Skillmd

com.skillmd由 skillmd.com 发布官方发布者v1.2.0更新于 Nov 9, 2026

Search, fetch, lint, and install Agent Skills (SKILL.md) from the SkillMD registry.

已验证Streamable HTTP可网页运行知识与记忆开发者工具AI 与机器学习

概览

AI 生成的概览

让助手在 SkillMD 注册表中搜索、查看、下载 Agent Skills（SKILL.md 文件）并获取推荐。

可以做什么
按任务、名称或关键词搜索 SkillMD 注册表，返回匹配技能及其 slug、分类、安全结论和安装片段，最佳匹配优先。获取单个技能的描述、SKILL.md 正文、来源信息、许可证、安全结论和能力标记，以及技能包中的附带文件列表。下载公开技能的完整内容，包括技能包的全部附带文件，可直接写入磁盘。查看按安装量、收藏和评分排序的技能排行榜，可按分类和时间范围筛选。根据某个技能所在分类获取推荐，或获取最近 30 天的热门技能。
适用场景
适合在对话中让助手查找并引入现成的 agent 指令，按安全结论和能力标记比较技能，或在自行安装前发现热门和相关技能。
运行要求
可作为基于 streamable HTTP 的远程托管端点运行，也可通过 npm 包 skillmds 用 npx 在本地运行；本地方式需要 Node.js。搜索、获取、下载、排行榜和推荐均无需账号。可选的 SKILLMD_TOKEN 用于启用已保存技能和个性化推荐；SKILLMD_API 可覆盖注册表 API 基础地址。
安装前请注意
下载的技能是供 agent 按需阅读的纯文本指令，使用前应查看其内容和能力标记；注册表会标注网络调用、脚本执行和读取密钥等能力。可选的 SKILLMD_TOKEN 是个人访问令牌，应妥善保密。该服务器本身只返回技能内容，写入磁盘是另一步操作。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Skillmd，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/com.skillmd%2Fskillmd/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "skillmd": {
      "type": "http",
      "url": "https://api.skillmd.com/mcp"
    }
  }
}

README

[SkillMD — the open registry of Agent Skills]

SkillMD

The registry that lints.
Search, install, lint and publish Agent Skills (SKILL.md) for Claude Code, Cursor, Codex and 60+ other agents.
This repo is the open-source toolchain behind skillmd.com: the CLI, the MCP server, the GitHub Action and the SKILL.md engine they share.

[skillmds on npm] [@skillmds/core on npm] [npm downloads] [CI] [MIT license]

Browse skills · Categories · Publishers · Install guides · Docs · Blog · Stats

What this is

An Agent Skill is a folder with a SKILL.md file: YAML frontmatter (name, description) plus Markdown instructions an agent loads on demand. Claude Code, Cursor, Codex, Gemini CLI, GitHub Copilot, Windsurf and dozens of other agents read the same format, which is what makes a shared registry worth having. If the format is new to you, start with What is an Agent Skill? and the anatomy of a SKILL.md file.

skillmd.com is the open registry of those skills: 1,000,000+ skills from 30,000+ publishers, every one of them linted against the format, security-scanned for what it can do, and pinned to a commit. Verdicts, capability flags and independent scanner results sit on every skill page. Installing writes files and does nothing else.

This repository is everything that runs on your machine or in your CI, MIT-licensed:

PackageWhat it isInstall
skillmdsOne npm package, two binaries: the skillmd CLI and the skillmds MCP servernpm i -g skillmds
@skillmds/coreThe SKILL.md engine: parser, lint rules, security scanner, quality score, SARIF / JSON / GitHub formattersnpm i @skillmds/core
skillmds/skillmd/actionGitHub Action: lint every skill in a repo, results in GitHub Code Scanninguses: skillmds/skillmd/action@v1

The registry applies the same engine, so a skill that passes locally passes on publish.

Quick start

bash
# Search the registry and install a skill into every agent on your machinenpx skillmds search "pdf"npx skillmds add anthropic/pdf
# Lint your own skill before you share itnpx skillmds lint ./my-skill

Plugins

A plugin is a bundle of skills that installs as one unit. In Claude Code it becomes a real plugin — /plugin lists it, and enable, disable and uninstall work on the whole set — and on every other agent the skills are installed individually.

bash
npx skillmds add plugin:skillmd/design

To browse them inside Claude Code's Plugins tab instead, add this repository as a marketplace: skillmds/skillmd. It carries the flagship plugins as real directories under plugins/, listed in .claude-plugin/marketplace.json and refreshed weekly. The tab only understands plugins that live in git, which is why the whole registry is not in there — every other plugin installs with the command above.

No account needed for any of the above. Skills land in each detected agent's own directory (.claude/skills/, .cursor/skills/, .agents/skills/, …). Per-agent walkthroughs: Claude Code · Cursor · Codex · Gemini CLI · GitHub Copilot · Windsurf · all agents.

The CLI: skillmd

bash
npm i -g skillmds
CommandWhat it does
skillmd lint [path]Validate SKILL.md files. Diagnostics, a 0–100 quality score, --fix for the mechanical ones.
skillmd scan [path]What would this skill do? Reports scripts, network calls and secret access.
skillmd rules [id]List the lint rules, or explain one.
skillmd init [name]Scaffold a new skill from a template.
skillmd search <query>Search the registry from the terminal.
skillmd add <source>Install from a registry slug, a GitHub repo or a local path. Lints first, never executes scripts.
skillmd list / remove / updateManage installed skills across agents.
skillmd publish [path]Publish to skillmd.com. Blocked on lint errors.
bash
skillmd lint . --format sarif > skillmd.sarif   # GitHub Code Scanningskillmd lint . --strict                          # warnings fail tooskillmd add owner/repo -a claude-code -g         # one agent, global scopeskillmd add some/skill --deny executes_scripts   # refuse skills that run code

skillmd add detects 68 agents by their config directories: Claude Code, Cursor, Codex, Windsurf, OpenCode, Gemini CLI, Antigravity, Kiro, Warp, GitHub Copilot, Cline, Roo Code, Goose, Trae, Qwen Code, Amp, Zed, Continue, Devin, OpenHands, Replit and more. Agents that share the .agents/skills convention are written once. Running plain skillmd opens a guided menu.

