secure-skills-cli

Secure Skills CLI — discover, add, update, search, and publish agent skills as folders.

Install

# From source
npm install
npm run build
npm link

# Once published to npm
npm i -g secure-skills-cli

Quick Start

# Search for skills
secure-skills search "database"

# Add (install) a skill
secure-skills add my-skill-pack

# Update all installed skills
secure-skills update --all

# Inspect a skill's details
secure-skills inspect my-skill-pack

# Publish a skill
secure-skills publish ./my-skill-pack --slug my-skill-pack --name "My Skill Pack" --version 1.2.0 --changelog "Fixes + docs"

Authentication

# Browser-based login
secure-skills login
# or
secure-skills auth login

# Headless / token paste
secure-skills login --token ssk_...

• Browser login opens https://skillhub.360.com/cli/auth and completes via a loopback callback.
• Token stored in ~/Library/Application Support/secure-skills/config.json on macOS (override via SECURE_SKILLS_CONFIG_PATH).

Commands

| Command | Description | | -------------------------------- | ------------------------------------------------------ | | secure-skills search <query> | Search for skills by keyword | | secure-skills add <slug> | Install a skill into the local skills directory | | secure-skills remove <slug> | Remove an installed skill | | secure-skills update [slug] | Update one or all installed skills | | secure-skills inspect <slug> | View skill details, versions, files, and security info | | secure-skills publish <folder> | Publish a local skill folder to the registry | | secure-skills sync | Scan and upload local skills to the registry | | secure-skills delete <slug> | Delete a skill from the registry (owner only) | | secure-skills star <slug> | Star a skill | | secure-skills unstar <slug> | Unstar a skill | | secure-skills login | Authenticate with the registry | | secure-skills logout | Remove stored credentials | | secure-skills whoami | Show current authenticated user |

Global Options

| Flag | Env Variable | Description | | ------------------ | ------------------------ | --------------------------------- | | --workdir <path> | SECURE_SKILLS_WORKDIR | Override working directory | | --dir <path> | — | Override skills install directory | | --site <url> | SECURE_SKILLS_SITE | Override site URL | | --registry <url> | SECURE_SKILLS_REGISTRY | Override registry URL | | --no-input | — | Disable interactive prompts |

Sync (upload local skills)

# Scans current workdir, known agent locations, and agent configs
secure-skills sync

# Explicit roots + non-interactive dry-run
secure-skills sync --root ../my-skills/skills --all --dry-run

Agent Compatibility

The CLI is designed to work with multiple AI agent tools. When resolving the working directory and scanning for skills, the following discovery strategy is used:

Workdir resolution (in order)

1. Explicit --workdir flag
2. SECURE_SKILLS_WORKDIR environment variable
3. Current directory if it contains a .secure-skills/ marker
4. Dynamic agent config detection (reads ~/.openclaw/openclaw.json, ~/.clawdbot/clawdbot.json, ~/.claude/claude.json for workspace paths)
5. Well-known agent skill directories (~/.claude/skills, ~/.openclaw/skills, ~/.clawdbot/skills, ~/.copilotcode/skills, etc.)
6. Falls back to current directory

Skills scan fallback roots

When secure-skills sync finds no skills in the primary workdir, it scans:

• Adjacent repos: ../openclaw/skills, ../clawdbot/skills, ../clawdis/skills, ../moltbot/skills
• Standard home dirs: ~/.claude/skills, ~/.openclaw/skills, ~/.clawdbot/skills, ~/.copilotcode/skills
• macOS Application Support dirs for all known agents
• Dynamic roots from agent JSON configs (workspace paths, extra skill dirs)

Skill detection

A folder is recognized as a skill if it contains a SKILL.md or skill.md file, regardless of how it was installed.

Notes

• Ignore files: The CLI reads .secureskillsignore (in addition to .gitignore) for file exclusion patterns.
• Metadata dir: The CLI reads lockfiles and origin metadata from the .secure-skills/ directory.
• Third-party skills: Skills not installed via this CLI are fully supported for scanning, syncing, and updating. The sync command identifies them by fingerprint matching against the registry.

Defaults

• Site: https://skillhub.360.com (override via --site or SECURE_SKILLS_SITE)
• Registry: discovered from /.well-known/secure-skills.json on the site (override via --registry or SECURE_SKILLS_REGISTRY)
• Workdir: auto-detected (see Agent Compatibility above; override via --workdir or SECURE_SKILLS_WORKDIR)
• Install dir: ./skills under workdir (override via --dir)

Development

# Build
npm run build

# Run tests
npm test

# Watch mode
npm run test:watch

# Dev mode (with source maps)
npm run dev -- search "test"