+| Method                    | Description                                                                                 |
+| ------------------------- | ------------------------------------------------------------------------------------------- |
+| **Symlink** (Recommended) | Creates symlinks from each agent to a canonical copy. Single source of truth, easy updates. |
+| **Copy**                  | Creates independent copies for each agent. Use when symlinks aren't supported.              |
+
+## `skills use`
+
+Generate a prompt for one skill, or start a supported coding agent interactively:
+
+```bash
+npx skills use vercel-labs/agent-skills@web-design-guidelines | claude
+npx skills use vercel-labs/agent-skills --skill web-design-guidelines --agent claude-code
+```
+
+`skills use` resolves sources the same way as `skills add`, writes the selected skill files to a temporary directory, and prints only the generated prompt to stdout unless `--agent` is provided. With `--agent`, it starts one supported agent interactively with the generated prompt.
+
+## `skills list`
+
+List all installed skills. Similar to `npm ls`.
+
+```bash
+# List project installed skills
+npx skills list
+
+# List only global skills
+npx skills ls -g
+
+# Filter by specific agents
+npx skills ls -a claude-code -a cursor
+```
+
+## `skills find`
+
+Search for skills interactively or by keyword.
+
+```bash
+# Interactive search (fzf-style)
+npx skills find
+
+# Search by keyword
+npx skills find typescript
+
+# Search across every repository owned by an organization or user
+npx skills find react --owner vercel
+```
+
+## `skills check`
+
+Check installed skills for available updates without reinstalling them:
+
+```bash
+npx skills check
+```
+
+## `skills update`
+
+```bash
+# Update all skills (interactive scope prompt)
+npx skills update
+
+# Update a single skill by name
+npx skills update my-skill
+
+# Update multiple specific skills
+npx skills update frontend-design web-design-guidelines
+
+# Update only global or project skills
+npx skills update -g
+npx skills update -p
+
+# Non-interactive (auto-detects scope: project if in a project, else global)
+npx skills update -y
+```
+
+| Option          | Description                                                               |
+| --------------- | ------------------------------------------------------------------------- |
+| `-g, --global`  | Only update global skills                                                 |
+| `-p, --project` | Only update project skills                                                |
+| `-y, --yes`     | Skip scope prompt (auto-detect: project if in a project dir, else global) |
+| `[skills...]`   | Update specific skills by name instead of all                             |
+
+## `skills init`
+
+```bash
+# Create SKILL.md in current directory
+npx skills init
+
+# Create a new skill in a subdirectory
+npx skills init my-skill
+```
+
+## `skills remove`
+
+Remove installed skills from agents.
+
+```bash
+# Remove interactively (select from installed skills)
+npx skills remove
+
+# Remove all skills from an exact lock source
+npx skills remove owner/repo
+
+# Remove specific skill by name
+npx skills remove web-design-guidelines
+
+# Remove multiple skills
+npx skills remove frontend-design web-design-guidelines
+
+# Remove from global scope
+npx skills remove --global web-design-guidelines
+
+# Remove from specific agents only
+npx skills remove --agent claude-code cursor my-skill
+
+# Remove all installed skills without confirmation
+npx skills remove --all
+
+# Remove all skills from a specific agent
+npx skills remove --skill '*' -a cursor
+
+# Remove a specific skill from all agents
+npx skills remove my-skill --agent '*'
+
+# Use 'rm' alias
+npx skills rm my-skill
+```
+
+| Option         | Description                                      |
+| -------------- | ------------------------------------------------ |
+| `-g, --global` | Remove from global scope (~/) instead of project |
+| `-a, --agent`  | Remove from specific agents (use `'*'` for all)  |
+| `-s, --skill`  | Specify skills to remove (use `'*'` for all)     |
+| `-y, --yes`    | Skip confirmation prompts                        |
+| `--all`        | Shorthand for `--skill '*' --agent '*' -y`       |
+
+## Experimental commands
+
+These commands are still experimental. Their names, options, and behavior may change.
+
+<a id="skills-sync"></a>
+
+### `skills experimental_sync`
+
+Sync skills from npm packages and `package.json` declarations. `sync` remains
+supported as a compatibility alias for users of skills@1.7.3.
+
+Install a package that ships skills, then sync them into your project:
+
+```bash
+npm install -D skills agent-browser
+npx skills experimental_sync -y
+```
+
+Sync reads installed dependencies declared in your project's `package.json`, including
+`dependencies`, `devDependencies`, `optionalDependencies`, and `peerDependencies`.
+It discovers a package's root `SKILL.md`, `skills/<name>/SKILL.md`, or
+`dist/skills/<name>/SKILL.md` and links each skill into `.agents/skills/` and the
+selected agent directories. The linked skill updates with the installed package.
