CLI reference

v1.2.12

Every vskill command and its flags. Run npx vskill@latest --help or npx vskill@latest <command> --help for the same list in your terminal. Commands that read or change installed skills use the project lockfile, vskill.lock, or the user-level one at ~/.agents/vskill.lock outside a project.

vskill install <source>

Install a skill after a security scan. The source can be a skill name from the verified-skill.com registry, a GitHub repository or a local path. The scan always runs. A failed scan, or a skill on the blocklist, stops the install unless you pass --force. vskill i is the short form.

bash
npx vskill@latest install <source>
FlagDescription
--yes, -ySkip all prompts and use the defaults: all skills, all agents, project scope, symlinks
--globalInstall to the global (user-level) agent folders instead of the project
--agent <id>Install to one agent only, for example cursor or claude-code. Repeat for more
--skill <name>Pick one skill from a repository that holds several
--plugin <name>Install one plugin by name (checks marketplace.json, then the plugins folder)
--repo <owner/repo>The GitHub repository to install from, with --plugin or --all
--allInstall every plugin in the --repo marketplace
--only-skills <names>Install only these skills from a plugin (comma-separated)
--selectChoose skills and agents interactively
--copyInstall independent copies instead of symlinks
--dry-runShow what would be installed and enabled without doing it
--forceInstall even when the scan finds issues or the skill is on the blocklist (not recommended)
--tenant <slug>Resolve a private skill from this account (overrides config and VSKILL_TENANT)
--version <version>With --tenant, install and pin an exact hosted private version. For a public skill use owner/repo/skill@1.2.3

Source types:

Registry namenpx vskill@latest install remotion-best-practices
Exact versionnpx vskill@latest install anton-abyzov/specweave/sw-do@3.1.0
Private versionnpx vskill@latest install --tenant my-team my-skill --version 1.0.1
GitHub reponpx vskill@latest install remotion-dev/skills
Repo + pluginnpx vskill@latest install --repo anton-abyzov/vskill --plugin frontend
Local pathnpx vskill@latest install ./my-skill

To install an exact published version, name it after the full skill name: owner/repo/skill@1.2.3. vskill looks the version up in the registry and installs the content of the commit that version was published from; an unknown version exits with the versions that exist. A private skill takes --tenant <slug> for the account and --version <version> for the version, in either order, and the installed version is pinned.

bash
npx vskill@latest install anton-abyzov/specweave/sw-do@3.1.0
npx vskill@latest install --tenant my-team my-skill --version 1.0.1
Every detected agent

vskill detects the agents installed on your machine and installs the skill to each of them. Use --agent cursor to target one.

vskill find <query>

Search the verified-skill.com registry. vskill search does the same.

bash
npx vskill@latest find react
npx vskill@latest find "code review" --limit 20
FlagDescription
--limit <n>Maximum results, 7 by default, up to 30
--jsonPrint the raw JSON response

vskill scan <path>

Run the Tier 1 scan on a SKILL.md without installing it, and print the score, the verdict (PASS, CONCERNS or FAIL), the number of patterns checked and each finding. vskill 1.2.12 checks 58 patterns. The registry runs its own copy of the scanner when you submit, so check the result on your skill page after submitting as well.

bash
npx vskill@latest scan ./my-skill

vskill list

Show the installed skills from the lockfile.

bash
npx vskill@latest list
npx vskill@latest list --installed
FlagDescription
--installedInstalled skills with their enabled or disabled state per scope
--agentsKnown agents and whether each is installed
--globalUser-level skills from ~/.agents/vskill.lock (the default outside a project)
--jsonOutput as JSON

vskill remove <skill>

Remove an installed skill from every agent. --global or --local limits it to one scope, --force skips the confirmation, and --json prints what happened per agent.

bash
npx vskill@latest remove remotion-best-practices

vskill update [skill]

Update installed skills from their source. Each new version is scanned first, and a skill whose scan fails is not updated. Pinned skills stay at their pin unless you pass --force.

