Skillmd

com.skillmd由 skillmd.com 發布官方發布者v1.2.0更新於 Nov 9, 2026

Search, fetch, lint, and install Agent Skills (SKILL.md) from the SkillMD registry.

已驗證Streamable HTTP可網頁執行知識與記憶開發者工具AI 與機器學習

概覽

AI 產生的概覽

讓助理在 SkillMD 註冊表中搜尋、檢視、下載 Agent Skills（SKILL.md 檔案）並取得推薦。

可以做什麼
依任務、名稱或關鍵字搜尋 SkillMD 註冊表，回傳符合的技能及其 slug、分類、安全結論與安裝片段，最佳符合者優先。取得單一技能的描述、SKILL.md 內容、來源資訊、授權條款、安全結論與能力標記，以及技能包中的附帶檔案清單。下載公開技能的完整內容，包含技能包的所有附帶檔案，可直接寫入磁碟。檢視依安裝量、收藏與評分排序的技能排行榜，可依分類與時間範圍篩選。依某個技能所屬分類取得推薦，或取得最近 30 天的熱門技能。
適用情境
適合在對話中讓助理尋找並引入現成的 agent 指令、依安全結論與能力標記比較技能，或在自行安裝前探索熱門與相關技能。
執行需求
可作為以 streamable HTTP 提供的遠端託管端點執行，也可透過 npm 套件 skillmds 以 npx 在本機執行；本機方式需要 Node.js。搜尋、取得、下載、排行榜與推薦皆不需帳號。選用的 SKILLMD_TOKEN 可啟用已儲存技能與個人化推薦；SKILLMD_API 可覆寫註冊表 API 基礎位址。
安裝前請注意
下載的技能是供 agent 視需要閱讀的純文字指令，使用前應檢視其內容與能力標記；註冊表會標示網路呼叫、腳本執行與讀取密鑰等能力。選用的 SKILLMD_TOKEN 是個人存取權杖，應妥善保密。此伺服器本身只回傳技能內容，寫入磁碟是另一個步驟。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Skillmd，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。

交給代理程式安裝

把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。

閱讀 https://sourceweft.com/mcp/com.skillmd%2Fskillmd/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。

檢視代理程式所依據的安裝指南

其他 MCP 客戶端

把它新增到你客戶端的 mcpServers 設定中。

{
  "mcpServers": {
    "skillmd": {
      "type": "http",
      "url": "https://api.skillmd.com/mcp"
    }
  }
}

README

[SkillMD — the open registry of Agent Skills]

SkillMD

The registry that lints.
Search, install, lint and publish Agent Skills (SKILL.md) for Claude Code, Cursor, Codex and 60+ other agents.
This repo is the open-source toolchain behind skillmd.com: the CLI, the MCP server, the GitHub Action and the SKILL.md engine they share.

[skillmds on npm] [@skillmds/core on npm] [npm downloads] [CI] [MIT license]

Browse skills · Categories · Publishers · Install guides · Docs · Blog · Stats

What this is

An Agent Skill is a folder with a SKILL.md file: YAML frontmatter (name, description) plus Markdown instructions an agent loads on demand. Claude Code, Cursor, Codex, Gemini CLI, GitHub Copilot, Windsurf and dozens of other agents read the same format, which is what makes a shared registry worth having. If the format is new to you, start with What is an Agent Skill? and the anatomy of a SKILL.md file.

skillmd.com is the open registry of those skills: 1,000,000+ skills from 30,000+ publishers, every one of them linted against the format, security-scanned for what it can do, and pinned to a commit. Verdicts, capability flags and independent scanner results sit on every skill page. Installing writes files and does nothing else.

This repository is everything that runs on your machine or in your CI, MIT-licensed:

PackageWhat it isInstall
skillmdsOne npm package, two binaries: the skillmd CLI and the skillmds MCP servernpm i -g skillmds
@skillmds/coreThe SKILL.md engine: parser, lint rules, security scanner, quality score, SARIF / JSON / GitHub formattersnpm i @skillmds/core
skillmds/skillmd/actionGitHub Action: lint every skill in a repo, results in GitHub Code Scanninguses: skillmds/skillmd/action@v1

The registry applies the same engine, so a skill that passes locally passes on publish.

Quick start

bash
# Search the registry and install a skill into every agent on your machinenpx skillmds search "pdf"npx skillmds add anthropic/pdf
# Lint your own skill before you share itnpx skillmds lint ./my-skill

Plugins

A plugin is a bundle of skills that installs as one unit. In Claude Code it becomes a real plugin — /plugin lists it, and enable, disable and uninstall work on the whole set — and on every other agent the skills are installed individually.

bash
npx skillmds add plugin:skillmd/design

To browse them inside Claude Code's Plugins tab instead, add this repository as a marketplace: skillmds/skillmd. It carries the flagship plugins as real directories under plugins/, listed in .claude-plugin/marketplace.json and refreshed weekly. The tab only understands plugins that live in git, which is why the whole registry is not in there — every other plugin installs with the command above.

No account needed for any of the above. Skills land in each detected agent's own directory (.claude/skills/, .cursor/skills/, .agents/skills/, …). Per-agent walkthroughs: Claude Code · Cursor · Codex · Gemini CLI · GitHub Copilot · Windsurf · all agents.

The CLI: skillmd

bash
npm i -g skillmds
CommandWhat it does
skillmd lint [path]Validate SKILL.md files. Diagnostics, a 0–100 quality score, --fix for the mechanical ones.
skillmd scan [path]What would this skill do? Reports scripts, network calls and secret access.
skillmd rules [id]List the lint rules, or explain one.
skillmd init [name]Scaffold a new skill from a template.
skillmd search <query>Search the registry from the terminal.
skillmd add <source>Install from a registry slug, a GitHub repo or a local path. Lints first, never executes scripts.
skillmd list / remove / updateManage installed skills across agents.
skillmd publish [path]Publish to skillmd.com. Blocked on lint errors.
bash
skillmd lint . --format sarif > skillmd.sarif   # GitHub Code Scanningskillmd lint . --strict                          # warnings fail tooskillmd add owner/repo -a claude-code -g         # one agent, global scopeskillmd add some/skill --deny executes_scripts   # refuse skills that run code

skillmd add detects 68 agents by their config directories: Claude Code, Cursor, Codex, Windsurf, OpenCode, Gemini CLI, Antigravity, Kiro, Warp, GitHub Copilot, Cline, Roo Code, Goose, Trae, Qwen Code, Amp, Zed, Continue, Devin, OpenHands, Replit and more. Agents that share the .agents/skills convention are written once. Running plain skillmd opens a guided menu.

Full reference: docs/cli.md · CLI docs on skillmd.com · How one SKILL.md works in every agent

The MCP server: skillmds

Give any MCP-capable agent the whole registry. It can search, inspect, lint and install skills mid-conversation.

bash
# Claude Codeclaude mcp add skillmd -- npx -y skillmds
jsonc
// Claude Desktop, Cursor, VS Code, Windsurf, … (examples/mcp/ has per-client files){ "mcpServers": { "skillmd": { "command": "npx", "args": ["-y", "skillmds"] } } }

Or use the hosted remote server, zero install, streamable HTTP:

https://api.skillmd.com/mcp
ToolWhat the agent gets
skillmd_searchRegistry search with categories, ratings and install snippets
skillmd_getFull skill detail: body, provenance, license, security flags
skillmd_installSafe install: validated, SHA-256-verified, zip-slip-guarded, never executes scripts
skillmd_trending / skillmd_recommendLeaderboard and similar-skill suggestions
skillmd_list_savedYour saved skills (with SKILLMD_TOKEN)
skillmd_lintValidate any SKILL.md content on the spot

Full reference: docs/mcp.md · MCP docs on skillmd.com · Using SkillMD over MCP · MCP registry entry: com.skillmd/skillmd

The engine: @skillmds/core

bash
npm i @skillmds/core
ts
import { lint } from "@skillmds/core";
const { ok, score, diagnostics, security } = lint(rawSkillMd, { slug: "my-skill" });

Nine lint rules, a line-aware security scanner, a 0–100 quality score and SARIF / JSON / GitHub-annotation formatters. ESM, typed, no runtime dependency beyond yaml, runs in Node, browsers and edge runtimes.

The scanner classifies every skill into capability flags you can filter or deny on install:

FlagMeaning
docs_onlyNothing executable found. Pure instructions.
network_callsFetches, curls or otherwise talks to the network.
executes_scriptsRuns commands or bundled scripts.
reads_secretsTouches env vars, tokens or credential files.
untrusted_installFetch-and-execute from a non-standard source.

Rules and scoring: docs/rules.md · Debugging skills: lint, scan, score · Common SKILL.md mistakes

CI for your skills

yaml
- uses: skillmds/skillmd/action@v1  with:    path: .

Lints every skill in the repo and uploads SARIF to GitHub Code Scanning, so findings show up in pull requests. Full example: examples/github-action.yml · action/README.md

Publishing a skill

bash
skillmd login                   # token from your skillmd.com accountskillmd publish ./my-skill      # blocked on lint errorsskillmd publish ./my-skill --dry-run

Published skills get a page at skillmd.com/skills/<you>/<name>, a safety verdict, an install command for every agent, and a live README badge:

markdown
[![SkillMD](https://skillmd.com/badge/<you>/<name>.svg)](https://skillmd.com/skills/<you>/<name>)

Guides: Publishing a skill to the registry · Writing skills that get used · What a verified badge means · Skill packs

The registry API

Everything here is a thin client over the public API at api.skillmd.com (GET /v1/search?q=…, GET /v1/skills/<owner>/<name>, …). Described by docs/registry-api.md, skillmd.com/openapi.json and, for AI systems, skillmd.com/llms.txt. Every skill page also has a Markdown twin at …/<name>.md.

What's in the registry

Browse by category: Coding & Dev Tools · AI & ML · DevOps & Infra · Integrations & APIs · Security · Data & Analytics · Web & Frontend · Productivity · Docs & Writing · Design & Media

Or by publisher, official skills from verified publishers, the leaderboard, or what's new. Live counts: skillmd.com/stats.

Security model

Installing a skill writes files and does nothing else. No script execution, strict path containment (slug validation plus zip-slip guards), SHA-256 integrity verification against the registry's content-addressed store, and companion files pinned to GitHub raw hosts. Publishing runs the same lint and scan the CLI does, and every listed skill shows its verdict, capability flags and independent scanner results.

Details in SECURITY.md. Report vulnerabilities to [email protected].

Learn more

Development

bash
npm cinpm run build      # @skillmds/core, then skillmdsnpm test           # vitest across both packages, incl. an MCP stdio smoke testnpm run typecheck  # strict tsc

See CONTRIBUTING.md for layout, PR guidelines and the release process, and CODE_OF_CONDUCT.md.

License

MIT © SkillMD · skillmd.com · [email protected]

來源：README.md，提交 f9a48a7

工具

5

skillmd_get

Get skill details

Fetch one skill by owner/name slug: description, SKILL.md body, provenance (source repo and pinned commit), license, safety verdict and capability flags, plus companion file listing for packs.

輸入參數slug必填

skillmd_download

Download skill files

Return the full contents of any public skill by owner/name slug: the SKILL.md text plus every companion file for packs, ready to write to disk. Skills are plain-text instructions an agent reads on demand; nothing executes, and every listed skill has passed SkillMD's safety review.

輸入參數slug必填

skillmd_recommend

Recommend skills

Recommend skills. With based_on set to a skill's owner/name slug, returns the top skills in that skill's category (excluding itself); without it, returns what is trending over the last 30 days.

輸入參數limitbased_on

版本歷史

1
  1. v1.2.0最新Sep 16, 2026

評分

已滿足適用檢查項的 100%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通必需25 分
  • 已宣告認證方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分