Install from any GitHub repo

<h1 align="center">vskill</h1>

<p align="center">
  <strong>The package manager for AI skills.</strong><br/>
  Scan. Verify. Install. Across 49 agent platforms.
</p>

<p align="center">
  <a href="https://www.npmjs.com/package/vskill"><img src="https://img.shields.io/npm/v/vskill?color=cb3837&logo=npm" alt="npm" /></a>
  <a href="https://www.npmjs.com/package/vskill"><img src="https://img.shields.io/npm/dw/vskill?color=cb3837&logo=npm&label=downloads" alt="downloads" /></a>
  <img src="https://img.shields.io/badge/agents-49_platforms-0969DA" alt="49 agents" />
  <img src="https://img.shields.io/badge/plugins-5-8B5CF6" alt="5 plugins" />
  <img src="https://img.shields.io/badge/skills-7-10B981" alt="7 skills" />
  <a href="https://verified-skill.com"><img src="https://img.shields.io/badge/registry-verified--skill.com-F59E0B" alt="registry" /></a>
  <img src="https://img.shields.io/badge/license-MIT-green" alt="MIT" />
</p>

<br/>

```bash
npx vskill install remotion-best-practices
```

<br/>

## The Problem

**36.82% of AI skills have security flaws** ([Snyk ToxicSkills](https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/)).

When you install a skill today, you're trusting blindly:

- **No scanning** — malicious prompts execute with full system access
- **No versioning** — silent updates can inject anything, anytime
- **No deduplication** — the same skill lives in 3 repos, all diverging
- **No blocklist** — known-bad skills install just fine

vskill fixes all of this.

<br/>

## How It Works

```
  ┌──────────┐     ┌──────────┐     ┌──────────┐     ┌──────────┐
  │  Source   │────>│   Scan   │────>│  Verify  │────>│ Install  │
  │          │     │          │     │          │     │          │
  │ GitHub   │     │ 38 rules │     │ LLM      │     │ Pin SHA  │
  │ Registry │     │ Blocklist│     │ analysis │     │ Lock ver │
  │ Local    │     │ Patterns │     │ Intent   │     │ Symlink  │
  └──────────┘     └──────────┘     └──────────┘     └──────────┘
```

Every install goes through the security pipeline. No exceptions. No `--skip-scan`.

<br/>

## Quick Start

```bash
# Install from any GitHub repo
npx vskill install remotion-dev/skills/remotion-best-practices

# Browse a repo and pick interactively
npx vskill install remotion-dev/skills

# Install a plugin (Claude Code)
npx vskill install --repo anton-abyzov/vskill --plugin mobile
```

Or install globally: `npm install -g vskill`

> **Getting E401 errors?** If your project has a `.npmrc` pointing to a private registry (e.g. AWS CodeArtifact, GitHub Packages), npx may fail with `npm error code E401`. Fix it by overriding the registry:
> ```bash
> npx --registry https://registry.npmjs.org vskill install <skill>
> ```
> Or install globally once to avoid this entirely: `npm i -g vskill --registry https://registry.npmjs.org`

<br/>

## Three-Tier Verification

| Tier | How | Trust Level |
|:-----|:----|:------------|
| **Scanned** | 38 deterministic pattern checks against known attack vectors | Baseline |
| **Verified** | Pattern scan + LLM-based intent analysis for subtle threats | Recommended |
| **Certified** | Full manual security review by the vskill team | Highest |

Every install is at minimum **Scanned**. The `vskill.lock` file tracks the SHA-256 hash, scan date, and tier for every installed skill. Running `vskill update` diffs against the locked version and re-scans before applying.

<br/>

## 49 Agent Platforms

vskill auto-detects your installed agents and installs skills to all of them at once.

**CLI & Terminal** — Claude Code, Cursor, GitHub Copilot, Windsurf, Codex, Gemini CLI, Amp, Cline, Roo Code, Goose, Aider, Kilo, Devin, OpenHands, Qwen Code, Trae, and more

**IDE Extensions** — VS Code, JetBrains, Zed, Neovim, Emacs, Sublime Text, Xcode

**Cloud & Hosted** — Replit, Bolt, v0, GPT Pilot, Plandex, Sweep

<br/>

## Plugin Marketplace

vskill ships **7 expert skills** organized into **5 domain plugins**. Each plugin has its own namespace — install only what you need.

```bash
npx vskill install --repo anton-abyzov/vskill --plugin mobile
npx vskill install --repo anton-abyzov/vskill --plugin marketing
```

Then invoke as `/plugin:skill` in your agent:

```
/mobile:appstore             /marketing:social-media-posting
/google-workspace:gws        /skills:scout
```

### Available Plugins

| Plugin | Description | Skills |
|--------|-------------|--------|
| **mobile** | React Native, Expo, Flutter, SwiftUI, Jetpack Compose, app store | `appstore` |
| **marketing** | Social media content creation, posting, and engagement across 11 platforms, plus Slack messaging | `social-media-posting` `slack-messaging` |
| **google-workspace** | Google Workspace CLI (gws) for Drive, Sheets, Docs, Calendar, Chat, Admin | `gws` |
| **skills** | Skill discovery and recommendations | `scout` |
| **productivity** | Expert network survey completion and paid expertise sharing | `survey-passing` |

<br/>

## Commands

```
vskill install <source>     Instal

... (truncated)