One package manager for a fragmented agent world
Coding-agent skills are mostly folders containing a SKILL.md file, optional scripts and references, and YAML frontmatter describing when the agent should use the instructions. The format is simple. Distribution is not. Claude Code looks in .claude/skills, Codex has its own locations, and dozens of other agents use variations under .agents, application-specific folders, or user configuration directories.
Vercel Labs' skills CLI turns that path matrix into one interface. The README lists support for Claude Code, Codex, Cursor, OpenCode, and more than 70 other agents. Run npx skills add owner/repo, choose skills and target agents, and the tool discovers valid files and writes them where each agent expects them.
The project is a manager, not a bundle of Vercel prompts. It installs from GitHub shorthand, full GitHub or GitLab URLs, arbitrary Git remotes, local directories, direct file URLs, and common archives. The skills.sh directory adds discovery, but a skill does not have to be listed there to work. This openness is both the product's strength and its central risk.
Installation and daily use are well designed
Project scope is the default. Skills land inside the repository's agent directories, where a team can inspect and commit them. Global scope puts them under user directories for reuse across projects. Interactive installation recommends one canonical copy with symlinks into each agent folder, avoiding a pile of independent copies that drift. The --copy option covers environments where links are undesirable or unavailable.
The command set feels like a small package manager. list shows installed skills, find searches by keyword or repository owner, update refreshes all or selected entries, remove cleans up selected agents or scopes, and init creates a valid starter file. Non-interactive flags make a reviewed skill set reproducible in onboarding scripts. use can resolve a skill into a temporary directory and print a generated prompt, or start a supported agent with it, which is useful for trying a narrow workflow without a permanent install.
Private repository handling is unusually thoughtful. The CLI tries normal Git credentials, authenticated GitHub CLI cloning, and SSH rather than extracting a stored GitHub token into its Node process. Explicit GITHUB_TOKEN and GH_TOKEN values are supported for API access. Direct downloads also have default limits for bytes, expanded size, and file count, reducing accidental archive explosions.
There is one prerequisite the README should surface earlier: package metadata requires Node.js 22.20 or newer. That is easy on a current developer laptop and awkward in an older enterprise image. npx saves a separate global installation, but it does not remove the runtime version requirement.
Portable instructions are not identical behavior
Basic markdown skills transfer well because agents can all read procedural instructions. The CLI knows many native directories and can discover nested catalogs, experimental and system folders, plus skill paths declared by Claude plugin manifests. For an author, that is far better than shipping separate installers for every agent.
The compatibility table prevents overpromising. allowed-tools works across many listed agents, but context: fork is shown only for Claude Code. Hooks are supported by Claude Code, Cline, and Kiro CLI in the table, not by most other targets. A skill that depends on these features is not made portable merely because its folder can be copied. Authors should keep the core instructions agent-neutral, label special behavior, and test on every agent they claim to support.
The same warning applies to universal conversions. An open report against v1.5.21 says a universal-agent copy lost required name frontmatter and other custom keys even though the canonical copy stayed intact. Another report says some global installations wrote only to the canonical directory and skipped the agent-specific global path the selected CLI actually reads. With a fast-growing list of targets, path detection and frontmatter preservation are ongoing maintenance work. Verify with skills list and a real agent launch, not just a successful install message.
Treat skills like executable dependencies
A skill can tell an agent how to create pull requests, call external services, run scripts, or choose tools. Installing one changes the instructions given to software that may already have shell, repository, and network access. Read the complete SKILL.md, scripts, and referenced files before use. Prefer a commit you have reviewed, and inspect updates as carefully as dependency upgrades.
This matters because current conflict behavior can be destructive. An August 2026 issue shows v1.5.22 replacing an existing same-name Claude Code skill without prompting, including replacing a user-managed symlink with an upstream directory. A fix pull request is already open, but users on the released version should check target names first. Another open request explains that updates reinstall whole skill directories, so local helper files and edits disappear. Keep customization in your own source repository, never inside a managed installation.
Telemetry is documented and optional. Confirmed-public GitHub repository and skill identifiers may be sent, while other remote source types may include identifiers because their visibility cannot be verified through GitHub. Security-audit requests are limited to confirmed-public GitHub repositories. Set DISABLE_TELEMETRY=1 or DO_NOT_TRACK=1 for confidential environments and do your own review regardless of catalog status.
Health and the recommendation
The project was pushed on August 9, 2026, and v1.5.22 shipped on August 5 after a steady series of July releases. Its GitHub open count of 1,012 includes issues and pull requests, plus many catalog listing and re-audit requests, so it is not a thousand confirmed CLI defects. Recent work fixed private authentication, update host handling, portable lockfile sources, nested discovery, and removal bookkeeping. The pace is excellent, although the volume of new agents and sources keeps exposing edge cases.
Use skills when cross-agent distribution is a recurring problem. For one agent and two local instructions, manually committing a skill folder may be simpler and easier to audit. For a team or a multi-agent workstation, this CLI earns its place, provided you use reviewed sources, avoid modifying installed copies, verify each target path, and make updates visible in code review.