
skillkit
io.github.furkan708Published by GitHub account furkan708v1.0.2Updated Oct 24, 2026
Toolbox for AI agent skills: scaffold, lint, pack, install, and serve SKILL.md skills
Overview
Lets an assistant discover, read, and lint installed SKILL.md agent skills through a local MCP server.
- What you can do
- skillkit is a Python toolbox for AI agent skills that also runs as a local MCP server over stdio. Through MCP it exposes three tools: list_skills to discover installed skills with names and descriptions, read_skill to load a skill's full SKILL.md instructions, and lint_skill to validate a skill and return a quality score. The same package provides CLI commands to scaffold, lint, pack, install, list, and remove skills.
- When to use it
- Useful when you keep a library of SKILL.md skills and want an assistant to find and load the right one on demand, or to check a skill's quality and security before publishing. It fits Claude Code, Cursor, and other MCP clients that read skills from a local directory.
- Requirements
- Runs locally as a Python package (skillkit-cli) via stdio; no authentication, environment variables, or headers are declared. Install with pipx or uvx, or from source. Skills are read from a directory such as ~/.claude/skills, configurable with --dir.
Installation
In SourceWeft
- Open skillkit in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.
Other MCP clients
Follow the launch instructions in the repository.
README
skillkit
[Python] [License] [Tests] [CI] [Code style: ruff] [Types: mypy] [Dependencies]
The toolbox for AI agent skills. Scaffold, lint, pack, and install SKILL.md skills — and serve your whole skill library to Claude Code, Cursor, and any MCP client with a built-in Model Context Protocol server.
Community audits found that the overwhelming majority of published SKILL.md files carry at least one "skill smell" — and a large share leak secrets. skillkit catches those before you ship.
Deep docs: Usage guide — lint rules reference, MCP patterns, CI usage · Architecture · Contributing · Changelog · Security
Features
new— scaffold a spec-compliant skill folder in one commandlint— validate against the Agent Skills spec plus security smells: leaked API keys, vague descriptions, oversized bodies, folder typos, and more (scored 0–100 with a grade)pack— zip a skill for upload to skill-capable platformsinstall— install from a folder or any git URL into~/.claude/skills(or your own directory)list/remove— manage your installed skill librarymcp— a zero-dependency MCP server (stdio, JSON-RPC 2.0) that exposeslist_skills,read_skill, andlint_skilltools to any client- Zero dependencies — pure Python standard library
- 76 tests, CI on Python 3.10 → 3.12
Quick start
Serve your skills over MCP
Add skillkit to any MCP client config — Claude Code, Cursor, Windsurf, and every other MCP-compatible agent:
Your agent can now discover and read every installed skill on demand:
What lint catches
Every run ends with a 0–100 score and a letter grade, so you know when a skill is ready to publish.
CLI reference
Built on the open Agent Skills specification — the same format supported by 40+ platforms including Claude, OpenAI Codex, and GitHub Copilot.
Tests
Project Structure
Roadmap
-
skillkit search— search community skill registries - More install targets (Codex, Copilot CLI paths as they standardize)
-
skillkit doctor— prompt-injection heuristics (planned, not implemented yet)
License
MIT — see the LICENSE file for details.
Source: README.md at commit 86d4139
Tools
0Version history
1- v1.0.2LatestSep 16, 2026
Score
50% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
- Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
- Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts