
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
@skillkit/cli
Advanced tools
Command-line interface for SkillKit - install, manage, translate, and sync skills across 32 AI coding agents.
npm install -g @skillkit/cli
# or
npm install -g skillkit # includes CLI
# Get skill recommendations for your project
skillkit recommend
# Install skills from GitHub
skillkit install anthropics/skills
# Translate skills between agents
skillkit translate my-skill --to cursor
# Launch interactive TUI
skillkit ui
skillkit install <source> # Install from GitHub/GitLab/Bitbucket/local
skillkit remove <skills> # Remove installed skills
skillkit update [skills] # Update skills from source
skillkit list # List installed skills
skillkit enable <skills> # Enable specific skills
skillkit disable <skills> # Disable specific skills
skillkit sync # Sync to agent config
skillkit read <skills> # Read skill content
skillkit recommend # Project-based recommendations
skillkit recommend --search "auth" # Task-based search
skillkit recommend --category security # Filter by category
skillkit recommend --min-score 80 # Quality threshold
skillkit marketplace # Browse skills
skillkit marketplace search "react" # Search marketplace
skillkit marketplace --tags typescript # Filter by tags
skillkit marketplace refresh # Refresh index
skillkit translate <skill> --to <agent> # Translate single skill
skillkit translate --all --to cursor # Translate all skills
skillkit translate skill --dry-run # Preview without writing
skillkit context init # Analyze project, create context
skillkit context show # Display current context
skillkit context sync --all # Sync to all detected agents
skillkit context export # Export context file
skillkit memory status # View memory status
skillkit memory search "auth" # Search learnings
skillkit memory list # List all learnings
skillkit memory compress # Compress observations
skillkit memory export <id> # Export as skill
skillkit memory add # Add manual learning
skillkit memory --global # Use global scope
skillkit test # Run all skill tests
skillkit test ./my-skill # Test specific skill
skillkit test --tags unit # Run tagged tests
skillkit workflow list # List workflows
skillkit workflow run <name> # Execute workflow
skillkit workflow create # Create new workflow
skillkit cicd github-action # Generate GitHub Actions
skillkit cicd gitlab-ci # Generate GitLab CI
skillkit cicd pre-commit # Generate pre-commit hook
skillkit cicd init # Initialize CI/CD templates
skillkit team init --name "Team" # Initialize team
skillkit team share <bundle> # Share skill bundle
skillkit team import <path> # Import bundle
skillkit team list # List team bundles
skillkit team sync # Sync with remote
skillkit team remove <bundle> # Remove bundle
skillkit team bundle-create # Create new bundle
skillkit team bundle-export <id> # Export bundle
skillkit team bundle-list # List all bundles
skillkit plugin list # List installed plugins
skillkit plugin install <name> # Install plugin
skillkit plugin uninstall <name> # Uninstall plugin
skillkit plugin enable <name> # Enable plugin
skillkit plugin disable <name> # Disable plugin
skillkit plugin info <name> # Plugin details
skillkit methodology list # List methodologies
skillkit methodology load <name> # Load methodology
skillkit methodology apply <name> # Apply to project
skillkit plan parse <file> # Parse plan file
skillkit plan validate <file> # Validate plan
skillkit plan execute <file> # Execute plan
skillkit plan status # Plan execution status
skillkit hook list # List registered hooks
skillkit hook register <event> # Register new hook
skillkit hook trigger <event> # Trigger hook manually
skillkit hook enable <id> # Enable hook
skillkit hook disable <id> # Disable hook
skillkit command generate <agent> # Generate agent-native commands
skillkit command list <agent> # List available commands
skillkit scan <path> # Scan skill for vulnerabilities
skillkit scan <path> --format json # Output as JSON
skillkit scan <path> --format sarif # SARIF for GitHub Code Scanning
skillkit scan <path> --fail-on high # Exit code 1 if HIGH+ findings
skillkit scan <path> --skip-rules UC001,UC002 # Skip specific rules
Detects: prompt injection, command injection, data exfiltration, tool abuse, hardcoded secrets, unicode steganography.
Skills are automatically scanned during install (use --no-scan to skip) and publish.
skillkit init # Initialize in project
skillkit init --agent cursor # Initialize for specific agent
skillkit validate ./skill # Validate skill format
skillkit create my-skill # Create new skill
skillkit settings # View all settings
skillkit settings --set key=value # Update setting
skillkit install owner/repo # GitHub repository
skillkit install gitlab:owner/repo # GitLab repository
skillkit install ./local/path # Local directory
# Options
--list # List available skills without installing
--skills=pdf,xlsx # Install specific skills
--all # Install all discovered skills
--yes # Skip confirmation prompts
--global # Install globally
--force # Overwrite existing
--no-scan # Skip security scan
--agent=cursor,windsurf # Install to specific agents
import {
installCommand,
listCommand,
syncCommand,
translateCommand,
recommendCommand,
} from '@skillkit/cli';
// Install skills programmatically
await installCommand('anthropics/skills', {
agent: ['claude-code', 'cursor'],
yes: true,
});
// List installed skills
const skills = await listCommand({ json: true });
// Security scan
import { SkillScanner, formatResult } from '@skillkit/core';
const scanner = new SkillScanner({ failOnSeverity: 'high' });
const result = await scanner.scan('./my-skill');
console.log(formatResult(result, 'summary'));
// Sync to agent
await syncCommand({ all: true });
// Translate skill
await translateCommand('my-skill', {
to: 'cursor',
dryRun: false,
});
// Get recommendations
const recs = await recommendCommand({
path: './my-project',
minScore: 70,
});
# GitHub Actions example
- name: Setup skills
run: |
npx skillkit install owner/skills --skills=lint,test --yes
npx skillkit sync --yes
| Agent | Format |
|---|---|
| Claude Code | SKILL.md |
| Cursor | MDC (.mdc) |
| Codex | SKILL.md |
| Gemini CLI | SKILL.md |
| Windsurf | Markdown |
| GitHub Copilot | Markdown |
| + 26 more | SKILL.md |
Full documentation: https://github.com/rohitg00/skillkit
Apache-2.0
FAQs
CLI commands for SkillKit
The npm package @skillkit/cli receives a total of 297 weekly downloads. As such, @skillkit/cli popularity was classified as not popular.
We found that @skillkit/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.