{"id":45408520,"url":"https://github.com/anton-abyzov/vskill","last_synced_at":"2026-05-31T09:04:08.906Z","repository":{"id":338732087,"uuid":"1158844740","full_name":"anton-abyzov/vskill","owner":"anton-abyzov","description":"Secure multi-platform AI skill installer — scan before you install. 49 agents, 12 plugins, 41 expert skills.","archived":false,"fork":false,"pushed_at":"2026-05-25T06:17:55.000Z","size":7660,"stargazers_count":35,"open_issues_count":0,"forks_count":6,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-25T07:27:00.428Z","etag":null,"topics":["ai","ai-agents","claude-code","cli","copilot","cursor","developer-tools","npm-package","plugin-marketplace","security","skills","windsurf"],"latest_commit_sha":null,"homepage":"https://verified-skill.com","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/anton-abyzov.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-02-16T01:37:46.000Z","updated_at":"2026-05-25T06:17:57.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/anton-abyzov/vskill","commit_stats":null,"previous_names":["anton-abyzov/vskill"],"tags_count":250,"template":false,"template_full_name":null,"purl":"pkg:github/anton-abyzov/vskill","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anton-abyzov%2Fvskill","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anton-abyzov%2Fvskill/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anton-abyzov%2Fvskill/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anton-abyzov%2Fvskill/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/anton-abyzov","download_url":"https://codeload.github.com/anton-abyzov/vskill/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anton-abyzov%2Fvskill/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33725060,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-31T02:00:06.040Z","response_time":95,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai","ai-agents","claude-code","cli","copilot","cursor","developer-tools","npm-package","plugin-marketplace","security","skills","windsurf"],"created_at":"2026-02-21T22:09:11.871Z","updated_at":"2026-05-31T09:04:08.890Z","avatar_url":"https://github.com/anton-abyzov.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003ch1 align=\"center\"\u003evskill\u003c/h1\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003cstrong\u003eThe package manager for AI skills.\u003c/strong\u003e\u003cbr/\u003e\n  Author. Eval. Publish. Install — across 53 agent platforms.\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://www.npmjs.com/package/vskill\"\u003e\u003cimg src=\"https://img.shields.io/npm/v/vskill?color=cb3837\u0026logo=npm\" alt=\"npm\" /\u003e\u003c/a\u003e\n  \u003ca href=\"https://www.npmjs.com/package/vskill\"\u003e\u003cimg src=\"https://img.shields.io/npm/dw/vskill?color=cb3837\u0026logo=npm\u0026label=downloads\" alt=\"downloads\" /\u003e\u003c/a\u003e\n  \u003ca href=\"https://github.com/anton-abyzov/vskill/stargazers\"\u003e\u003cimg src=\"https://img.shields.io/github/stars/anton-abyzov/vskill?color=FFD700\u0026logo=github\" alt=\"GitHub stars\" /\u003e\u003c/a\u003e\n  \u003ca href=\"https://github.com/anton-abyzov/vskill/actions/workflows/desktop-release.yml\"\u003e\u003cimg src=\"https://img.shields.io/github/actions/workflow/status/anton-abyzov/vskill/desktop-release.yml?branch=main\u0026label=desktop%20build\u0026logo=githubactions\" alt=\"desktop build\" /\u003e\u003c/a\u003e\n  \u003cimg src=\"https://img.shields.io/badge/agents-53_platforms-0969DA\" alt=\"53 agents\" /\u003e\n  \u003cimg src=\"https://img.shields.io/badge/plugins-9-8B5CF6\" alt=\"9 plugins\" /\u003e\n  \u003cimg src=\"https://img.shields.io/badge/skills-16-10B981\" alt=\"16 skills\" /\u003e\n  \u003ca href=\"https://verified-skill.com\"\u003e\u003cimg src=\"https://img.shields.io/badge/registry-verified--skill.com-F59E0B\" alt=\"registry\" /\u003e\u003c/a\u003e\n  \u003ca href=\"https://github.com/anton-abyzov/vskill/blob/main/LICENSE\"\u003e\u003cimg src=\"https://img.shields.io/badge/license-MIT-green\" alt=\"MIT\" /\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003cstrong\u003eDownload Skill Studio:\u003c/strong\u003e\u003cbr/\u003e\u003cbr/\u003e\n  \u003ca href=\"https://github.com/anton-abyzov/vskill/releases/latest/download/Skill.Studio_1.0.16_aarch64.dmg\"\u003e\u003cimg src=\"https://img.shields.io/badge/Download-macOS-000000?style=for-the-badge\u0026logo=apple\u0026logoColor=white\" alt=\"Download for macOS\" /\u003e\u003c/a\u003e\n  \u003ca href=\"https://github.com/anton-abyzov/vskill/releases/latest/download/Skill.Studio_1.0.16_x64-setup.exe\"\u003e\u003cimg src=\"https://img.shields.io/badge/Download-Windows-0078D4?style=for-the-badge\u0026logo=windows\u0026logoColor=white\" alt=\"Download for Windows\" /\u003e\u003c/a\u003e\n  \u003ca href=\"https://github.com/anton-abyzov/vskill/releases/latest\"\u003e\u003cimg src=\"https://img.shields.io/badge/Download-Linux-FCC624?style=for-the-badge\u0026logo=linux\u0026logoColor=black\" alt=\"Download for Linux\" /\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003cem\u003eAll releases: \u003ca href=\"https://github.com/anton-abyzov/vskill/releases\"\u003egithub.com/anton-abyzov/vskill/releases\u003c/a\u003e\u003c/em\u003e\n\u003c/p\u003e\n\n\u003cbr/\u003e\n\n```bash\n# Browser studio — zero install\nnpx vskill@latest studio        # open the local IDE for AI skills\nnpx vskill@latest install remotion-best-practices\n```\n\nNative Mac, Windows, and Linux desktop apps available at\n**[GitHub Releases](https://github.com/anton-abyzov/vskill/releases/latest)** — 1.5 s cold launch,\nno telemetry. macOS Apple Silicon is signed by `Developer ID Application: EasyChamp, Inc.`\nand notarized + stapled by Apple — no Gatekeeper warning.\n\nThe desktop app wraps the same studio runtime as `npx vskill studio` in a Tauri 2 shell:\nnative menu bar, global `⌘K` find-skill palette, `⌘,` Preferences with General / Updates /\nPrivacy / Advanced tabs, settings persisted to `~/.vskill/settings.json` (atomic, 0600 perms),\nand signed auto-update via `tauri-plugin-updater` against minisign-signed manifests.\n\n\u003cbr/\u003e\n\n## Why vskill\n\n**36.82% of AI skills have security flaws** ([Snyk ToxicSkills](https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/)).\nAnd the ones that aren't malicious often *don't even improve the model* — they just feel like they should.\n\nvskill is built around three problems:\n\n- **Trust** — every install runs a 3-tier scan (52 patterns → blocklist → LLM intent). No `--skip-scan`.\n- **Proof** — Skill Studio runs A/B evals so you can *show* a skill makes a model better, not assume it.\n- **Reach** — one skill, 53 agents (Claude Code, Cursor, Copilot, Codex, Windsurf, Zed, Gemini CLI, Ollama, …).\n\n\u003cbr/\u003e\n\n## Skill Studio — the local IDE for skills\n\n```bash\nnpx vskill@latest studio\n```\n\nA localhost workbench opens at a deterministic per-project port. You can:\n\n- **Author** new skills with an AI-assisted generator (Anthropic skill-creator engine *or* vskill native — first-class peers, you pick).\n- **Edit** SKILL.md live with a Linear/Raycast-grade UI.\n- **Run benchmarks** with SSE-streamed pass/fail across Claude, GPT, Llama, Gemini, local Ollama / LM Studio.\n- **A/B compare** with vs. without your skill — blind LLM judge ranks outputs as EFFECTIVE / MARGINAL / INEFFECTIVE / DEGRADING.\n- **Cross-model sweep** the same skill across providers (Anthropic Batch API supported — 50% cheaper).\n- **Find skills** from the verified-skill.com registry with a `⌘⇧K` palette, install with consent + provenance.\n- **Publish** with one click — `git push` from the UI, then opens the submit form on verified-skill.com pre-filled.\n\nCORS-free by design: the browser only ever talks to localhost. The server proxies to verified-skill.com and to provider APIs. Every mutation is logged to `~/.vskill/studio-ops.jsonl` for audit.\n\n\u003cbr/\u003e\n\n## How install works\n\n```\n  ┌──────────┐     ┌──────────┐     ┌──────────┐     ┌──────────┐\n  │  Source  │────\u003e│   Scan   │────\u003e│  Verify  │────\u003e│ Install  │\n  │          │     │          │     │          │     │          │\n  │ GitHub   │     │ 52 rules │     │ LLM      │     │ Pin SHA  │\n  │ Registry │     │ Blocklist│     │ intent   │     │ Lock ver │\n  │ Local    │     │ Patterns │     │ analysis │     │ Symlink  │\n  └──────────┘     └──────────┘     └──────────┘     └──────────┘\n```\n\nEvery install runs the full pipeline. SARIF v2.1.0 output is available for CI (`vskill audit --ci`).