skillhub

Trusted skill marketplace for AI agents. One manifest, many runtimes.

A skill is a small tool that an AI agent (Hermes, Claude Code, Codex, Cursor) can call as a black box. skillhub is the place where:

maintainers publish skills once, in a universal skill.yaml,
agents and humans discover them via skillhub search,
they install into the right runtime with skillhub install <name> <runtime>.

No domain. No accounts. No money involved — yet. Just the protocol, the CLI, and a registry of 20 seed skills.

Status

v0.0.1 — local CLI, no network, no payments. The goal of v0.0.1 is to prove the manifest format and the discoverability workflow before we add infrastructure.

What's here

File	What it is
`manifest_spec.md`	Universal skill manifest, v0.1
`src/skillhub/cli.py`	CLI: `search`, `show`, `install`, `validate`, `publish`
`src/skillhub_mcp/server.py`	MCP server exposing the same 4 tools to agents
`src/skillhub/trust.py`	Trust Score v0.2 (real GitHub signals)
`src/skillhub/scan.py`	Static security scanner
`registry/skills.jsonl`	254 curated skills (incl. `skillhub-mcp` itself)
`registry/trust.json`	Cached trust scores (TTL 6h)
`scripts/seed_from_sources.py`	Idempotent importer from public registries
`scripts/enrich_tags.py`	Tag enrichment via token frequency
`pyproject.toml`	`uv tool install -e .`

Install (local)

Requires uv (a fast Python package manager). On macOS: brew install uv. The CLI is then globally available as skillhub.

git clone https://github.com/djmarat/skillhub
cd skillhub
uv tool install -e .            # installs skillhub + skillhub-mcp
skillhub search "pdf"           # try it

To re-install after pulling new code:

cd skillhub
uv tool install -e . --force

Usage

# Search the local registry
skillhub search "search"             # human table
skillhub search "pdf" --json         # agent-friendly, one JSON per line

# Show one skill in detail
skillhub show pdf-md

# Install into a runtime
skillhub install pdf-md --runtime hermes
# or
skillhub install pdf-md -r claude-code

# Validate your own skill.yaml
skillhub validate ./my-skill/skill.yaml

As an MCP server (`skillhub-mcp`)

For AI agents that speak MCP (Claude Code, Hermes, Codex, Cursor), skillhub ships its own marketplace as a server. Connect once, then search/show/install/validate skills as tool calls — no copy-paste, no scraping.

{
  "mcpServers": {
    "skillhub": {
      "command": "skillhub-mcp"
    }
  }
}

If you don't have uv tool installed globally, fall back to the dev form:

{
  "mcpServers": {
    "skillhub": {
      "command": "python",
      "args": ["-m", "skillhub_mcp.server"],
      "cwd": "/path/to/skillhub"
    }
  }
}

The server exposes 15 tools — full agent lifecycle:

Tool	When the agent uses it
`search`	"I need a tool that does X"
`show`	"Tell me more about this one"
`stats`	"What's the community success rate? Latency?"
`probe`	"Try a dry-run install first, don't touch my runtime"
`install`	"Make it real"
`update`	"Refresh me on the latest version"
`uninstall`	"I don't need this anymore"
`validate`	"Is this skill.yaml well-formed and safe to ship?"
`rate`	"Did this skill work? Tell others"
`recommend`	"What else usually goes with the stuff I have?"
`profile`	"What have I already installed/rated in this account?"
`collections`	"List curated bundles (AI Researcher, PDF, …)"
`collection`	"Show one bundle details"
`bundle_install`	"Install an entire bundle"
`bundle_suggest`	"What bundle fits my installed skills?"

The retention loop is built in: every install writes to a local profile; every successful run is recorded as a rate; the next stats call surfaces those signals back. So agents get more confident about skills over time — not less.

See src/skillhub_mcp/server.py for the full schema.

Maintainers write skill.yaml once; the CLI compiles to runtime layouts.
Agents find skills via skillhub search --json instead of web scraping.
Humans get a trust_score per skill — derived from real signals, not stars.
Everyone agrees on the same skill.yaml schema, so we don't fork five copies of the same SKILL.md across runtimes.

Roadmap (no dates)

v0.1: schema stable, security scanner v1, real registry updater.
v0.2: trust score from install_success_rate (live telemetry).
v0.3: in-agent MCP-server (skillhub-mcp) so any MCP-capable agent can discover/install skills via tool calls.
v1.0: featured/verified tiers, paid placements, the actual marketplace.

License

MIT. See headers in source files.