Full reference: docs/cli.md · CLI docs on skillmd.com · How one SKILL.md works in every agent

The MCP server: skillmds

Give any MCP-capable agent the whole registry. It can search, inspect, lint and install skills mid-conversation.

bash
# Claude Codeclaude mcp add skillmd -- npx -y skillmds
jsonc
// Claude Desktop, Cursor, VS Code, Windsurf, … (examples/mcp/ has per-client files){ "mcpServers": { "skillmd": { "command": "npx", "args": ["-y", "skillmds"] } } }

Or use the hosted remote server, zero install, streamable HTTP:

https://api.skillmd.com/mcp
ToolWhat the agent gets
skillmd_searchRegistry search with categories, ratings and install snippets
skillmd_getFull skill detail: body, provenance, license, security flags
skillmd_installSafe install: validated, SHA-256-verified, zip-slip-guarded, never executes scripts
skillmd_trending / skillmd_recommendLeaderboard and similar-skill suggestions
skillmd_list_savedYour saved skills (with SKILLMD_TOKEN)
skillmd_lintValidate any SKILL.md content on the spot

Full reference: docs/mcp.md · MCP docs on skillmd.com · Using SkillMD over MCP · MCP registry entry: com.skillmd/skillmd

The engine: @skillmds/core

bash
npm i @skillmds/core
ts
import { lint } from "@skillmds/core";
const { ok, score, diagnostics, security } = lint(rawSkillMd, { slug: "my-skill" });

Nine lint rules, a line-aware security scanner, a 0–100 quality score and SARIF / JSON / GitHub-annotation formatters. ESM, typed, no runtime dependency beyond yaml, runs in Node, browsers and edge runtimes.

The scanner classifies every skill into capability flags you can filter or deny on install:

FlagMeaning
docs_onlyNothing executable found. Pure instructions.
network_callsFetches, curls or otherwise talks to the network.
executes_scriptsRuns commands or bundled scripts.
reads_secretsTouches env vars, tokens or credential files.
untrusted_installFetch-and-execute from a non-standard source.

Rules and scoring: docs/rules.md · Debugging skills: lint, scan, score · Common SKILL.md mistakes

CI for your skills

yaml
- uses: skillmds/skillmd/action@v1  with:    path: .

Lints every skill in the repo and uploads SARIF to GitHub Code Scanning, so findings show up in pull requests. Full example: examples/github-action.yml · action/README.md

Publishing a skill

bash
skillmd login                   # token from your skillmd.com accountskillmd publish ./my-skill      # blocked on lint errorsskillmd publish ./my-skill --dry-run

Published skills get a page at skillmd.com/skills/<you>/<name>, a safety verdict, an install command for every agent, and a live README badge:

markdown
[![SkillMD](https://skillmd.com/badge/<you>/<name>.svg)](https://skillmd.com/skills/<you>/<name>)

Guides: Publishing a skill to the registry · Writing skills that get used · What a verified badge means · Skill packs

The registry API

Everything here is a thin client over the public API at api.skillmd.com (GET /v1/search?q=…, GET /v1/skills/<owner>/<name>, …). Described by docs/registry-api.md, skillmd.com/openapi.json and, for AI systems, skillmd.com/llms.txt. Every skill page also has a Markdown twin at …/<name>.md.

What's in the registry

Browse by category: Coding & Dev Tools · AI & ML · DevOps & Infra · Integrations & APIs · Security · Data & Analytics · Web & Frontend · Productivity · Docs & Writing · Design & Media

Or by publisher, official skills from verified publishers, the leaderboard, or what's new. Live counts: skillmd.com/stats.

Security model

Installing a skill writes files and does nothing else. No script execution, strict path containment (slug validation plus zip-slip guards), SHA-256 integrity verification against the registry's content-addressed store, and companion files pinned to GitHub raw hosts. Publishing runs the same lint and scan the CLI does, and every listed skill shows its verdict, capability flags and independent scanner results.

Details in SECURITY.md. Report vulnerabilities to [email protected].

Learn more

Development

bash
npm cinpm run build      # @skillmds/core, then skillmdsnpm test           # vitest across both packages, incl. an MCP stdio smoke testnpm run typecheck  # strict tsc

See CONTRIBUTING.md for layout, PR guidelines and the release process, and CODE_OF_CONDUCT.md.

License

MIT © SkillMD · skillmd.com · [email protected]

来源：README.md，提交 f9a48a7

工具

5

skillmd_get

Get skill details

Fetch one skill by owner/name slug: description, SKILL.md body, provenance (source repo and pinned commit), license, safety verdict and capability flags, plus companion file listing for packs.

输入参数slug必填

skillmd_download

Download skill files

Return the full contents of any public skill by owner/name slug: the SKILL.md text plus every companion file for packs, ready to write to disk. Skills are plain-text instructions an agent reads on demand; nothing executes, and every listed skill has passed SkillMD's safety review.

输入参数slug必填

skillmd_recommend

Recommend skills

Recommend skills. With based_on set to a skill's owner/name slug, returns the top skills in that skill's category (excluding itself); without it, returns what is trending over the last 30 days.

输入参数limitbased_on

版本历史

1
  1. v1.2.0最新Sep 16, 2026

评分

已满足适用检查项的 100%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分