\n\n\u003cbr/\u003e\n\n## Quick Start\n\n```bash\n# Install one skill\nnpx vskill@latest install remotion-dev/skills/remotion-best-practices\n\n# Browse a repo, pick interactively\nnpx vskill@latest install remotion-dev/skills\n\n# Install a Claude Code plugin (full domain bundle)\nnpx vskill@latest install --repo anton-abyzov/vskill --plugin frontend\n```\n\nInstall globally for repeat use: `npm i -g vskill`\n\n\u003csub\u003eBehind a private npm registry? See \u003ca href=\"https://verified-skill.com/docs/getting-started\"\u003eGetting Started\u003c/a\u003e for the E401 workaround.\u003c/sub\u003e\n\n\u003cbr/\u003e\n\n## What ships today\n\n| Surface | Count | Notes |\n|---|---|---|\n| **Agent platforms** | **53** | Claude Code, Cursor, Copilot, Windsurf, Codex, Gemini CLI, Zed, Ollama, LM Studio, … |\n| **Plugins** | **8** | Multi-skill bundles for Claude Code |\n| **Skills** | **14** | Individual SKILL.md files inside plugins |\n| **Top-level CLI commands** | **22** | `install`, `studio`, `eval`, `find`, `scan`, `audit`, `submit`, `skill`, `keys`, … |\n| **Tests** | **307 test files** | More tests than source files |\n\n### Plugins (Claude Code)\n\n| Plugin | Skills |\n|---|---|\n| **frontend** | figma-connect, frontend-design, task-skill-announcer |\n| **personal** | obsidian-brain, greet-anton, tax-filing |\n| **marketing** | slack-messaging, social-media-posting |\n| **skills** | skill-builder, scout |\n| **mobile** | appstore |\n| **google-workspace** | gws |\n| **easychamp** | tournament-manager |\n| **productivity** | survey-passing |\n\nInstall all eight: `npx vskill@latest install --repo anton-abyzov/vskill --all`\n\nBrowse the full catalog → [verified-skill.com/docs/plugins](https://verified-skill.com/docs/plugins)\n\n\u003cbr/\u003e\n\n## Commands you'll actually use\n\n```bash\nnpx vskill@latest studio               # open local IDE\nnpx vskill@latest install \u003cskill\u003e      # install with full security scan\nnpx vskill@latest find \u003cquery\u003e         # search verified-skill.com registry\nnpx vskill@latest list --installed     # what's installed where\nnpx vskill@latest diff \u003cskill\u003e v1 v2   # compare versions before upgrading\nnpx vskill@latest skill new            # create a new skill (AI-assisted)\nnpx vskill@latest eval sweep \u003cskill\u003e   # benchmark across models\nnpx vskill@latest audit --ci           # SARIF v2.1.0 for CI\nnpx vskill@latest keys set anthropic   # store API keys in ~/.vskill/keys.env\nnpx vskill@latest auth login           # sign in to GitHub for private skills\n```\n\nFull reference → [verified-skill.com/docs/cli-reference](https://verified-skill.com/docs/cli-reference)\n\n\u003cbr/\u003e\n\n## Authentication (GitHub, for private skills)\n\n`vskill auth` signs you in to GitHub using the official Device Flow so the CLI\ncan install skills from private repos and the local Studio can list your org's\nprivate catalog.\n\n```bash\nnpx vskill@latest auth login    # interactive Device Flow — copy code, visit URL\nnpx vskill@latest auth status   # show the current GitHub identity\nnpx vskill@latest auth logout   # forget the GitHub token\n```\n\nHow it works:\n\n1. `vskill auth login` requests a device + user code from `github.com/login/device/code`.\n2. You visit `https://github.com/login/device` and enter the 8-character code (rendered as `XXXX-XXXX`).\n3. The CLI polls `github.com/login/oauth/access_token` until you authorize, then validates against `api.github.com/user`.\n4. The resulting token is stored in your **OS keychain** (macOS Keychain / Windows DPAPI / libsecret).\n   On systems without a keyring daemon, the token falls back to `~/.vskill/keys.env` with mode `0600` and a startup warning.\n\nWhere the token is used:\n\n- **`vskill install \u003cgithub-url\u003e`** — added as `Authorization: Bearer …` on every fetch to `api.github.com` and `raw.githubusercontent.com`. Public skills still install anonymously.