+Use `--copy` to copy files instead; copies require another sync after a package update.
+
+The `.agents/skills/` directory is the shared location. Selecting Claude Code also
+creates links under `.claude/skills/` pointing to the shared skills:
+
+```bash
+npx skills experimental_sync -a claude-code -y
+```
+
+Outside an agent, sync detects installed agents. When run inside a coding agent,
+it targets that agent automatically unless you pass `-a` to select others.
+
+Already downloaded remote skills are reused to create missing agent links without
+fetching their source again. Packaged skills are relinked on every run.
+
+To run sync after dependency installation, add a `prepare` script:
+
+```json
+{
+  "scripts": {
+    "prepare": "skills experimental_sync -y"
+  }
+}
+```
+
+The project and its dependencies can also declare a `skills` array in `package.json`:
+
+```json
+{
+  "skills": ["npm:agent-browser", "vercel-labs/agent-skills@web-design-guidelines"]
+}
+```
+
+An `npm:` entry references skills in an installed package. Other entries reference
+Git sources and are fetched into the project. Pin a Git ref when you need reproducible
+remote content. A package can publish this array as a shareable skill pack.
+See the [field specification](https://github.com/antfu/skills-npm/blob/main/SPEC.md)
+and [RFC](https://github.com/vercel-labs/skills/issues/2323) for the full proposal.
+
+Sync tracks its skills in `skills-lock.json`, removes skills that are no longer
+provided, and preserves skills installed separately with `skills add`.
+
+| Option                    | Description                                                   |
+| ------------------------- | ------------------------------------------------------------- |
+| `-a, --agent <agents...>` | Select agent directories                                      |
+| `-y, --yes`               | Skip confirmation prompts                                     |
+| `--dry-run`               | Show the plan without installing or removing skills           |
+| `--copy`                  | Copy packaged skills instead of linking them                  |
+| `--no-cleanup`            | Keep skills that are no longer provided                       |
+| `--no-remote`             | Skip installing and removing remote skills                    |
+| `--include <patterns...>` | Include skills by package or `package#skill` pattern          |
+| `--exclude <patterns...>` | Exclude skills by package or `package#skill` pattern          |
+| `-r, --recursive`         | Also read dependencies of workspace packages                  |
+
+The include/exclude filters apply to both packaged and remote skills. For remote
+skills, the package pattern matches the package declaring the entry (`.` for the
+project's own field). Eve always receives copies because it rewrites skill frontmatter.
+
+### Restore skills from the project lock file
+
+```bash
+npx skills experimental_install
+```
+
+Restore supported sources recorded in `skills-lock.json` into `.agents/skills/`.
+Entries from npm packages are synced from the dependencies already on disk, so
+install your npm dependencies before restoring. This command does not install
+npm packages or create agent-specific links for restored skills.

package/docs/creating-skills.md

@@ -0,0 +1,140 @@
+# Creating skills
+
+[Back to the README](../README.md)
+
+Create a template with `npx skills init my-skill`, then edit its `SKILL.md`.
+
+Skills are directories containing a `SKILL.md` file with YAML frontmatter:
+
+```markdown
+---
+name: my-skill
+description: What this skill does and when to use it
+---
+
+# My Skill
+
+Instructions for the agent to follow when this skill is activated.
+
+## When to Use
+
+Describe the scenarios where this skill should be used.
+
+## Steps
+
+1. First, do this
+2. Then, do that
+```
+
+### Required Fields
+
+- `name`: Unique identifier (lowercase, hyphens allowed)
+- `description`: Brief explanation of what the skill does
+
+### Optional Fields
+
+- `metadata.internal`: Set to `true` to hide the skill from normal discovery. Internal skills are only visible and
+  installable when `INSTALL_INTERNAL_SKILLS=1` is set. Useful for work-in-progress skills or skills meant only for
+  internal tooling.
+
+```markdown
+---
+name: my-internal-skill
+description: An internal skill not shown by default
+metadata:
+  internal: true
+---
+```
+
+### Skill Discovery
+
+The CLI searches for skills in these locations within a repository. Each
+skill container directory is walked up to three levels deep, covering flat
+layouts (`skills/<name>/SKILL.md`) and catalog layouts with one or two category
+levels (`skills/<category>/<name>/SKILL.md` or
+`skills/<category>/<category>/<name>/SKILL.md`). A `SKILL.md` discovered at a
+shallower level shadows anything nested below it. Use `--full-depth` to also
+discover `SKILL.md` files outside these container directories (e.g. under
+`examples/` or `tests/`).
