musharrafsaroof-123/skillpm

skillpm — Package manager for Agent Skills. Built on npm.

The Agent Skills spec defines what a skill is — but not how to publish, install, version, or share them. There's no registry, no dependency management, no way for one skill to build on another. Without dependencies, skills become monoliths — authors duplicate instructions because there's no way to reuse another skill.

skillpm fills that gap. It's a lightweight orchestration layer — ~630 lines of code, 3 runtime dependencies — that maps Agent Skills onto npm's ecosystem. Same package.json, same nodemodules/, same registry. Skills become npm packages you can publish, install, version, and depend on — just like any other package. Small skills that compose, not monoliths that overlap.

Quick start

# Install a skill (no global install needed)
npx skillpm install <skill-name>

# List installed skills
npx skillpm list

# Scaffold a new skill package
npx skillpm init

Or install the CLI globally:

npm install -g skillpm

Note: Skills are always workspace-local. This installs the skillpm CLI — not skills.

How it works

When you run skillpm install <skill:

• npm install — npm handles resolution, download, lockfile, nodemodules/
• Scan — skillpm scans nodemodules/ for packages containing skills//SKILL.md
• Link — for each skill found, skillpm calls skills to wire it into agent directories (Claude, Cursor, VS Code, Codex, and many more)
• Configs — for each skill with a configs/ directory, skillpm copies agent definitions, rules, and prompts into the workspace (auto-prefixed to avoid conflicts)
• MCP config — skillpm collects skillpm.mcpServers from all skills (transitively) and configures each via add-mcp

That's it. Agents see the full skill tree with MCP servers configured.

What's missing from the spec — and what skillpm adds

skillpm doesn't reinvent anything. It orchestrates three battle-tested tools: npm, skills, and add-mcp.

| The spec doesn't define... | skillpm adds... | |---|---| | A registry | Publish to npmjs.org with skillpm publish | | An install command | skillpm install resolves the full dependency tree | | Dependency management | Standard package.json dependencies — npm handles semver, lockfiles, audit | | Versioning | npm semver, package-lock.json, reproducible installs | | Agent wiring | Links skills into agent directories via skills | | Config files | Copies agent definitions, rules, and prompts from configs/ into the workspace | | MCP server config | Collects and configures MCP servers transitively via add-mcp |

Commands

| Command | Description | |---|---| | skillpm install [skill...] | Install skill(s) + full dependency tree, wire into agent dirs | | skillpm uninstall <skill... | Remove skill(s) and clean up | | skillpm list [--json] | List installed skill packages | | skillpm init | Scaffold a new skill package | | skillpm publish | Publish to npmjs.org (validates "agent-skill" keyword) | | skillpm sync | Re-wire agent directories without reinstalling | | skillpm mcp add <source... | Configure MCP server(s) across agents | | skillpm mcp list | List configured MCP servers | | skillpm <npm-command [args] | Any other command is passed through to npm |

Aliases: i/add for install, rm/remove for uninstall, ls for list.