Skillmd

com.skillmdPublished by skillmd.comOfficial publisherv1.2.0Updated Oct 24, 2026

Search, fetch, lint, and install Agent Skills (SKILL.md) from the SkillMD registry.

VerifiedStreamable HTTPWeb executableKnowledge & MemoryDeveloper Tools

Overview

AI-generated overview

Lets an assistant search, inspect, download and get recommendations for Agent Skills (SKILL.md files) from the SkillMD registry.

What you can do
Search the SkillMD registry by task, name or keyword and see matches with slug, category, safety verdict and install snippet, best match first. Fetch one skill's description, SKILL.md body, provenance, license, safety verdict and capability flags, plus companion file listings for packs. Download a public skill's full contents, including every companion file, ready to write to disk. Browse the leaderboard of top skills by installs, saves and ratings, optionally filtered by category and time window. Get recommendations from a given skill's category, or trending skills from the last 30 days.
When to use it
Useful when you want an assistant to find and pull in ready-made agent instructions mid-conversation, compare skills by safety verdict and capability flags, or discover popular and related skills before installing one yourself.
Requirements
Runs as a hosted remote endpoint over streamable HTTP, or locally via npx from the npm package skillmds. Node.js is needed for the local option. No account is required for search, fetch, download, trending and recommendations. An optional SKILLMD_TOKEN enables saved skills and personalized recommendations; SKILLMD_API can override the registry API base URL.
Before you install
Downloaded skills are plain-text instructions an agent reads on demand, so review their content and capability flags before use; the registry reports flags such as network calls, script execution and secret access. The optional SKILLMD_TOKEN is a personal access token and should be kept private. The server itself only returns skill content; writing files to disk is a separate step.

Installation

In SourceWeft

  1. Open Skillmd in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.skillmd%2Fskillmd/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "skillmd": {
      "type": "http",
      "url": "https://api.skillmd.com/mcp"
    }
  }
}

README

[SkillMD — the open registry of Agent Skills]

SkillMD

The registry that lints.
Search, install, lint and publish Agent Skills (SKILL.md) for Claude Code, Cursor, Codex and 60+ other agents.
This repo is the open-source toolchain behind skillmd.com: the CLI, the MCP server, the GitHub Action and the SKILL.md engine they share.

[skillmds on npm] [@skillmds/core on npm] [npm downloads] [CI] [MIT license]

Browse skills · Categories · Publishers · Install guides · Docs · Blog · Stats

What this is

An Agent Skill is a folder with a SKILL.md file: YAML frontmatter (name, description) plus Markdown instructions an agent loads on demand. Claude Code, Cursor, Codex, Gemini CLI, GitHub Copilot, Windsurf and dozens of other agents read the same format, which is what makes a shared registry worth having. If the format is new to you, start with What is an Agent Skill? and the anatomy of a SKILL.md file.

skillmd.com is the open registry of those skills: 1,000,000+ skills from 30,000+ publishers, every one of them linted against the format, security-scanned for what it can do, and pinned to a commit. Verdicts, capability flags and independent scanner results sit on every skill page. Installing writes files and does nothing else.

This repository is everything that runs on your machine or in your CI, MIT-licensed:

PackageWhat it isInstall
skillmdsOne npm package, two binaries: the skillmd CLI and the skillmds MCP servernpm i -g skillmds
@skillmds/coreThe SKILL.md engine: parser, lint rules, security scanner, quality score, SARIF / JSON / GitHub formattersnpm i @skillmds/core
skillmds/skillmd/actionGitHub Action: lint every skill in a repo, results in GitHub Code Scanninguses: skillmds/skillmd/action@v1

The registry applies the same engine, so a skill that passes locally passes on publish.

Quick start

bash
# Search the registry and install a skill into every agent on your machinenpx skillmds search "pdf"npx skillmds add anthropic/pdf
# Lint your own skill before you share itnpx skillmds lint ./my-skill

Plugins

A plugin is a bundle of skills that installs as one unit. In Claude Code it becomes a real plugin — /plugin lists it, and enable, disable and uninstall work on the whole set — and on every other agent the skills are installed individually.

bash
npx skillmds add plugin:skillmd/design

To browse them inside Claude Code's Plugins tab instead, add this repository as a marketplace: skillmds/skillmd. It carries the flagship plugins as real directories under plugins/, listed in .claude-plugin/marketplace.json and refreshed weekly. The tab only understands plugins that live in git, which is why the whole registry is not in there — every other plugin installs with the command above.

No account needed for any of the above. Skills land in each detected agent's own directory (.claude/skills/, .cursor/skills/, .agents/skills/, …). Per-agent walkthroughs: Claude Code · Cursor · Codex · Gemini CLI · GitHub Copilot · Windsurf · all agents.

The CLI: skillmd

bash
npm i -g skillmds
CommandWhat it does
skillmd lint [path]Validate SKILL.md files. Diagnostics, a 0–100 quality score, --fix for the mechanical ones.
skillmd scan [path]What would this skill do? Reports scripts, network calls and secret access.
skillmd rules [id]List the lint rules, or explain one.
skillmd init [name]Scaffold a new skill from a template.
skillmd search <query>Search the registry from the terminal.
skillmd add <source>Install from a registry slug, a GitHub repo or a local path. Lints first, never executes scripts.
skillmd list / remove / updateManage installed skills across agents.
skillmd publish [path]Publish to skillmd.com. Blocked on lint errors.
bash
skillmd lint . --format sarif > skillmd.sarif   # GitHub Code Scanningskillmd lint . --strict                          # warnings fail tooskillmd add owner/repo -a claude-code -g         # one agent, global scopeskillmd add some/skill --deny executes_scripts   # refuse skills that run code

skillmd add detects 68 agents by their config directories: Claude Code, Cursor, Codex, Windsurf, OpenCode, Gemini CLI, Antigravity, Kiro, Warp, GitHub Copilot, Cline, Roo Code, Goose, Trae, Qwen Code, Amp, Zed, Continue, Devin, OpenHands, Replit and more. Agents that share the .agents/skills convention are written once. Running plain skillmd opens a guided menu.

