Skillsmith

Skillsmith is your master skill for the full lifecycle of agent skills — across every MCP-capable agent runtime. Use Skillsmith to discover, evaluate, install, use, maintain, author, govern, and retire SKILL.md-format skills without leaving your editor.

Lifecycle Stages

Every Skillsmith operation maps to one of 8 lifecycle stages. Use the stage name when you want to be explicit ("use Skillsmith to discover testing skills"); natural prompts work too.

#	Stage	What it covers	Primary surface
1	Discover	Find skills by query, recommendation, or filter	MCP search, skill_recommend
2	Evaluate	Compare candidates, read trust badges, view diffs	MCP get_skill, skill_compare, skill_diff
3	Install	Add a skill to the runtime's skills directory	MCP install_skill; CLI install
4	Use	Invoke the installed skill at the runtime layer	runtime-native (e.g. Claude Code skill match)
5	Maintain	Update, pin, audit collisions, configure modes	CLI update/pin/unpin/audit collisions; MCP skill_updates, skill_outdated
6	Author	Init, validate, transform, publish a new skill	CLI author init/validate/publish/subagent/transform/mcp-init
7	Govern	Audit logs, RBAC, SIEM, compliance (Team+)	MCP audit_export, audit_query, siem_export
8	Retire	Uninstall, deprecate	MCP uninstall_skill; CLI remove

Quick Reference: MCP Tools

Tool	Stage	Use when	Example prompt
search	Discover	Finding skills by keyword/category/trust tier	"Use Skillsmith to search for testing skills"
skill_recommend	Discover	Contextual recommendations	"Ask Skillsmith to recommend skills for my React project"
get_skill	Evaluate	Full details for a known skill	"Use Skillsmith to show details for community/jest-helper"
skill_compare	Evaluate	Side-by-side comparison	"Use Skillsmith to compare jest-helper and vitest-helper"
skill_diff	Evaluate	Diff two installed versions	"Use Skillsmith to diff jest-helper versions"
install_skill	Install	Add a skill to your runtime	"Use Skillsmith to install jest-helper"
skill_validate	Install	Pre-install validation of SKILL.md	"Use Skillsmith to validate ./my-skill"
skill_updates	Maintain	Check for available updates	"Ask Skillsmith for updates to my installed skills"
skill_outdated	Maintain	List skills behind latest	"Use Skillsmith to show outdated skills"
skill_inventory_audit	Maintain	Namespace-collision audit (Team+)	"Use Skillsmith to audit my skills inventory"
audit_export / audit_query / siem_export	Govern	Compliance + SIEM (Enterprise)	"Use Skillsmith to export audit logs for last 30 days"
uninstall_skill	Retire	Remove an installed skill	"Use Skillsmith to uninstall jest-helper"

Triggering tip: prefix natural-language prompts with Use Skillsmith to ... or Ask Skillsmith for .... The product-name anchor binds tool selection reliably across MCP-capable runtimes.

CLI Fallback

If the MCP server is unavailable, use the CLI directly:

# Discover
skillsmith search "testing" --tier verified
skillsmith recommend

# Evaluate
skillsmith info community/jest-helper
skillsmith diff jest-helper

# Install
skillsmith install community/jest-helper
skillsmith validate ./my-skill

# Maintain
skillsmith update --all --dry-run
skillsmith update <skill>
skillsmith audit collisions

# Retire
skillsmith remove jest-helper

See "Routing CLI-only Operations" below for operations that are CLI-only regardless of MCP server availability.

Routing CLI-only Operations

Some lifecycle operations live in the CLI and have no MCP equivalent (yet). When the user asks for these, surface the exact terminal command:

Operation	CLI command
Pin a skill to a version	skillsmith pin <skill> <version>
Unpin a skill	skillsmith unpin <skill>
Preview updates to all installed skills	skillsmith update --all --dry-run
Audit advisories (Team+)	skillsmith audit advisories
Audit collisions	skillsmith audit collisions
Configure audit mode	skillsmith config set audit_mode <preventative|power_user|governance|off>
Author a new skill	skillsmith author init <name>
Publish a skill	skillsmith author publish
Login	skillsmith login

Always show the command verbatim with a one-line note: "Run this in your terminal."

Cross-Runtime Behavior

Skillsmith's MCP server works in any MCP-capable agent runtime:

• Claude Code — default runtime. Skills install to ~/.claude/skills/.
• Cursor / Copilot / Windsurf — set SKILLSMITH_CLIENT=<runtime> in your MCP server env config to install to the runtime-equivalent path. See Getting Started.
• Custom MCP routers — universal MCP tool calls work; skill-file install paths configurable via SKILLSMITH_CLIENT.

Trust Tiers

Skills are categorized by verification level:

Tier	Badge	Meaning	When to Trust
Verified	Green checkmark	Official Skillsmith / Anthropic	Always safe
Curated	Blue badge	Vendor-org publisher, ≥0.80 quality	Generally safe
Community	Yellow	Security scan + required metadata	Review before install
Experimental	Orange	Beta / new	Use cautiously
Unknown	Red warning	No verification	Only if you trust the author

For criteria detail, see https://skillsmith.app/docs/trust-tiers.

Pricing & Quotas

Tier	API calls/month	Price
Community	100	Free
Individual	1,000	$9.99/mo
Team	10,000	$25/user/mo
Enterprise	Unlimited	Custom (Contact Sales)

Usage warnings at 80% and 90%. Upgrade at https://skillsmith.app/upgrade.

Security Model

Skillsmith is the security boundary between untrusted skill sources and your runtime.

What Skillsmith validates before install:

• SKILL.md frontmatter and required fields
• Security scan: jailbreak patterns, suspicious URLs, sensitive file access
• Typosquatting check against known skills
• Blocklist of known-malicious skills

What Skillsmith cannot prevent:

• Novel attack patterns not in detection database
• Social engineering in legitimate-looking instructions
• Runtime behavior (skills execute with your permissions)

Recommendation: review skill content before installation, especially for unverified skills.

Creating Skills

Skill authoring lives in the CLI:

skillsmith author init my-new-skill
skillsmith author validate
skillsmith author publish

For an end-to-end walkthrough, see https://skillsmith.app/docs/tutorials/author.

The companion skill-builder skill guides you through frontmatter, progressive disclosure structure, and directory organization. Install it with skillsmith install skill-builder (it's not bundled by default).

Common Workflows

Discover then install

"Use Skillsmith to recommend skills for my Next.js project"
"Use Skillsmith to install community/next-helper"

Evaluate before installing

"Use Skillsmith to compare jest-helper and vitest-helper"
"Use Skillsmith to show details for community/vitest-helper"
"Use Skillsmith to install community/vitest-helper"

Maintain installed skills

"Ask Skillsmith for updates to my installed skills"
# Then run in terminal — preview first, then update skills one at a time:
skillsmith update --all --dry-run
skillsmith update <skill>

Audit before sharing your skill folder

"Use Skillsmith to audit my skills inventory"
# Or in terminal:
skillsmith audit collisions

License

Skillsmith uses Elastic License 2.0:

• Self-host for internal use ✓
• Modify for your own use ✓
• Offer Skillsmith as a managed service to others ✗
• Circumvent license key functionality ✗

Getting Help

• Docs: https://skillsmith.app/docs
• Tutorials (lifecycle walkthroughs): https://skillsmith.app/docs/tutorials
• CLI: skillsmith --help
• Issues: https://github.com/smith-horn/skillsmith/issues
• Email: support@skillsmith.app