Asm

<p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="assets/logo/logo-full.svg" /> <source media="(prefers-color-scheme: light)" srcset="assets/logo/logo-black.svg" /> <img src="assets/logo/logo-full.svg" alt="asm" width="340" /> </picture> </p> <p align="center"> <a href="https://www.npmjs.com/package/agent-skill-manager"><img src="https://img.shields.io/npm/v/agent-skill-manager.svg" alt="npm version" /></a> <a href="https://www.npmjs.com/package/agent-skill-manager"><img src="https://img.shields.io/npm/dm/agent-skill-manager.svg" alt="npm downloads" /></a> <a href="https://github.com/luongnv89/agent-skill-manager/stargazers"><img src="https://img.shields.io/github/stars/luongnv89/agent-skill-manager.svg?style=social" alt="GitHub stars" /></a> <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green.svg" alt="MIT License" /></a> <a href="https://github.com/luongnv89/agent-skill-manager/actions"><img src="https://github.com/luongnv89/agent-skill-manager/actions/workflows/ci.yml/badge.svg" alt="CI" /></a> <a href="https://bun.sh"><img src="https://img.shields.io/badge/runtime-Bun%20%E2%89%A5%201.0-black.svg" alt="Bun" /></a> </p> <h1 align="center">One tool to manage every AI agent's skills</h1> <p align="center"> Stop juggling skill directories across Claude Code, Codex, Cursor, Windsurf, and 10+ other AI agents.<br/> <strong>agent-skill-manager</strong> (<code>asm</code>) gives you a single TUI and CLI to install, search, audit, and organize all your agent skills — everywhere. </p> <p align="center"> <a href="#get-started-in-30-seconds"><strong>Get Started in 30 Seconds &rarr;</strong></a> &nbsp;&nbsp;|&nbsp;&nbsp; <a href="https://luongnv.com/asm/"><strong>Browse 2,800+ Skills Online &rarr;</strong></a> </p>

---

🌐 ASM Catalog — Browse Skills in Your Browser

Don't want to install anything yet? Explore the full skill catalog online →

Search, filter by category or repo, and copy install commands — all from a single page. No signup, no backend, no tracking. Share filtered views via URL (e.g. ?q=code-review&cat=development).

---

<p align="center"> <img src="assets/screenshots/tui.png" alt="agent-skill-manager TUI dashboard" width="800" /> </p>

---

Your AI agent skills are a mess

You use Claude Code at work, Codex for side projects, and OpenClaw for experiments. Each tool keeps skills in its own hidden directory with its own conventions. Here's what that looks like in practice:

• Skills scattered everywhere — ~/.claude/skills/, ~/.codex/skills/, ~/.openclaw/skills/, project-level .claude/skills/... you have the same skill installed three times and can't remember which version is where
• No visibility — there's no quick way to see what's installed, what's duplicated, or what's outdated across all your agents
• Installing is manual and risky — you clone repos, copy folders, hope the SKILL.md is valid, and pray you didn't just install something that exfiltrates your codebase

The more AI agents you use, the worse this gets. Every new tool adds another skill directory to babysit.

asm brings order to the chaos

agent-skill-manager is a single command that manages skills across every AI coding agent you use. One TUI. One CLI. Every agent.

• See everything at once — List, search, and filter skills across all providers and scopes from one dashboard. No more ls-ing through hidden directories.
• Install from GitHub in one command — asm install github:user/repo handles cloning, validation, and placement. Supports single-skill repos, multi-skill collections, subfolder URLs, and private repos via SSH.
• Catch problems before they bite — Built-in security scanning flags dangerous patterns (shell execution, network access, credential exposure, obfuscation) before you install. Duplicate audit finds and cleans redundant skills across providers.
• Create and test skills locally — Scaffold new skills with asm init, symlink them for live development with asm link, audit for security issues, and verify metadata — all before publishing. See the full local dev workflow ↓
• Works with every major agent — 17 providers built-in: Claude Code, Codex, OpenClaw, Cursor, Windsurf, Cline, Roo Code, Continue, GitHub Copilot, Aider, OpenCode, Zed, Augment, Amp, Gemini CLI, Google Antigravity, and a generic Agents provider. Add custom providers in seconds via config.
• Two interfaces, one tool — Full interactive TUI with keyboard navigation, search, and detail views. Or use the CLI with --json for scripting and automation.