Full reference: docs/cli.md · CLI docs on skillmd.com · How one SKILL.md works in every agent

The MCP server: skillmds

Give any MCP-capable agent the whole registry. It can search, inspect, lint and install skills mid-conversation.

bash
# Claude Codeclaude mcp add skillmd -- npx -y skillmds
jsonc
// Claude Desktop, Cursor, VS Code, Windsurf, … (examples/mcp/ has per-client files){ "mcpServers": { "skillmd": { "command": "npx", "args": ["-y", "skillmds"] } } }

Or use the hosted remote server, zero install, streamable HTTP:

https://api.skillmd.com/mcp
ToolWhat the agent gets
skillmd_searchRegistry search with categories, ratings and install snippets
skillmd_getFull skill detail: body, provenance, license, security flags
skillmd_installSafe install: validated, SHA-256-verified, zip-slip-guarded, never executes scripts
skillmd_trending / skillmd_recommendLeaderboard and similar-skill suggestions
skillmd_list_savedYour saved skills (with SKILLMD_TOKEN)
skillmd_lintValidate any SKILL.md content on the spot

Full reference: docs/mcp.md · MCP docs on skillmd.com · Using SkillMD over MCP · MCP registry entry: com.skillmd/skillmd

The engine: @skillmds/core

bash
npm i @skillmds/core
ts
import { lint } from "@skillmds/core";
const { ok, score, diagnostics, security } = lint(rawSkillMd, { slug: "my-skill" });

Nine lint rules, a line-aware security scanner, a 0–100 quality score and SARIF / JSON / GitHub-annotation formatters. ESM, typed, no runtime dependency beyond yaml, runs in Node, browsers and edge runtimes.

The scanner classifies every skill into capability flags you can filter or deny on install:

FlagMeaning
docs_onlyNothing executable found. Pure instructions.
network_callsFetches, curls or otherwise talks to the network.
executes_scriptsRuns commands or bundled scripts.
reads_secretsTouches env vars, tokens or credential files.
untrusted_installFetch-and-execute from a non-standard source.

Rules and scoring: docs/rules.md · Debugging skills: lint, scan, score · Common SKILL.md mistakes

CI for your skills

yaml
- uses: skillmds/skillmd/action@v1  with:    path: .

Lints every skill in the repo and uploads SARIF to GitHub Code Scanning, so findings show up in pull requests. Full example: examples/github-action.yml · action/README.md

Publishing a skill

bash
skillmd login                   # token from your skillmd.com accountskillmd publish ./my-skill      # blocked on lint errorsskillmd publish ./my-skill --dry-run

Published skills get a page at skillmd.com/skills/<you>/<name>, a safety verdict, an install command for every agent, and a live README badge:

markdown
[![SkillMD](https://skillmd.com/badge/<you>/<name>.svg)](https://skillmd.com/skills/<you>/<name>)

Guides: Publishing a skill to the registry · Writing skills that get used · What a verified badge means · Skill packs

The registry API

Everything here is a thin client over the public API at api.skillmd.com (GET /v1/search?q=…, GET /v1/skills/<owner>/<name>, …). Described by docs/registry-api.md, skillmd.com/openapi.json and, for AI systems, skillmd.com/llms.txt. Every skill page also has a Markdown twin at …/<name>.md.

What's in the registry

Browse by category: Coding & Dev Tools · AI & ML · DevOps & Infra · Integrations & APIs · Security · Data & Analytics · Web & Frontend · Productivity · Docs & Writing · Design & Media

Or by publisher, official skills from verified publishers, the leaderboard, or what's new. Live counts: skillmd.com/stats.

Security model

Installing a skill writes files and does nothing else. No script execution, strict path containment (slug validation plus zip-slip guards), SHA-256 integrity verification against the registry's content-addressed store, and companion files pinned to GitHub raw hosts. Publishing runs the same lint and scan the CLI does, and every listed skill shows its verdict, capability flags and independent scanner results.

Details in SECURITY.md. Report vulnerabilities to [email protected].

Learn more

Development

bash
npm cinpm run build      # @skillmds/core, then skillmdsnpm test           # vitest across both packages, incl. an MCP stdio smoke testnpm run typecheck  # strict tsc

See CONTRIBUTING.md for layout, PR guidelines and the release process, and CODE_OF_CONDUCT.md.

License

MIT © SkillMD · skillmd.com · [email protected]

Source: README.md at commit f9a48a7

Tools

5

skillmd_get

Get skill details

Fetch one skill by owner/name slug: description, SKILL.md body, provenance (source repo and pinned commit), license, safety verdict and capability flags, plus companion file listing for packs.

Parametersslugrequired

skillmd_download

Download skill files

Return the full contents of any public skill by owner/name slug: the SKILL.md text plus every companion file for packs, ready to write to disk. Skills are plain-text instructions an agent reads on demand; nothing executes, and every listed skill has passed SkillMD's safety review.

Parametersslugrequired

skillmd_recommend

Recommend skills

Recommend skills. With based_on set to a skill's owner/name slug, returns the top skills in that skill's category (excluding itself); without it, returns what is trending over the last 30 days.

Parameterslimitbased_on

Version history

1
  1. v1.2.0LatestSep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts