@vegastack/skills

Installer for VegaStack Agent Skills — a family of self-contained skills for Claude Code, Codex, and Hermes, shipped in one integrity-checked package.

npx @vegastack/skills list
npx @vegastack/skills add architect

Skills in this package

| Skill | What it does | |---|---| | architect | Architecture advisor: the locked stack and lean-first principles as evidence-distilled decision tables, dated source-verified platform facts, a per-project .vegastack/arch.md profile with repo-wins drift detection, and an advisory-only review discipline | | skill-maintainer | Encodes the Agent Skills standards (Claude Code, Codex, Hermes, agentskills.io) for creating, updating, and releasing skills in a skills repo | | skillify | Turns a feature or workflow into a complete skill conforming to the VegaStack skills contract, or audits an existing one |

Commands

| Command | What it does | |---|---| | list | Show the bundled skills | | add <skill> | Install (or upgrade) a skill into the selected agent directories | | verify [skill] | Check installed copies against the bundled checksum manifest (all bundled skills when no name given) | | doctor | Diagnose an install: integrity across all skills, profile presence, installed-vs-latest version | | remove <skill> | Uninstall a skill from the selected agent directories |

Flags

| Flag | Meaning | |---|---| | --project / --global | Install into the current project (default) or the user's home directory | | --agent codex\|claude\|hermes\|both\|all | Target agent runtime(s); both = codex+claude | | --dir PATH | Operate on a different project directory | | --dry-run | Show what would change without writing | | --force | Overwrite a modified installed copy | | --non-interactive | Skip prompts and use defaults: --agent both, project-local (for automation) |

Agent targeting is automatic: the CLI detects which agents you have (~/.claude, ~/.codex/~/.agents, ~/.hermes) and targets them without asking — --agent overrides. A numbered picker appears only when nothing is detected. Installs are project-local by default; pass --global for the home directory (required for Hermes).

Agent surfaces

| Agent | Project install | Global install | |---|---|---| | Claude Code | .claude/skills/ | ~/.claude/skills/ | | Codex | .agents/skills/ | ~/.agents/skills/ | | Hermes | — (Hermes discovers skills globally only) | ~/.hermes/skills/ |

--agent hermes therefore requires --global; --agent all on a project install covers codex+claude and prints a notice about hermes.

Integrity model

The package ships a checksum manifest that is verified at install and by verify — it proves the installed bytes match what was packed, not who published it. Publisher identity is attested separately by npm provenance, generated by the trusted-publishing release pipeline. Verify it with npm audit signatures or on the package's npm page.

Network and telemetry

Zero telemetry. The only network call in the tool is doctor's single version check against registry.npmjs.org (installed-vs-latest); add, verify, and remove are fully offline.

Requirements

• Node >= 24
• macOS or Linux. Windows is not yet supported (path handling; tracked in the repo issues).

Docs

Skill content, freshness model, and policies: github.com/vegastack/vegastack-skills

MIT license.