@corespeed/skills

CoreSpeed's fork of vercel-labs/skills, the CLI for the open agent skills ecosystem. Same commands, same install layout, same lock files. It exists for one reason: an environment setup script should be one line.

bunx --bun @corespeed/skills add \
  corespeed-io/internal-skills \
  cloudflare/skills@wrangler,workers-best-practices,durable-objects,sandbox-stable \
  vercel-labs/skills@find-skills \
  vercel-labs/agent-skills@vercel-react-best-practices \
  -g -a claude-code universal -y

+ corespeed-io/internal-skills: ship, neat-freak, knowledge-placement, unify-design-system, agent-ensemble
+ cloudflare/skills: sandbox-stable, workers-best-practices, wrangler, durable-objects
+ vercel-labs/skills: find-skills
+ vercel-labs/agent-skills: vercel-react-best-practices
Installed 11 skills from 4 of 4 sources in 2.4s

What differs from upstream

• add takes several sources. Each bare argument is a source, and skills are picked on the source itself with upstream's @skill syntax, extended to comma lists: cloudflare/skills@wrangler,durable-objects. Tokens naming the same repository merge into one clone. --skill is rejected with several sources because it would have no clear owner. Sources install concurrently (one child process each), the lock file is written once at the end, and the exit code is non-zero if any source failed. Several sources are always non-interactive, so pass --agent (-y is implied).
• add --json prints one JSON array, one entry per skill (status: installed | skipped | failed). This is upstream PR #1686 by @hcjmartin, carried here until it merges.
• owner/repo@a,b names several skills from one source (upstream's @skill takes one). Works with a single source too.
• Concise output for several sources: one line per source plus a total, no boxes. Single-source output is unchanged.
• bunx --bun runs the CLI under Bun; this matters where node on PATH is a slow shim. Under Node everything works the same.

Everything else, including ls --json, update, remove, find and the lock formats, is upstream as of the version named in package.json's upstream field (npm view @corespeed/skills upstream).

Versioning

One mechanical rule: major.minor is upstream's, patch counts the fork's releases on that line. So 1.5.1 is the first fork release on upstream's 1.5 line, 1.5.2 the next one (a rebase onto a newer upstream 1.5.x or a fix to the fork's own patches, either way), and when upstream moves to 1.6 the fork continues from 1.6.1. Every version is a stable release; semver has no slot for a downstream revision (a prerelease sorts before and reads as unstable, build metadata is ignored), so the exact upstream base lives in package.json's upstream field (npm view @corespeed/skills upstream) and in this table, not in the version number. The table and the field are kept in step by a test.

Because major.minor is pinned to upstream, a fork-originated change of any size lands as a patch bump: the fork's patch number carries no semver-patch guarantee, so pin an exact version if that matters to you (a bunx one-liner resolves latest and does not care).

Release tags are named @corespeed/skills@<version>, not v<version>: this repository is a GitHub fork of vercel-labs/skills, whose v1.5.1…v1.5.25 tags share the namespace and arrive with git fetch upstream --tags.

Keeping up with upstream

git remote add upstream https://github.com/vercel-labs/skills.git
git fetch upstream --tags
git rebase v1.5.26        # the fork is a short patch series on top of an upstream tag
bun install && bun run type-check && bun run build && bunx vitest run

Then set upstream to vercel-labs/[email protected], bump version (1.5.2: same upstream line, next fork release), add the row to the table above, land the commit through a PR, tag the merge commit @corespeed/[email protected] and publish a GitHub release for the tag: the Publish workflow builds, tests and runs npm publish. It authenticates with npm trusted publishing (OIDC), so there is no token to rotate: the package's settings on npmjs.com list corespeed-io/skills + publish.yml as a trusted publisher, and provenance is attached automatically. The patch series lives in git log <upstream tag>..HEAD; keep it small so rebases stay trivial.

skills

The CLI for the open agent skills ecosystem.

