
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@hemliq/agentskills
Advanced tools
CLI to lint, validate, and install Agent Skills (SKILL.md) from the SkillMD registry.
CLI to lint, validate, and install Agent Skills (SKILL.md) from the SkillMD registry.
npx agentskills lint ./my-skill
# or
npm i -g agentskills
| Command | Description |
|---|---|
agentskills lint [path] (check) | Validate SKILL.md files; print diagnostics and a quality score. |
agentskills scan [path] | Report scripts, network calls, and secret access. |
agentskills rules [id] | List lint rules. |
agentskills init [name] | Create a SKILL.md from a template. |
agentskills search <query> | Search the registry. |
agentskills add <source> | Install a skill (registry slug, GitHub repo, or local path). Lints first. |
agentskills list (ls) | List installed skills. |
agentskills remove <names...> (rm) | Remove installed skills. |
agentskills update [names...] | Update installed skills. |
agentskills publish [path] (submit) | Publish to the registry. Exits non-zero on lint errors. |
agentskills login / logout | Store or remove a token. |
All commands accept --json.
Lint formats: text (default), json, sarif, github. Exit codes: 0 clean, 1 errors (or warnings with --strict).
This package shares its engine with skillmds, which also provides an MCP server.
FAQs
CLI to lint, validate, and install Agent Skills (SKILL.md) from the SkillMD registry.
We found that @hemliq/agentskills demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.