secure-skills-cli

CLI for 360 Secure SkillHub — discover, install, update, publish, and manage agent skills.

Install

npm i -g secure-skills-cli

Quick Start

secure-skills search "database"
secure-skills add my-skill
secure-skills update --all
secure-skills inspect my-skill
secure-skills publish ./my-skill --slug my-skill --name "My Skill" --version 1.0.0

Authentication

secure-skills login                # browser-based OAuth
secure-skills login --token ssk_...  # headless token paste
secure-skills logout
secure-skills whoami

Token stored in ~/Library/Application Support/secure-skills/config.json (macOS). Override path via SECURE_SKILLS_CONFIG_PATH.

Subcommands also available under secure-skills auth login|logout|whoami.

Commands

Skills — Local Operations

| Command | Description | | ---------------- | -------------------------------------------------------------------------------------------------- | | search <query> | Vector search skills. --limit <n> | | explore | Browse registry. --limit <n> --sort <order> --json | | add <slug> | Install skill. --version <ver> --force | | update [slug] | Update one or --all. --version <ver> --force | | remove <slug> | Remove local skill. --yes | | list | List installed skills from lockfile | | inspect <slug> | View metadata/files. --version --tag --versions --limit --files --file <path> --json |

Skills — Registry Management

| Command | Description | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------- | | publish <folder> | Publish skill. --slug --name --version --changelog | | sync | Scan & upload local skills. --root <dir...> --all --dry-run --bump <patch\|minor\|major> --changelog --concurrency <n> | | delete <slug> | Soft-delete (hide) skill. --yes --purge | | undelete <slug> | Restore soft-deleted skill. --yes | | hide <slug> | Hide skill (alias for soft-delete). --yes | | unhide <slug> | Unhide skill (alias for undelete). --yes | | purge <slug> | Permanently delete skill (irreversible). --yes | | star <slug> | Star a skill. --yes | | unstar <slug> | Unstar a skill. --yes |

Moderation (admin/moderator)

| Command | Description | | ------------------------------ | -------------------------------------------------------------------------- | | ban-user <handleOrId> | Ban user & delete owned skills. --id --fuzzy --reason <text> --yes | | set-role <handleOrId> <role> | Set role (user\|moderator\|admin). --id --fuzzy --yes |

Permission Summary

| Command | Who | | ----------------------------------------- | ----------------------- | | delete / hide / undelete / unhide | owner, moderator, admin | | purge | owner, admin | | ban-user | moderator, admin | | set-role | admin |

Global Options

| Flag | Env | Description | | ------------------ | ------------------------ | ----------------------------------------------------------- | | --workdir <path> | SECURE_SKILLS_WORKDIR | Working directory | | --dir <path> | — | Skills install dir (relative to workdir, default: skills) | | --site <url> | SECURE_SKILLS_SITE | Site URL (default: https://skillhub.360.com) | | --registry <url> | SECURE_SKILLS_REGISTRY | Registry API URL (auto-discovered from site) | | --no-input | — | Disable interactive prompts |

Security Enforcement

• danger status: install/update blocked unconditionally.
• warning status: prompts for confirmation (or requires --force in non-interactive mode).

Publish

secure-skills publish ./my-skill --slug my-skill --name "My Skill" --version 1.0.0 --changelog "Initial"

Required: <folder> (must contain SKILL.md), --slug, --name, --version (semver). Optional: --changelog.

Sync

secure-skills sync
secure-skills sync --root ../extra-skills --all --dry-run --bump minor

Scans workdir + <workdir>/skills + any --root dirs. Detects skills by SKILL.md presence. Fingerprints files to detect changes.

Workdir Resolution

1. --workdir flag
2. SECURE_SKILLS_WORKDIR env
3. Current dir if .secure-skills/ marker exists
4. Agent workspace auto-detection
5. Current dir fallback

Skill Detection

A folder is a skill if it contains SKILL.md or skill.md. Ignore patterns from .secureskillsignore and .gitignore. Metadata stored in .secure-skills/ directory.

Defaults

• Site: https://skillhub.360.com
• Registry: discovered from /.well-known/secure-skills.json
• Install dir: ./skills

Development

npm run build
npm test
npm run dev -- search "test"