Supports OpenCode, Claude Code, Codex, Cursor, and 75 more.

Install a Skill

npx skills add vercel-labs/agent-skills

Use a Skill Without Installing

Generate a prompt for one skill, or start a supported coding agent interactively:

npx skills use vercel-labs/agent-skills@web-design-guidelines | claude
npx skills use vercel-labs/agent-skills --skill web-design-guidelines --agent claude-code

skills use resolves sources the same way as skills add, writes the selected skill files to a temporary directory, and prints only the generated prompt to stdout unless --agent is provided. With --agent, it starts one supported agent interactively with the generated prompt.

Source Formats

# GitHub shorthand (owner/repo)
npx skills add vercel-labs/agent-skills

# Full GitHub URL
npx skills add https://github.com/vercel-labs/agent-skills

# Direct path to a skill in a repo
npx skills add https://github.com/vercel-labs/agent-skills/tree/main/skills/web-design-guidelines

# GitLab URL
npx skills add https://gitlab.com/org/repo

# Any git URL
npx skills add [email protected]:vercel-labs/agent-skills.git

# Local path
npx skills add ./my-local-skills

Private Repositories

Use the same command for public and private repositories. The CLI uses the authentication already configured for the repository URL:

# GitHub shorthand or HTTPS (Git credential helper, GitHub CLI, then SSH fallback)
npx skills add acme/private-skills

# SSH on GitHub, GitLab, or another Git host
npx skills add [email protected]:acme/private-skills.git
npx skills add ssh://[email protected]/acme/private-skills.git

# HTTPS on any Git host (uses your configured Git credential helper)
npx skills add https://git.example.com/acme/private-skills.git

For GitHub HTTPS and shorthand sources, skills first uses normal Git credentials. If that fails and GitHub CLI is authenticated, it tries gh repo clone, followed by SSH. It does not execute gh auth token or copy the stored GitHub CLI credential into the Node.js process.

For GitHub tree lookups, skills first tries the API anonymously, then an explicitly supplied environment token, then gh api. GitHub CLI applies its own stored authentication and returns only the API response; the credential is never printed to or read by skills. If API access still fails, update checks fall back to an authenticated Git clone.

GITHUB_TOKEN or GH_TOKEN can be set explicitly for GitHub API access, including private repository downloads and update checks. They are optional for installs when Git, GitHub CLI, or SSH authentication is already configured.

Options

Examples

# List skills in a repository
npx skills add vercel-labs/agent-skills --list

# Install specific skills
npx skills add vercel-labs/agent-skills --skill frontend-design --skill skill-creator

# Install a skill with spaces in the name (must be quoted)
npx skills add owner/repo --skill "Convex Best Practices"

# Install to specific agents
npx skills add vercel-labs/agent-skills -a claude-code -a opencode

# Non-interactive installation (CI/CD friendly)
npx skills add vercel-labs/agent-skills --skill frontend-design -g -a claude-code -y

# Install all skills from a repo to all agents
npx skills add vercel-labs/agent-skills --all

# Install all skills to specific agents
npx skills add vercel-labs/agent-skills --skill '*' -a claude-code

# Install specific skills to all agents
npx skills add vercel-labs/agent-skills --agent '*' --skill frontend-design

# Install from a direct SKILL.md or archive download URL
npx skills add https://example.com/download/my-skill

Direct download URLs are tried after well-known discovery. They may point to a single valid SKILL.md file or a .zip, .tar, .tar.gz, or .tgz archive; the URL does not need to include a file extension. Downloads are limited to 10 MiB, extracted content to 25 MiB, and archives to 1000 files by default. Override with SKILLS_DOWNLOAD_MAX_BYTES, SKILLS_EXTRACT_MAX_BYTES, and SKILLS_EXTRACT_MAX_FILES when you trust the source.

Installation Scope

Installation Methods

When installing interactively, you can choose:

Other Commands

skills list

List all installed skills. Similar to npm ls.

