Getting Started

v1.2.12

vskill scans, verifies, and installs AI skills across 56 agent platforms. Every install goes through a security pipeline — static pattern analysis, LLM intent review, and provenance verification.

Install

No global installation required. Run with npx for one-off use, or install globally for repeated use.

bash
# No install required — run directly
npx vskill@latest install remotion-best-practices

Skill Studio — the local IDE for skills

Studio is a localhost workbench for authoring, testing, and publishing skills. It opens at a deterministic per-project port and talks only to localhost — the server proxies upstream to verified-skill.com and provider APIs (CORS-free by design).

bash
npx vskill@latest studio
├── AuthorAI-assisted skill generator — pick the Anthropic skill-creator engine or the vskill-native engine. Edit SKILL.md live with a Linear/Raycast-grade UI.
├── EvalSSE-streamed pass/fail benchmarks across Claude, GPT, Llama, Gemini, local Ollama / LM Studio. Anthropic Batch API supported (50% cheaper).
├── A/B compareRun prompts with vs. without your skill — a blind LLM judge ranks outputs as EFFECTIVE / MARGINAL / INEFFECTIVE / DEGRADING.
├── Find⌘⇧K palette searches the verified-skill.com registry inside Studio — install with consent + provenance.
└── PublishOne-click git push from the UI, then opens the verified-skill.com submit form pre-filled.
Audit trail
Every Studio mutation is logged to ~/.vskill/studio-ops.jsonl.
Studio runtime: one Node process, two ports. The browser only ever talks to localhost — the server proxies upstream calls so nothing CORS-leaks. (Mermaid — auto-layout, source at diagrams/03-runtime-topology.mmd)
Same diagram, Excalidraw — hand-drawn aesthetic, brand colors. Layout is hand-placed (no auto-routing) so it costs more to maintain when the system changes.

Install your first skill

1

Install a skill from the registry

Choose a skill from the registry or install by name.

bash
npx vskill@latest install remotion-best-practices
2

Security scan runs automatically

Every install triggers a security scan — 58 static patterns across 9 threat categories. There is no --skip-scan flag.

3

Skill is installed to all detected agents

vskill auto-detects your installed agents (Claude Code, Cursor, Copilot, etc.) and installs the skill to all of them. Target a specific agent with --agent cursor.

4

Use the skill in your agent

The skill is now available in your AI agent. Invoke it via /skill-name or reference it in your prompts.

How it works

Every install flows through four stages. No stage can be skipped.

bash
  ┌──────────┐     ┌──────────┐     ┌──────────┐     ┌──────────┐
  │  Source   │────>│   Scan   │────>│  Verify  │────>│ Install  │
  │          │     │          │     │          │     │          │
  │ GitHub   │     │ 58 rules │     │ LLM      │     │ Pin SHA  │
  │ Registry │     │ Blocklist│     │ analysis │     │ Lock ver │
  │ Local    │     │ Patterns │     │ Intent   │     │ Symlink  │
  └──────────┘     └──────────┘     └──────────┘     └──────────┘
Lock file
The vskill.lock file records the SHA-256 hash, scan date, and trust tier for every installed skill. Running vskill update diffs against the locked version and re-scans before applying any changes.

Three-tier verification

ScannedBaseline

The Tier 1 scan passes: deterministic pattern checks against known attack techniques (58 in the vskill CLI). It runs on every install.

VerifiedRecommended

The scan, then a language model reviews the skill on six questions, from malicious intent to prompt injection.

CertifiedHighest

A high trust score and model review, a source repository that matches, and a completed human review. Skills from listed vendor organizations are certified on publication.

56 agent platforms

vskill auto-detects your installed agents and installs skills to all of them simultaneously.

├── CLI & TerminalClaude Code, Cursor, Copilot, Windsurf, Codex, Gemini CLI, Amp, Cline, Roo Code, Goose, Aider, Kilo, Devin, OpenHands, and more
├── IDE ExtensionsVS Code, JetBrains, Zed, Neovim, Emacs, Sublime Text, Xcode
└── Cloud & HostedReplit, Bolt, v0, GPT Pilot, Plandex, Sweep

Target a specific agent with --agent cursor. vskill handles agent-specific config paths and formats automatically.

Where skills live on disk: source (authored once) on the left, installed (materialized per-agent by vskill install) on the right. Studio scans both.

Skills vs plugins

├── SkillsSingle SKILL.md files that work with any of the 56 supported agents. Drop a SKILL.md into the agent's commands directory — no configuration needed.
└── PluginsMulti-component containers for Claude Code. Bundle skills, hooks, commands, and agents under a single namespace with enable/disable support.
Learn more
See the Plugins guide for how to install and use the 9 domain plugins with 20 expert skills.

Next steps

CLI ReferenceAll commands and flags
→
Security Guidelines58 scan patterns and how to pass verification
→
Plugin MarketplaceBrowse 20 expert skills across 9 domains
→
Submit a SkillPublish your own skill to the registry
→

Related resources