One CLI targets 77 coding-agent integrations
Skills turns repositories containing SKILL.md files into installable instruction packages. The README names OpenCode, Claude Code, Codex, and Cursor, then says 73 more agents are supported. Each integration maps project and global skill directories, while the CLI handles source discovery and prompts for targets. This is useful for developers whose instructions otherwise get copied into several hidden folders and drift apart.
The core commands cover adding, temporary use, listing, searching, updating, removing, and initializing skills. skills use can print a generated prompt or start a supported agent with that prompt. Project installation is the default; --global writes to the user's agent locations. Interactive installs recommend a canonical copy with symlinks, while --copy produces independent copies that can diverge after manual edits.
Git, archives, and local paths are valid sources
A source can be GitHub shorthand, a full GitHub or GitLab URL, another Git URL, a local directory, a direct SKILL.md, or an archive download. Archive defaults cap downloads at 10 MiB, extracted content at 25 MiB, and file count at 1,000. Those limits reduce accidental expansion, though the README permits overrides when the user trusts the source.
Private GitHub installs first try normal Git credentials, then authenticated GitHub CLI cloning, then SSH. The program does not call gh auth token or copy that stored credential into its Node process. API lookups can use an explicit GITHUB_TOKEN or GH_TOKEN; otherwise they try anonymous access and gh api before falling back to a clone. That is a thoughtful authentication chain for private skill repositories.
What happened when we ran it
Our clean Node 22 sandbox installed 126 pnpm packages in 5 seconds and occupied 94 MB. The build succeeded in 9 seconds. Tests also succeeded, finishing in 32 seconds. commit 435076e therefore passed every install, build, and test step that our harness invoked, with no failure log to qualify.
The checkout itself was small at 1 MB, with 118 files and about 27,133 source lines. It contained 3 CI workflow files and a tests directory, but no Dockerfile. Those measurements fit a developer CLI that runs through npx; a service container would add little. They do not inspect the safety or correctness of any third-party skill installed through the tool.
Skill discovery is broad and sometimes agent-specific
Skills searches the repository root, several conventional skill containers, agent-owned paths, and Claude plugin manifests. The normal catalog walk goes 3 levels deep, with a full-depth option for less conventional layouts. If standard locations produce nothing, the CLI performs a recursive search. Valid frontmatter requires a name and description, while internal entries can be hidden unless a dedicated environment setting enables them.
Basic skill files travel well, but richer features do not. The compatibility table says allowed-tools works across most named clients. Forked context is shown only for Claude Code, and hooks work in a smaller set including Claude Code, Cline, and Kiro CLI. A shared installer cannot make an agent implement semantics it lacks, so authors still need to state which advanced fields their skill relies on.
Version 1.5.23 has a dangerous removal report
Issue 2054 reproduces a removal bug against version 1.5.23 and source commit 435076e. The report says remove counted directories that were not installed skills. In its isolated fixture, remove --all deleted skills/docs/ and skills/templates/ from a source repository because an agent integration also used skills/ as an installation path. Pull request 2055 proposes requiring SKILL.md during that scan.
That report should change current operating advice. Avoid broad removal in a repository, inspect the exact target, and keep source work under version control so deletion is recoverable. Release 1.5.23 already fixed another remove --all case involving named skills, but its changelog predates issue 2054. A separate issue reports that project updates can create duplicate skill copies on a clean CI home directory.
Telemetry and activation need deliberate settings
The CLI collects anonymous usage data by default. For public GitHub repositories, it sends repository and skill identifiers only after GitHub confirms public visibility. Other remote-source types may include those identifiers because visibility cannot be checked the same way. DISABLE_TELEMETRY=1 and DO_NOT_TRACK=1 disable collection, which regulated or private environments should set before the first command.
Installation and activation are still coupled enough that users have requested separate enable and disable state. Issue 2010 proposes global defaults with repository overrides while keeping installed files updateable. Until such management exists, exposing a skill generally follows where the CLI places or links it and how the agent scans that path. Skills is already valuable for mixed-agent teams, but filesystem scope remains part of its user interface.
August maintenance is fast and noisy
GitHub recorded 29,708 stars, a push on August 18, 2026, and release v1.5.23 on the same date. The release added a select-all control, another agent integration, private-authentication work, and fixes for pinned references and internal skills. GitHub also reported 1,127 combined issues and pull requests, a huge queue that includes directory-listing requests alongside code defects.
The passing 46 seconds of build and test work supports trying the CLI, while the removal report argues for narrow commands and recoverable repositories. Use explicit sources, pin references where stability matters, disable telemetry if identifiers are sensitive, and inspect changes after updates. That discipline leaves Skills doing its best job: translating one instruction package into the folder conventions of many agents.