<p align="center"> <img src="assets/screenshots/asm-stats.png" alt="asm stats — skill statistics across all providers" width="700" /> <br/><em>asm stats — totals, disk usage, and per-provider breakdown at a glance</em> </p>

How it works

1. Install asm — one command via npm, Bun, or curl
2. Run asm — it auto-discovers skills across all configured agent directories
3. Manage everything — install, search, inspect, audit, and uninstall skills from the TUI or CLI
4. Stay safe — security scan skills before installing, detect duplicates, and clean up with confidence

<p align="center"> <a href="#get-started-in-30-seconds"><strong>Start Managing Your Skills &rarr;</strong></a> </p> <p align="center"> <img src="assets/screenshots/asm-search-code-review.png" alt="asm search — find installed and available skills" width="700" /> <br/><em>asm search code-review — finds installed skills and suggests new ones from indexed repos</em> </p>

---

Build, Test, and Ship Your Own Skills

asm isn't just for consuming skills — it's the complete toolkit for creating, developing, auditing, and testing skills locally before you share them.

1. Scaffold a new skill

Interactive mode — pick a target tool:

asm init my-skill

Scaffold directly into Claude Code:

asm init my-skill -p claude

Scaffold in a custom directory:

asm init my-skill --path ./skills

This creates a my-skill/SKILL.md with valid YAML frontmatter and a markdown template ready to fill in.

2. Develop with live reload via symlink

Symlink into Claude Code's skill directory:

asm link ./my-skill -p claude

Or into Codex, or any other tool:

asm link ./my-skill -p codex

Edit the source files — changes are reflected immediately in the agent. No reinstall needed. This is the fastest iteration loop for skill development.

3. Audit your skill for security issues

Audit an installed skill by name:

asm audit security my-skill

Audit a local directory:

asm audit security ./path/to/my-skill

Audit every installed skill:

asm audit security --all

The security scanner flags dangerous patterns — shell execution, network access, credential exposure, obfuscation, and external URLs — so you can catch problems before users install your skill.

4. Inspect and verify metadata

Check name, version, description, file count:

asm inspect my-skill

Machine-readable output for CI:

asm inspect my-skill --json

5. Test the install flow locally

Once your skill is on GitHub, verify that end users can install it cleanly.

Install your own skill as a user would:

asm install github:you/awesome-skill

Install to a specific tool:

asm install github:you/awesome-skill -p claude

Install a specific skill from a multi-skill repo:

asm install github:you/skills --path skills/awesome-skill

Force reinstall to test upgrades:

asm install github:you/awesome-skill --force

Non-interactive install (useful for CI):

asm install github:you/awesome-skill -p claude --yes --json

This catches issues that local development misses — broken repo structure, missing files, invalid frontmatter in a clean install context.

Typical local development workflow

1. Scaffold — asm init awesome-skill -p claude
2. Edit your SKILL.md
3. Link for live testing — asm link ./awesome-skill -p claude
4. Test with your AI agent
5. Security audit — asm audit security awesome-skill
6. Verify metadata — asm inspect awesome-skill
7. Push to GitHub
8. Verify install flow — asm install github:you/awesome-skill

Whether you're building skills for yourself or publishing them for the community, asm gives you the full create → develop → audit → ship pipeline in one tool.

---

Skill Verification

Skills indexed by asm are automatically evaluated against a set of verification criteria. Skills that pass all criteria receive a verified badge in the catalog and "verified": true in the index JSON. Skills that fail any criterion are still indexed but marked as unverified.

Verification Criteria

A skill must satisfy all four of the following to be verified:

1. Valid frontmatter -- The SKILL.md file must contain YAML frontmatter with both a name and a description field. Empty or whitespace-only values fail this check.

2. Meaningful body content -- The markdown body (everything after the frontmatter block) must contain at least 20 characters of instruction text. A SKILL.md that is only frontmatter with no real guidance for the agent will fail.

3. No malicious patterns -- The full SKILL.md content is scanned for dangerous code patterns:

   • atob() calls (runtime base64 decoding / obfuscation)
   • Suspicious base64-encoded strings (40+ character base64 blocks with padding)
   • Hex-escape sequences (4+ consecutive \xNN escapes)
   • Hardcoded credentials (API_KEY, SECRET_KEY, or PASSWORD assignments)

4. Proper structure -- The skill directory must exist and contain a SKILL.md file that the ingestion pipeline can read.

How to Reproduce Locally

You can verify your skill befo