skillkit

io.github.furkan708由 GitHub 帳號 furkan708 發布v1.0.2更新於 Nov 10, 2026

Toolbox for AI agent skills: scaffold, lint, pack, install, and serve SKILL.md skills

概覽

AI 產生的概覽

透過本機 MCP 伺服器,讓助理探索、讀取並檢查已安裝的 SKILL.md 代理技能。

可以做什麼
skillkit 是針對 AI 代理技能的 Python 工具箱,同時以 stdio 方式作為本機 MCP 伺服器執行。透過 MCP 提供三個工具:list_skills 列出已安裝技能的名稱與描述,read_skill 讀取某個技能完整的 SKILL.md 指示,lint_skill 驗證技能並回傳品質分數。同一個套件也提供建立、檢查、打包、安裝、列出與移除技能的 CLI 指令。
適用情境
適合維護 SKILL.md 技能庫、希望助理依需求找到並載入合適技能的情況,也適合在發佈前檢查技能的品質與安全問題。適用於 Claude Code、Cursor 等從本機目錄讀取技能的 MCP 用戶端。
執行需求
以本機 Python 套件(skillkit-cli)透過 stdio 執行;未宣告驗證、環境變數或標頭。可用 pipx 或 uvx 安裝,也可從原始碼安裝。技能從 ~/.claude/skills 等目錄讀取,可用 --dir 指定。
安裝前請注意
install 指令可從任意 git 網址取得技能並寫入技能目錄,remove 會刪除已安裝技能,執行前應確認來源與目標。檢查器會回報技能檔案中外洩的 API 金鑰、私鑰等機密,但這只是檢查,並非保證。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 skillkit,將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only,透過 STDIO。 STDIO 服務會啟動本機處理程序,因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

skillkit

[Python] [License] [Tests] [CI] [Code style: ruff] [Types: mypy] [Dependencies]

The toolbox for AI agent skills. Scaffold, lint, pack, and install SKILL.md skills — and serve your whole skill library to Claude Code, Cursor, and any MCP client with a built-in Model Context Protocol server.

[skillkit terminal demo]

Community audits found that the overwhelming majority of published SKILL.md files carry at least one "skill smell" — and a large share leak secrets. skillkit catches those before you ship.

Deep docs: Usage guide — lint rules reference, MCP patterns, CI usage · Architecture · Contributing · Changelog · Security

Features

  • new — scaffold a spec-compliant skill folder in one command
  • lint — validate against the Agent Skills spec plus security smells: leaked API keys, vague descriptions, oversized bodies, folder typos, and more (scored 0–100 with a grade)
  • pack — zip a skill for upload to skill-capable platforms
  • install — install from a folder or any git URL into ~/.claude/skills (or your own directory)
  • list / remove — manage your installed skill library
  • mcp — a zero-dependency MCP server (stdio, JSON-RPC 2.0) that exposes list_skills, read_skill, and lint_skill tools to any client
  • Zero dependencies — pure Python standard library
  • 76 tests, CI on Python 3.10 → 3.12

Quick start

bash
# run without installing (uvx — pulls from PyPI on demand)uvx --from skillkit-cli skillkit lint ./skills
# or install (installs the `skillkit` command)pipx install skillkit-cli
# ...or from sourcegit clone https://github.com/furkan708/skillkit.gitcd skillkit && pip install .
# 1. create a skillskillkit new commit-writer -d "Writes conventional commit messages from staged diffs. Use when the user asks to commit changes."
# 2. lint it (spec + security + quality)skillkit lint commit-writer# ✓ no issues found# score: 100/100 (grade A) · 0 errors · 0 warnings · 0 notes
# 3. pack it for uploadskillkit pack commit-writer        # → commit-writer.zip
# 4. install it for Claude Codeskillkit install ./commit-writer   # → ~/.claude/skills/commit-writer

Serve your skills over MCP

Add skillkit to any MCP client config — Claude Code, Cursor, Windsurf, and every other MCP-compatible agent:

json
{  "mcpServers": {    "skillkit": { "command": "skillkit", "args": ["mcp"] }  }}

Your agent can now discover and read every installed skill on demand:

ToolWhat it does
list_skillsDiscover installed skills with names + descriptions
read_skillLoad the full SKILL.md instructions of one skill
lint_skillValidate a skill and get its quality score

What lint catches

RuleSeverityCheck
SEC001errorLeaked secrets: GitHub/AWS/OpenAI/Slack tokens, private keys, hardcoded credentials
SKILL001errorInvalid name: charset, length ≤ 64, reserved words (anthropic, claude)
SKILL002errorname does not match the folder name
SKILL003errordescription longer than 1,024 characters
SKILL009errormetadata is not a string→string map
SKILL004warnVague description (won't trigger — describe what and when)
SKILL005warnBody over ~500 lines (move detail into references/)
SKILL007warnFolder typos: script/, reference/, docs/…
SKILL006· infoVery thin body — add steps and examples
SKILL008· infoUnknown frontmatter fields

Every run ends with a 0–100 score and a letter grade, so you know when a skill is ready to publish.

CLI reference

skillkit new <name> -d <description> [--dir DIR]   scaffold a skillskillkit lint <path> [--json] [--strict]           validate a skillskillkit pack <path> [-o FILE.zip]                 zip for uploadskillkit install <path|git-url> [--agent claude|project] [--dir DIR]skillkit list [--agent ...] [--dir DIR] [--json]   show installed skillsskillkit remove <name> [--dir DIR]                 uninstall a skillskillkit mcp [--dir DIR]                           serve skills over MCP

Built on the open Agent Skills specification — the same format supported by 40+ platforms including Claude, OpenAI Codex, and GitHub Copilot.

Tests

bash
pip install pytestpytest -v

Project Structure

skillkit/├── skillkit/│   ├── frontmatter.py   # minimal YAML frontmatter parser│   ├── model.py         # skill loading (Agent Skills spec)│   ├── linter.py        # rules, security smells, 0-100 score│   ├── scaffold.py      # new + pack│   ├── installer.py     # install / list / remove (folder or git)│   ├── mcp_server.py    # zero-dependency MCP stdio server│   └── cli.py           # command-line interface└── tests/

Roadmap

  • skillkit search — search community skill registries
  • More install targets (Codex, Copilot CLI paths as they standardize)
  • skillkit doctor — prompt-injection heuristics (planned, not implemented yet)

License

MIT — see the LICENSE file for details.

來源:README.md,提交 86d4139

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包,因此其工具未知。

版本歷史

1
  1. v1.0.2最新Sep 16, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度,依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價,也不表示伺服器安全或目前可用:可連通性是帶日期的檢查結果,評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手;SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭,或保持端點能夠回應探測,以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list,或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分