# List all installed skills (project and global)
npx skills list

# List only global skills
npx skills ls -g

# Filter by specific agents
npx skills ls -a claude-code -a cursor

skills find

Search for skills interactively or by keyword.

# Interactive search (fzf-style)
npx skills find

# Search by keyword
npx skills find typescript

# Search across every repository owned by an organization or user
npx skills find react --owner vercel

skills update

# Update all skills (interactive scope prompt)
npx skills update

# Update a single skill by name
npx skills update my-skill

# Update multiple specific skills
npx skills update frontend-design web-design-guidelines

# Update only global or project skills
npx skills update -g
npx skills update -p

# Non-interactive (auto-detects scope: project if in a project, else global)
npx skills update -y

skills init

# Create SKILL.md in current directory
npx skills init

# Create a new skill in a subdirectory
npx skills init my-skill

skills remove

Remove installed skills from agents.

# Remove interactively (select from installed skills)
npx skills remove

# Remove specific skill by name
npx skills remove web-design-guidelines

# Remove multiple skills
npx skills remove frontend-design web-design-guidelines

# Remove from global scope
npx skills remove --global web-design-guidelines

# Remove from specific agents only
npx skills remove --agent claude-code cursor my-skill

# Remove all installed skills without confirmation
npx skills remove --all

# Remove all skills from a specific agent
npx skills remove --skill '*' -a cursor

# Remove a specific skill from all agents
npx skills remove my-skill --agent '*'

# Use 'rm' alias
npx skills rm my-skill

What are Agent Skills?

Agent skills are reusable instruction sets that extend your coding agent's capabilities. They're defined in SKILL.md files with YAML frontmatter containing a name and description.

Skills let agents perform specialized tasks like:

• Generating release notes from git history
• Creating PRs following your team's conventions
• Integrating with external tools (Linear, Notion, etc.)

Discover skills at skills.sh

Supported Agents

Skills can be installed to any of these agents:

[!NOTE] Kiro CLI users: The default agent automatically loads skills from .kiro/skills/ and ~/.kiro/skills/ — no configuration needed. If you use a custom agent, add skills to its resources in .kiro/agents/<agent>.json:

{
  "resources": ["skill://.kiro/skills/**/SKILL.md"]
}

The CLI automatically detects which coding agents you have installed. If none are detected, you'll be prompted to select which agents to install to.

Creating Skills

Skills are directories containing a SKILL.md file with YAML frontmatter:

---
name: my-skill
description: What this skill does and when to use it
---

# My Skill

Instructions for the agent to follow when this skill is activated.

## When to Use

Describe the scenarios where this skill should be used.

## Steps

1. First, do this
2. Then, do that

Required Fields

• name: Unique identifier (lowercase, hyphens allowed)
• description: Brief explanation of what the skill does

Optional Fields

• metadata.internal: Set to true to hide the skill from normal discovery. Internal skills are only visible and installable when INSTALL_INTERNAL_SKILLS=1 is set. Useful for work-in-progress skills or skills meant only for internal tooling.

---
name: my-internal-skill
description: An internal skill not shown by default
metadata:
  internal: true
---

Skill Discovery

The CLI searches for skills in these locations within a repository. Each skill container directory is walked up to three levels deep, covering flat layouts (skills/<name>/SKILL.md) and catalog layouts with one or two category levels (skills/<category>/<name>/SKILL.md or skills/<category>/<category>/<name>/SKILL.md). A SKILL.md discovered at a shallower level shadows anything nested below it. Use --full-depth to also discover SKILL.md files outside these container directories (e.g. under examples/ or tests/).

• Root directory (if it contains SKILL.md)
• skills/
• skills/.curated/
• skills/.experimental/
• skills/.system/
• .aider-desk/skills/
• .agents/skills/
• data/skills/
• .autohand/skills/
• .augment/skills/
• .bob/skills/
• .claude/skills/
• .codeartsdoer/skills/
• .codebuddy/skills/
• .codemaker/skills/
• .codestudio/skills/
• .commandcode/skills/
• .continue/skills/
• .cortex/skills/
• .crush/skills/
• .devin/skills/
• agent/skills/
• .forge/skills/
• .fx/skills/
• .goose/skills/
• .grok/skills/
• .hermes/skills/
• .inferencesh/skills/
• .jazz/skills/
• .junie/skills/
• .iflow/skills/
• .kimchi/skills/
• .kiro/skills/
• .kode/skills/
• .lingma/skills/
• .mcpjam/skills/
• .minimax/skills/
• .vibe/skills/
• .moxby/skills/
• .mux/skills/
• .openhands/skills/
• .ona/skills/
• .pi/skills/
• .posit/assistant/skills/
• .qoder/skills/
• .qwen/skills/
• .reasonix/skills/
• .rovodev/skills/
• .roo/skills/
• .tabnine/agent/skills/
• .terramind/skills/
• .tinycloud/skills/
• .trae/skills/
• .windsurf/skills/
• .zcode/skills/
• .zencoder/skills/
• .neovate/skills/
• .pochi/skills/
• .adal/skills/

Plugin Manifest Discovery

If .claude-plugin/marketplace.json or .claude-plugin/plugin.json exists, skills declared in those files are also discovered:

// .claude-plugin/marketplace.json
{
  "metadata": { "pluginRoot": "./plugins" },
  "plugins": [
    {
      "name": "my-plugin",
      "source": "my-plugin",
      "skills": ["./skills/review", "./skills/test"]
    }
  ]
}

This enables compatibility with the Claude Code plugin marketplace ecosystem. Skill paths declared in a manifest are searched at their declared depth and are not subject to the bounded depth-3 catalog walk described above.

If no skills are found in standard locations, a recursive search is performed.

Compatibility

Skills are generally compatible across agents since they follow a shared Agent Skills specification. However, some features may be agent-specific:

Troubleshooting

"No skills found"

Ensure the repository contains valid SKILL.md files with both name and description in the frontmatter.

Skill not loading in agent

• Verify the skill was installed to the correct path
• Check the agent's documentation for skill loading requirements
• Ensure the SKILL.md frontmatter is valid YAML

Permission errors

Ensure you have write access to the target directory.

Environment Variables

# Install internal skills
INSTALL_INTERNAL_SKILLS=1 npx skills add vercel-labs/agent-skills --list

Telemetry

This CLI collects anonymous usage data to help improve the tool. No personal information is collected.

GitHub repository and skill identifiers are sent only for repositories that GitHub positively confirms are public. Other remote source types may include source and skill identifiers in install telemetry because their visibility cannot be checked through GitHub. Security-audit requests remain limited to confirmed-public GitHub repositories. Set DISABLE_TELEMETRY=1 or DO_NOT_TRACK=1 to disable both entirely.

Related Links

• Agent Skills Specification
• Skills Directory
• Amp Skills Documentation
• Antigravity Skills Documentation
• Factory AI / Droid Skills Documentation
• Claude Code Skills Documentation
• OpenClaw Skills Documentation
• Cline Skills Documentation
• CodeBuddy Skills Documentation
• Codex Skills Documentation
• Command Code Skills Documentation
• Crush Skills Documentation
• Cursor Skills Documentation
• Firebender Skills Documentation
• Gemini CLI Skills Documentation
• GitHub Copilot Agent Skills
• iFlow CLI Skills Documentation
• Kimi Code CLI Skills Documentation
• Kiro CLI Skills Documentation
• Kode Skills Documentation
• OpenCode Skills Documentation
• Qwen Code Skills Documentation
• OpenHands Skills Documentation
• Pi Skills Documentation
• Posit Assistant Skills Documentation
• Qoder Skills Documentation
• Replit Skills Documentation
• Roo Code Skills Documentation
• Trae Skills Documentation
• Vercel Agent Skills Repository

License

This project is licensed under the MIT License.