skilla

imageCI imageRelease imageHomebrew imageAgent Skills imageAgent Plugins imageMade for AI agents imagePure Bash imageShellCheck imagePOSIX imageLicense: MIT

A small, dependency-light CLI for installing Agent Skills and Agent Plugins from git repositories into the locations agents read them from.

It clones a repo, discovers skills/<name>/SKILL.md, resolves declared dependencies (requires:), and installs the skills into a project (.agents/skills/) or your home (~/.agents/skills/) — tracking what's installed in a small JSON registry so it can list, update, and remove cleanly. When the source is an Agent Plugins 1.0.0 package, skilla plugin validates the manifest, installs the whole package, and hands you the MCP config with ${PLUGIN_ROOT}/${PLUGIN_DATA} already expanded.

Built to install agentskills.io skills for agents such as Devin (which indexes .agents/skills/<name>/SKILL.md) while staying host-agnostic — a drop-in for environments where a vendor plugin manager isn't available.

Requirements

bash, git, and jq (apt install jq / brew install jq).

Install

Managed — Homebrew (macOS/Linux):

brew install junior/tap/skilla

Managed — mise:

mise use -g 'github:junior/skilla[exe=skilla,matching=skilla]@0.4.1'

Quick — fetch the single script onto your PATH:

curl -fsSL https://raw.githubusercontent.com/junior/skilla/v0.4.1/skilla \
  -o ~/.local/bin/skilla && chmod +x ~/.local/bin/skilla

Usage

skilla <command> [options] [arguments]

Skills:
  add <git-url>        Install skills from a repo (with --force to reinstall)
  repo ls <git-url>    List a repo's skills (name · version · description) — no install
  update [skill]       Update one skill, or all if omitted
  list, ls             List installed skills + versions
  info <skill>         Show a skill's details + declared dependencies
  remove, rm [skill]   Remove a skill (or all with --all)

Plugins (Agent Plugins 1.0.0):
  plugin ls [git-url]  Inspect a plugin at a URL, or list installed plugins
  plugin add <git-url> Install a plugin: package + its skills + its plugin data
  plugin info <name>   Manifest, components, PLUGIN_ROOT / PLUGIN_DATA
  plugin mcp <name>    Print its mcp.json with the placeholders expanded
  plugin remove <name> Uninstall the package, its skills and its data
  plugin validate [dir] Conformance-check a plugin directory (default: .)
  plugin init [dir]    Scaffold a conformant plugin.json + skills/

Other:
  verify <artifact>    Verify a cosign-signed release artifact
  version              Print version (also -v, --version)

Options:
  --scope <user|project>  project = ./.agents/skills/ (default); user = ~/.agents/skills/
  -g, --global         Shorthand for --scope user
  --path <dir>         Install into a custom directory (e.g. .claude/skills)
  -s, --skill <name>   Install only one named skill from the repo
  --force              Reinstall even if present
  --check              Report actions without applying them
  -y, --yes            Auto-confirm prompts
  --all                Apply to all (for remove)

Examples

skilla repo ls https://github.com/microsoft/azure-skills   # browse before installing
skilla add git@github.com:acme/skills.git              # every skill in the repo
skilla add git@github.com:acme/skills.git -s nginx     # one skill (+ its deps)
skilla add --scope user git@github.com:acme/skills.git # into ~/.agents/skills (-g works too)
skilla list
skilla info nginx
skilla update nginx
skilla remove nginx

Agent Plugins

An Agent Plugin is a directory with a plugin.json manifest and components in fixed locations — skills/<name>/SKILL.md and mcp.json. The format is vendor-neutral (TSC: Amazon, Cursor, Google, Microsoft, OpenAI, Vercel), so the same package loads in ChatGPT/Codex, Cursor, GitHub Copilot, Kiro and VS Code — and here.

skilla plugin ls https://github.com/acme/my-plugin    # manifest + skills + MCP servers
skilla plugin add https://github.com/acme/my-plugin
skilla plugin ls                                       # installed plugins
skilla plugin mcp my-plugin                            # ready-to-paste MCP config
skilla plugin remove my-plugin

skilla does not run MCP servers. skilla plugin mcp <name> prints the plugin's mcp.json with ${PLUGIN_ROOT}/${PLUGIN_DATA} expanded to absolute paths (and PLUGIN_ROOT/PLUGIN_DATA injected into each stdio server's env), ready to paste into whatever host actually launches them.

Failure boundaries follow the spec: unknown top-level manifest fields and a non-object extensions are reported but non-fatal; any other manifest violation rejects the whole plugin; an invalid mcp.json disables MCP only; a bad single server entry or skill is skipped and the rest still installs.

Authoring a plugin

skilla plugin init ./my-plugin    # scaffold a conformant plugin.json + skills/
skilla plugin validate .          # check manifest, mcp.json and skills against 1.0.0

validate checks the closed manifest schema, the name grammar, the closed author object, extension namespacing, the mcp.json transports (stdio single-token command, cwd containment, reserved PLUGIN_ROOT/PLUGIN_DATA env keys, http-only-for-loopback URLs, case-insensitive duplicate headers) and each skill's SKILL.md frontmatter. Unlike a loading client it keeps going after a fatal manifest error, so you can fix everything in one pass.

How it works

• Discovery — a source repo holds skills at skills/<name>/SKILL.md (a repo with a single root SKILL.md is treated as one skill). This is also the Agent Plugins location, so a plugin's skills are found the same way.
• Dependencies — if a skill declares metadata.requires (or a top-level requires:) in its SKILL.md frontmatter, or requiredSkills under plugin.json extensions["dev.skilla"], those sibling skills are installed automatically from the same source (transitive closure).
• Version — read from SKILL.md frontmatter metadata.version — the location the agentskills.io spec defines, which has no top-level version: field. A top-level version: is still read as a legacy fallback, then plugin.json, then the commit hash.
• Registry — installs are recorded in registry.json beside the skills dir (source, commit, version, timestamps), so list/update/remove are exact and only ever touch skills this tool installed.
• No code runs at install time — it clones and copies; a skill's own scripts only run later when an agent uses it.
• Fast on big catalogs — add --skill, update, and repo ls use partial + sparse clones (only the needed skill's files download; dependencies materialize on demand), falling back to a plain shallow clone when the server/git can't do it.

Scopes

Use skilla from your AI CLI (the skilla skill)

This repo also ships a skill named skilla (skills/skilla/SKILL.md, agentskills.io format) that teaches an AI CLI — Claude Code, Devin, Cursor, anything that reads agent skills — to install and manage skills through skilla instead of its vendor-specific mechanism. Install it once and "install the nginx skill from " just works inside the agent:

# for the current project (Devin indexes .agents/skills/):
skilla add https://github.com/junior/skilla --skill skilla

# user-wide:
skilla add --scope user https://github.com/junior/skilla --skill skilla

# for a Claude Code project (its skills dir):
skilla add --path .claude/skills https://github.com/junior/skilla --skill skilla

This repo is itself a conformant Agent Plugin (plugin.json + skills/), so any Agent Plugins client can load it — including skilla:

skilla plugin add https://github.com/junior/skilla

Development

bash tests/test.sh     # self-contained: builds a fixture catalog, asserts install + deps
shellcheck skilla tests/test.sh

License

MIT