skillmds
OfficialAgent Skills 是教 AI 代理学习新工作流的 Markdown 文件(SKILL.md)。SkillMD 是一个会 lint 的注册中心:每个技能都会经过验证、安全扫描、内容固定 —— 而这个仓库就是实现这一切的工具链:在你自己机器上和注册中心里运行的是同一个引擎。
包 | 用途 |
一个 npm 包,两个可执行命令: | |
SKILL.md SDK:解析器、lint 规则、安全扫描器、质量评分、SARIF/JSON/Github 格式化器 | |
GithHub Action:在 CI 中 lint 技能,结果上传到 GitHub Code Scainning |
CLI
npm i -g skillmdsskillmd lint . # validate SKILL.md files — diagnostics + quality score
skillmd scan . # what would this skill do? scripts, network, secrets
skillmd search "pdf tools" # search the registry
skillmd add anthropic/pdf # install — lints first, never executes scripts
skillmd init my-skill # scaffold a new skill
skillmd publish ./my-skill # publish to skillmd.com (blocked on lint errors)skillmd add 会自动识别 68 种代理 —— 包括 Claude Code、Cursor、Codex、Windsurf、Gemini CLI、GitHub Copilot、Cline、Goose、Zed 等 —— 并按照这些代理各自的目录规范,把每个技能一一写入你机器上检测到的所有代理。直接运行 skillmd 会弹出引导式交互菜单。
完整参考: docs/cli.md
Related MCP server: SkillFlow MCP Server
MCP 服务器
把整个注册中心交给任何支持 MCP 的代理,让它在对话中就能搜索、查看、lint 和安装技能:
# Claude Code
claude mcp add skillmd -- npx -y skillmds// Claude Desktop, Cursor, VS Code, … (examples/mcp/ has per-client files)
{ "mcpServers": { "skillmd": { "command": "npx", "args": ["-y", "skillmds"] } } }或者使用托管远程服务器 —— 零安装、基于 Streamable HTTP:
https://api.skillmd.com/mcp工具 | 代理能获得的东西 |
| 注册中心搜索,包含分类、评分和安装片段 |
| 完整技能详情:正文、来源、许可证、安全标记 |
t | |
| 安全安装:已验证、SHA-256、zip-slip 防护,绝不执行脚本 |
| 热门排行榜和 + 相似技能推荐 |
| 你保存的技能(配合 |
| 即时验证任何 SKILL.md 内容 |
完整参考:
docs/mp.md · 注册中心条目: com.skillmd/skillmd
引擎
npm i @skillmd/coreimport { lint } from "@skillmd/core";
const { ok, score, diagnostics, security } = lint(rawSkillMd, { slug: "my-skill" });9 条 lint 容性、值感知的安全扫描器(network_calls, executes_scripts、reads_secrets)……,0–100 的视觉质量评分,以及 SARIF/JSON/Github 注释(app) 格式化器。ESM、带有类型、无任何运行时依赖,支持 Node/浏览器/edge。规则: docs/rules.md
为你的技能配置 CI
- uses: skillmds/skillmd/action@v1
with:
path: .对仓库内每个技能执行 lint 并上传 SARIF 到 GitHub Code Scanning —— 结果会直接出现在 PR 中。完整示例: examples/github-action.yml
注册中心 API
这里的所有内容只是 api.reg积中心.md 公共 API 的薄封装 —— 可接调用 usage(GET /v1/search?q=…),在 docs/registry-api.md 中有记录,也可见于 https://skillmd.com/openapi.json。
安全模型
安装技能只写文件,不做其他任何东西:不执行脚本、严格的路径隔离(最小字符验证 + zip-slip 防转)、SHA-256 integrity 完整性校验对注册中心 content-addressed 存储,下载关联项固定到 GitHub raw hosts。详见 SECURITY.md —— 漏洞报告请发送至 hi@skillmd.com:
开发
npm ci
npm run build # @skillmd/core, then skillmds
npm test # vitest across both packages (19 test files, incl. an MCP stdio smoke test)
npm run typecheck # strict tsc构建目录结构、PR 指南和版本发布参见 CONTRIBUTING.md。
许可证
MIT © 2023
This server cannot be installed
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Servers
- AlicenseBqualityDmaintenanceMCP (Model Context Protocol) Server for skill4agent - Search, view, and install AI skills in AI conversations.3444MIT
- AlicenseAqualityDmaintenanceConnects AI coding agents to the SkillFlow marketplace to search, discover, and retrieve detailed information about agent skills. It enables users to browse trending skills, categories, and publisher data directly through MCP-compatible environments.5561MIT
- AlicenseNot gradedqualityAmaintenanceEnables AI agents to discover, install, and manage SKILL.md skills from a Git-backed registry via MCP tools for search, install, and list operations.51MIT
- AlicenseAqualityCmaintenanceEnables AI agents to search, audit, and install open-source AI skills and MCP servers with security grading and quality scoring, directly from MCP clients.323MIT
Related MCP Connectors
A registry of 5,900+ peer-authored skills any MCP agent can search and load on demand.
Search your team's shared AI-skill library, get install commands, and save skills from your agent.
Agent-first skill marketplace with USK open standard for Claude, Cursor, Gemini, Codex CLI.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/skillmds/skillmd'
If you have feedback or need assistance with the MCP directory API, please join our Discord server