bash
npx vskill@latest update remotion-best-practices
npx vskill@latest update --all
FlagDescription
--allUpdate every installed skill
--forceUpdate past a version pin, this time only
--agent <id>Update for one agent only. Repeat for more
--globalUpdate user-level skills (the default outside a project)

vskill outdated

List installed skills that have a newer version. Takes --global and --json.

bash
npx vskill@latest outdated

vskill pin <skill> [version]

Hold a skill at a version so update leaves it alone. Without a version, the installed one is pinned. A version you name is checked against the registry first, except for skills from private repositories. vskill unpin <skill> removes the pin. After pinning, vskill prints the install command that reproduces the pin on another machine, in the owner/repo/skill@version form for public skills and with --tenant and --version for private ones.

bash
npx vskill@latest pin remotion-best-practices
npx vskill@latest pin remotion-best-practices 1.2.0
npx vskill@latest unpin remotion-best-practices

vskill versions <skill>

List the published versions of a skill, and optionally diff two of them.

bash
npx vskill@latest versions remotion-best-practices
npx vskill@latest versions remotion-best-practices --diff
FlagDescription
--diffShow a unified diff between the installed and the latest version
--from <version>Start version for the diff
--to <version>End version for the diff
--jsonOutput as JSON

vskill diff <skill> <from> <to>

Show what changed in every file between two published versions.

bash
npx vskill@latest diff remotion-best-practices 1.1.0 1.2.0 --stat
FlagDescription
--statSummary only: each file with lines added and removed, then a total
--files <pattern>Only files matching this glob
--jsonThe raw compare response as JSON

vskill doctor

Check the skill folders of every agent for the same skill installed twice with different content, identical copies, broken or redundant links, a frontmatter name that differs from its folder, names or descriptions over the length limits, and lockfile entries with nothing on disk. It exits 1 while problems remain. --fix moves broken links into _archive/<date>/, never deletes a folder with unique content and never edits a lockfile.

bash
npx vskill@latest doctor
npx vskill@latest doctor --global --fix
FlagDescription
--globalCheck the global (user) skill folders only
--projectCheck the current project's skill folders only
--fixArchive broken links, remove redundant links, replace identical copies with links
--jsonOutput the report as JSON

vskill check <skill> [path]

Before you run a skill, check that what its frontmatter declares is in place: the MCP servers it needs, its secrets, its Python version and its test runner. It exits 0 when everything is there, 1 when something required is missing and 2 for warnings only. --json prints the result for scripts.

bash
npx vskill@latest check my-skill

vskill audit [path]

Scan the files of a whole project, not only its skills, with the Tier 1 patterns. Up to 500 files by default. The exit code is 0 for PASS, 1 for CONCERNS and 2 for FAIL, so a CI step fails on its own.

bash
npx vskill@latest audit
npx vskill@latest audit --severity high
npx vskill@latest audit --ci > vskill.sarif
FlagDescription
--ciPrint SARIF v2.1.0 for GitHub code scanning and other CI tools
--jsonPrint the results as JSON
--report [path]Also write a Markdown report
--severity <level>Minimum severity to report: critical, high, medium, low or info
--exclude <patterns>Comma-separated paths to skip
--max-files <n>Maximum files to scan, 500 by default
--fixInclude a suggested fix with each finding
In CI

--ci prints SARIF v2.1.0 to stdout. Save it to a file and upload it to GitHub code scanning, or let the exit code stop the job.

vskill audit-webmcp [urls...]

Check the WebMCP tools that websites register, in headless Chromium, without running any tool. It reports write actions that do not declare themselves, read-only claims on tools that write, poisoned tool descriptions and tools registered by third-party scripts. Playwright is optional; pass --executable-path to use a Chromium binary you already have.

bash
npx vskill@latest audit-webmcp https://example.com
npx vskill@latest audit-webmcp --urls-file sites.txt --json --out report.jsonl --fail-on high
FlagDescription
--urls-file <path>Read URLs from a file, one per line (# comments allowed)
--jsonOutput JSON, or JSONL with one site per line for several URLs
--out <file>Write the report to a file
--fail-on <severity>Exit 1 when a finding is at or above critical, high, medium, low or info
--concurrency <n>Sites scanned in parallel, 4 by default
--timeout <ms>Page load timeout per site, 30000 by default
--executable-path <path>Chromium or chrome-headless-shell binary to use

vskill info <skill>

Show what the registry knows about a skill: author, description, version, installs, repository, certification and trust tier, and provenance.

bash
npx vskill@latest info remotion-best-practices

vskill submit <source>

Submit a skill from a GitHub repository to verified-skill.com. It goes through the Tier 1 scan, the model review and the provenance check before it is listed; the trust center explains each step. With --private, the skill is published only to your signed-in account; --tenant <slug> picks the account when you belong to more than one.

bash
npx vskill@latest submit owner/repo
npx vskill@latest submit owner/repo --private --tenant my-team

Submitting again republishes. Push your change to SKILL.md (raise its version in the frontmatter), then run the same submit command: the registry rescans the skill and publishes the new content as a new version, and the earlier versions stay installable with owner/repo/skill@version. A rejected skill is not a duplicate either: change SKILL.md and submit again for a new scan. The registry also rescans published skills whose source has changed on its own, so a push is picked up even if you do not resubmit.

FlagDescription
--skill <name>Pick one skill from a repository that holds several
--path <path>Path to SKILL.md inside the repository
--browserSign in with GitHub in the browser instead of the API
--privatePublish only to a signed-in private account, never to the public registry
--tenant <slug>The account that owns the private skill (with --private). vskill orgs list shows yours
--no-waitReturn as soon as the private submission is created
--submission <id>Read or wait for an existing private submission
Before submitting

Run npx vskill@latest scan ./your-skill first. The security guidelines list the patterns and a pre-submission checklist.

vskill blocklist [list|sync|check]

The local copy of the registry's blocklist of known malicious skills. list shows it, sync fetches the latest from verified-skill.com, and check <name> tells you whether one skill is on it.

bash
npx vskill@latest blocklist sync
npx vskill@latest blocklist check some-skill

vskill init

Detect the agents installed on your machine, create vskill.lock and sync the core skills. Add --agent <id> to include an agent that is not detected.

bash
npx vskill@latest init

vskill auth [login|status|logout]

Sign in to GitHub with the device flow, for private skills. login --repos also grants read access to your private repositories. status shows who you are signed in as (--json, --refresh), and logout clears the stored credentials.

bash
npx vskill@latest auth login --repos
npx vskill@latest auth status

vskill orgs [list|use|current]

Choose the account private skills come from. list shows the accounts you belong to and marks the active one, use <slug> switches, and current prints the active slug. vskill whoami shows your GitHub login, the active account and the list on one screen.

bash
npx vskill@latest orgs list
npx vskill@latest orgs use my-team
npx vskill@latest whoami

vskill keys [set|list|remove|path]

Store model provider keys for Skill Studio and evals in ~/.vskill/keys.env. Providers are anthropic, openai, openrouter and github; set github and remove github use the OS keychain instead. list shows stored keys redacted, and path prints where the file is.

bash
npx vskill@latest keys set anthropic
npx vskill@latest keys list

More commands

Run any of these with --help for its flags.

vskill enable <name>
Turn a previously installed skill back on in Claude Code
vskill disable <name>
Turn a skill off in Claude Code and leave its files on disk
vskill clone [source]
Fork an installed skill or plugin under a new author, with provenance
vskill studio
Open Skill Studio in the browser for local skill work
vskill eval <subcommand>
Evaluate skills: init, run, coverage, generate-all, serve
vskill skill <subcommand>
Skill builder: new, import, list, info, publish
vskill plugin new <name>
Scaffold a plugin folder with its manifest
vskill marketplace
Sync or list the entries in marketplace.json
vskill cleanup
Reconcile missing plugin registrations
vskill stamp-versions
Add a version to local SKILL.md files that lack one (dry run by default)
vskill repair-skills
Find and restore SKILL.md files with duplicated fields (dry run by default)

Related resources