+
+<!-- skill-discovery:start -->
+- Root directory (if it contains `SKILL.md`)
+- `skills/`
+- `skills/.curated/`
+- `skills/.experimental/`
+- `skills/.system/`
+- `.aider-desk/skills/`
+- `.agents/skills/`
+- `data/skills/`
+- `.autohand/skills/`
+- `.augment/skills/`
+- `.bob/skills/`
+- `.claude/skills/`
+- `.codeartsdoer/skills/`
+- `.codebuddy/skills/`
+- `.codemaker/skills/`
+- `.codestudio/skills/`
+- `.commandcode/skills/`
+- `.continue/skills/`
+- `.cortex/skills/`
+- `.crush/skills/`
+- `.devin/skills/`
+- `agent/skills/`
+- `.forge/skills/`
+- `.goose/skills/`
+- `.grok/skills/`
+- `.hermes/skills/`
+- `.inferencesh/skills/`
+- `.jazz/skills/`
+- `.junie/skills/`
+- `.iflow/skills/`
+- `.kimchi/skills/`
+- `.kiro/skills/`
+- `.kode/skills/`
+- `.lingma/skills/`
+- `.mcpjam/skills/`
+- `.minimax/skills/`
+- `.vibe/skills/`
+- `.moxby/skills/`
+- `.mux/skills/`
+- `.openhands/skills/`
+- `.ona/skills/`
+- `.posit/assistant/skills/`
+- `.qoder/skills/`
+- `.qwen/skills/`
+- `.reasonix/skills/`
+- `.rovodev/skills/`
+- `.roo/skills/`
+- `.tabnine/agent/skills/`
+- `.terramind/skills/`
+- `.tinycloud/skills/`
+- `.trae/skills/`
+- `.windsurf/skills/`
+- `.zcode/skills/`
+- `.zencoder/skills/`
+- `.neovate/skills/`
+- `.pochi/skills/`
+- `.adal/skills/`
+<!-- skill-discovery:end -->
+
+### Plugin Manifest Discovery
+
+If `.claude-plugin/marketplace.json` or `.claude-plugin/plugin.json` exists, skills declared in those files are also discovered:
+
+```json
+// .claude-plugin/marketplace.json
+{
+  "metadata": { "pluginRoot": "./plugins" },
+  "plugins": [
+    {
+      "name": "my-plugin",
+      "source": "my-plugin",
+      "skills": ["./skills/review", "./skills/test"]
+    }
+  ]
+}
+```
+
+This enables compatibility with the [Claude Code plugin marketplace](https://code.claude.com/docs/en/plugin-marketplaces) ecosystem. Skill paths declared in a manifest are searched at their declared depth and are not subject to the bounded depth-3 catalog walk described above.
+
+If no skills are found in standard locations, a recursive search is performed.

package/docs/troubleshooting.md

@@ -0,0 +1,40 @@
+# Troubleshooting and configuration
+
+[Back to the README](../README.md)
+
+## Troubleshooting
+
+### "No skills found"
+
+Ensure the repository contains valid `SKILL.md` files with both `name` and `description` in the frontmatter.
+
+### Skill not loading in agent
+
+- Verify the skill was installed to the correct path
+- Check the agent's documentation for skill loading requirements
+- Ensure the `SKILL.md` frontmatter is valid YAML
+
+### Permission errors
+
+Ensure you have write access to the target directory.
+
+## Environment Variables
+
+| Variable                  | Description                                                                |
+| ------------------------- | -------------------------------------------------------------------------- |
+| `INSTALL_INTERNAL_SKILLS` | Set to `1` or `true` to show and install skills marked as `internal: true` |
+| `DISABLE_TELEMETRY`       | Set to disable anonymous usage telemetry                                   |
+| `DO_NOT_TRACK`            | Alternative way to disable telemetry                                       |
+| `GITHUB_TOKEN`            | Optional explicit token for authenticated GitHub API requests              |
+| `GH_TOKEN`                | Fallback explicit token for authenticated GitHub API requests              |
+
+```bash
+# Install internal skills
+INSTALL_INTERNAL_SKILLS=1 npx skills add vercel-labs/agent-skills --list
+```
+
+## Telemetry
+
+This CLI collects anonymous usage data to help improve the tool. No personal information is collected.
+
+GitHub repository and skill identifiers are sent only for repositories that GitHub positively confirms are public. Other remote source types may include source and skill identifiers in install telemetry because their visibility cannot be checked through GitHub. Security-audit requests remain limited to confirmed-public GitHub repositories. Set `DISABLE_TELEMETRY=1` or `DO_NOT_TRACK=1` to disable both entirely.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skills",
-  "version": "1.7.2",
+  "version": "1.7.4",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {
@@ -10,6 +10,7 @@
   "files": [
     "dist",
     "bin",
+    "docs",
     "README.md",
     "ThirdPartyNoticeText.txt"
   ],