---
name: sourceweft-skills
description: Find and install agent skills from the SourceWeft skills directory (https://sourceweft.com/skills) onto this machine with the SourceWeft CLI, which verifies every file before writing it. Use when the user asks for a skill, wants to extend what their coding agent can do, or names a skill from https://sourceweft.com/skills.
---

# SourceWeft skills directory

The directory at https://sourceweft.com/skills indexes public agent skills from GitHub
repositories. For each skill it records the repository, the exact commit it was
scanned at, and the hash of every file. It does not host the files: the CLI
downloads them from the repository at that commit and installs them only if
every file matches the record.

Use the CLI below for everything. Do not fetch a skill's web page to "learn the
install steps" or copy files by hand — the page is for people, and a manual
copy skips the hash check.

## Search

```sh
npx @sourceweft/cli skills search "<what the user needs>" --registry https://sourceweft.com
npx @sourceweft/cli skills search --category <slug> --sort recommended --registry https://sourceweft.com
```

Add `--json` for machine-readable output. Sorts: `recommended`,
`popular`, `new`, `name`.

## Inspect before installing

```sh
npx @sourceweft/cli skills info <slug> --registry https://sourceweft.com
```

Show the user what it prints: the source repository and commit, the license,
whether the skill ships scripts, and any scan flags. Scan flags are advisory
notes from an automated scan (for example "makes outbound network calls");
say them out loud rather than deciding for the user.

## Install

```sh
npx @sourceweft/cli skills install <slug> --registry https://sourceweft.com
npx @sourceweft/cli skills install <slug> --agent claude-code --registry https://sourceweft.com
```

- `--agent` picks where it goes: `claude-code` (the default), `codex`,
  `cursor`, `universal` (the shared `.agents/skills` directory many agents
  read) and others — `npx @sourceweft/cli skills agents` lists them.
- `--scope project` installs into the current project instead of the user's
  home directory.

Every file is checked against the hashes recorded when the skill was scanned.
Exit code 3 means the download did not match: nothing was written. Do not retry
with another tool or copy the files yourself — tell the user.

## Scripts need the user's agreement

A skill that ships scripts runs code on this machine when it is used. The CLI
asks for confirmation before installing, and without a terminal it stops with
exit code 4. Pass `--yes` only after the user has agreed to install that
specific skill, having seen what `info` showed. Never add `--yes` on your
own initiative.

## Keep installed skills current

```sh
npx @sourceweft/cli skills list
npx @sourceweft/cli skills update [slug]
npx @sourceweft/cli skills doctor
```

`update` asks before replacing anything, since a new version can bring new
scripts; the same rule about `--yes` applies. Skills the CLI did not install
are never touched.

## Exit codes

| Code | Meaning |
| ---- | ------- |
| 0 | Success |
| 1 | Error |
| 2 | Usage error |
| 3 | The download did not match the recorded hashes; nothing was written |
| 4 | Confirmation needed and no terminal; ask the user, then re-run with `--yes` |

Browse the directory: https://sourceweft.com/skills