\n- **`vskill studio`** — the local eval-server proxies private routes (`/api/v1/private/*`, `/api/v1/tenants/*`) to verified-skill.com with the bearer header injected at the proxy boundary. Your browser never holds the token.\n\nConfiguration:\n\n- `VSKILL_GITHUB_CLIENT_ID` — the OAuth/App `client_id` used during Device Flow. Defaults are baked in for the public Skill Studio App; set this only if you are running a self-hosted variant.\n\nInspect status of all credentials in one place:\n\n```bash\nnpx vskill@latest keys list      # shows AI provider keys + the github slot\n```\n\n### Private skill workflow\n\nOnce authenticated, installing a private org skill is identical to a public one — the CLI silently attaches the keychain token to every `api.github.com` and `raw.githubusercontent.com` request:\n\n```bash\nnpx vskill@latest auth login                                # one-time setup\nnpx vskill@latest add https://github.com/\u003corg\u003e/\u003crepo\u003e       # private skill installs same as public\n```\n\nThe local skill bundle on disk **never contains** your GitHub token — the token is used only at fetch time. Your project's `vskill.lock` records `source: \"private\"` and the org name so future updates re-authenticate correctly.\n\nCustomer-facing setup walkthrough → [`.specweave/docs/external/private-repos-quickstart.md`](../../../.specweave/docs/external/private-repos-quickstart.md) (in the umbrella repo).\n\n## Security \u0026 Compliance\n\nSkill Studio private-repo support (increment 0826) ships with documented threat model, verification checklist, SOC 2 evidence map, and operational runbooks — all in the umbrella repo under `.specweave/docs/`:\n\n- **Customer quickstart** — `.specweave/docs/external/private-repos-quickstart.md`\n- **Vendor security questionnaire** — `.specweave/docs/external/security-questionnaire-template.md`\n- **Threat model \u0026 verification checklist** — `.specweave/docs/internal/security/0826-*.md`\n- **SOC 2 evidence map** — `.specweave/docs/internal/compliance/0826-soc2-evidence-map.md`\n- **Operations + rotation runbooks** — `.specweave/docs/internal/runbooks/0826-*.md`\n\n\u003cbr/\u003e\n\n## Recent highlights (0.5.x)\n\n- **0.5.129** — Studio Publish: one-click `git push` + open verified-skill.com submit pre-filled\n- **0.5.12x** — Studio Find palette (`⌘⇧K`): search the registry from inside Studio\n- **0.5.11x** — Engine selector in Create flow: choose Anthropic skill-creator *or* vskill native\n- **0.5.10x** — Multi-project tabs, deterministic per-project port (3077–3177), bookmarkable URLs\n- **0.5.0x** — A/B comparison with blind LLM judge, cross-model sweep, MCP-skill simulation mode\n\nFull changelog → [github.com/anton-abyzov/vskill/releases](https://github.com/anton-abyzov/vskill/releases)\n\n\u003cbr/\u003e\n\n## Learn more\n\n| Topic | Where |\n|---|---|\n| Quick start \u0026 first install | [verified-skill.com/docs/getting-started](https://verified-skill.com/docs/getting-started) |\n| Full CLI reference | [verified-skill.com/docs/cli-reference](https://verified-skill.com/docs/cli-reference) |\n| Security model \u0026 3-tier verification | [verified-skill.com/docs/security-guidelines](https://verified-skill.com/docs/security-guidelines) |\n| Plugin marketplace | [verified-skill.com/docs/plugins](https://verified-skill.com/docs/plugins) |\n| Submit a skill for verification | [verified-skill.com/docs/submitting](https://verified-skill.com/docs/submitting) |\n| FAQ | [verified-skill.com/docs/faq](https://verified-skill.com/docs/faq) |\n| Browse the registry | [verified-skill.com](https://verified-skill.com) |\n\n\u003cbr/\u003e\n\n## Contributing\n\nIssues and PRs welcome at [github.com/anton-abyzov/vskill](https://github.com/anton-abyzov/vskill). To submit a skill to the registry, see [verified-skill.com/docs/submitting](https://verified-skill.com/docs/submitting).\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanton-abyzov%2Fvskill","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fanton-abyzov%2Fvskill","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanton-abyzov%2Fvskill/lists"}