skillkit

io.github.furkan708由 GitHub 账号 furkan708 发布v1.0.2更新于 Nov 10, 2026

Toolbox for AI agent skills: scaffold, lint, pack, install, and serve SKILL.md skills

概览

AI 生成的概览

通过本地 MCP 服务器,让助手发现、读取并检查已安装的 SKILL.md 智能体技能。

可以做什么
skillkit 是一个面向 AI 智能体技能的 Python 工具箱,同时以 stdio 方式作为本地 MCP 服务器运行。通过 MCP 它提供三个工具:list_skills 列出已安装技能的名称和描述,read_skill 读取某个技能完整的 SKILL.md 指令,lint_skill 校验技能并返回质量评分。同一软件包还提供脚手架、检查、打包、安装、列出和删除技能的 CLI 命令。
适用场景
适合维护 SKILL.md 技能库、希望助手按需查找并加载合适技能的场景,也适合在发布前检查技能的质量与安全问题。适用于 Claude Code、Cursor 等从本地目录读取技能的 MCP 客户端。
运行要求
作为本地 Python 软件包(skillkit-cli)通过 stdio 运行;未声明认证、环境变量或请求头。可用 pipx 或 uvx 安装,也可从源码安装。技能从 ~/.claude/skills 等目录读取,可用 --dir 指定。
安装前请注意
install 命令可从任意 git 地址获取技能并写入技能目录,remove 会删除已安装技能,运行前应确认来源和目标。检查器会报告技能文件中泄露的 API 密钥、私钥等机密,但这只是检查,并非保证。

安装

在 SourceWeft 中

  1. 打开 控制台中的 skillkit,将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only,通过 STDIO。 STDIO 服务会启动本地进程,因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

skillkit

[Python] [License] [Tests] [CI] [Code style: ruff] [Types: mypy] [Dependencies]

The toolbox for AI agent skills. Scaffold, lint, pack, and install SKILL.md skills — and serve your whole skill library to Claude Code, Cursor, and any MCP client with a built-in Model Context Protocol server.

[skillkit terminal demo]

Community audits found that the overwhelming majority of published SKILL.md files carry at least one "skill smell" — and a large share leak secrets. skillkit catches those before you ship.

Deep docs: Usage guide — lint rules reference, MCP patterns, CI usage · Architecture · Contributing · Changelog · Security

Features

  • new — scaffold a spec-compliant skill folder in one command
  • lint — validate against the Agent Skills spec plus security smells: leaked API keys, vague descriptions, oversized bodies, folder typos, and more (scored 0–100 with a grade)
  • pack — zip a skill for upload to skill-capable platforms
  • install — install from a folder or any git URL into ~/.claude/skills (or your own directory)
  • list / remove — manage your installed skill library
  • mcp — a zero-dependency MCP server (stdio, JSON-RPC 2.0) that exposes list_skills, read_skill, and lint_skill tools to any client
  • Zero dependencies — pure Python standard library
  • 76 tests, CI on Python 3.10 → 3.12

Quick start

bash
# run without installing (uvx — pulls from PyPI on demand)uvx --from skillkit-cli skillkit lint ./skills
# or install (installs the `skillkit` command)pipx install skillkit-cli
# ...or from sourcegit clone https://github.com/furkan708/skillkit.gitcd skillkit && pip install .
# 1. create a skillskillkit new commit-writer -d "Writes conventional commit messages from staged diffs. Use when the user asks to commit changes."
# 2. lint it (spec + security + quality)skillkit lint commit-writer# ✓ no issues found# score: 100/100 (grade A) · 0 errors · 0 warnings · 0 notes
# 3. pack it for uploadskillkit pack commit-writer        # → commit-writer.zip
# 4. install it for Claude Codeskillkit install ./commit-writer   # → ~/.claude/skills/commit-writer

Serve your skills over MCP

Add skillkit to any MCP client config — Claude Code, Cursor, Windsurf, and every other MCP-compatible agent:

json
{  "mcpServers": {    "skillkit": { "command": "skillkit", "args": ["mcp"] }  }}

Your agent can now discover and read every installed skill on demand:

ToolWhat it does
list_skillsDiscover installed skills with names + descriptions
read_skillLoad the full SKILL.md instructions of one skill
lint_skillValidate a skill and get its quality score

What lint catches

RuleSeverityCheck
SEC001errorLeaked secrets: GitHub/AWS/OpenAI/Slack tokens, private keys, hardcoded credentials
SKILL001errorInvalid name: charset, length ≤ 64, reserved words (anthropic, claude)
SKILL002errorname does not match the folder name
SKILL003errordescription longer than 1,024 characters
SKILL009errormetadata is not a string→string map
SKILL004warnVague description (won't trigger — describe what and when)
SKILL005warnBody over ~500 lines (move detail into references/)
SKILL007warnFolder typos: script/, reference/, docs/…
SKILL006· infoVery thin body — add steps and examples
SKILL008· infoUnknown frontmatter fields

Every run ends with a 0–100 score and a letter grade, so you know when a skill is ready to publish.

CLI reference

skillkit new <name> -d <description> [--dir DIR]   scaffold a skillskillkit lint <path> [--json] [--strict]           validate a skillskillkit pack <path> [-o FILE.zip]                 zip for uploadskillkit install <path|git-url> [--agent claude|project] [--dir DIR]skillkit list [--agent ...] [--dir DIR] [--json]   show installed skillsskillkit remove <name> [--dir DIR]                 uninstall a skillskillkit mcp [--dir DIR]                           serve skills over MCP

Built on the open Agent Skills specification — the same format supported by 40+ platforms including Claude, OpenAI Codex, and GitHub Copilot.

Tests

bash
pip install pytestpytest -v

Project Structure

skillkit/├── skillkit/│   ├── frontmatter.py   # minimal YAML frontmatter parser│   ├── model.py         # skill loading (Agent Skills spec)│   ├── linter.py        # rules, security smells, 0-100 score│   ├── scaffold.py      # new + pack│   ├── installer.py     # install / list / remove (folder or git)│   ├── mcp_server.py    # zero-dependency MCP stdio server│   └── cli.py           # command-line interface└── tests/

Roadmap

  • skillkit search — search community skill registries
  • More install targets (Codex, Copilot CLI paths as they standardize)
  • skillkit doctor — prompt-injection heuristics (planned, not implemented yet)

License

MIT — see the LICENSE file for details.

来源:README.md,提交 86d4139

工具

0
SourceWeft 尚未在沙箱中启动过该软件包,因此其工具未知。

版本历史

1
  1. v1.0.2最新Sep 16, 2026

评分

已满足适用检查项的 50%

该评分衡量此收录条目的完整程度,依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价,也不表示服务器安全或当前可用:可连通性是带日期的检查结果,评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手;SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头,或保持端点能够响应探测,以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list,或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分