
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
@skillkit/core
Advanced tools
Core engine for SkillKit - skill discovery, cross-agent translation, recommendations, session memory, testing, and workflow orchestration.
npm install @skillkit/core
import { findAllSkills, discoverSkills, parseSkill } from '@skillkit/core';
// Find all installed skills
const skills = findAllSkills(['.claude/skills', '.cursor/skills']);
// Discover skills from a repository
const repoSkills = await discoverSkills('anthropics/skills');
// Parse a single skill file
const skill = parseSkill('./my-skill/SKILL.md');
import { translateSkill, translateSkillFile, TranslatorRegistry } from '@skillkit/core';
// Translate skill content to Cursor format
const result = translateSkill(skillContent, 'cursor');
console.log(result.content); // MDC format for Cursor
// Translate a skill file
const translated = await translateSkillFile('./skill.md', 'windsurf');
// Get available translators
const registry = new TranslatorRegistry();
const formats = registry.getSupportedFormats();
import { ProjectDetector, RecommendationEngine, ContextManager } from '@skillkit/core';
// Detect project context
const detector = new ProjectDetector();
const profile = await detector.analyze('./my-project');
// profile.stack includes: languages, frameworks, libraries, testing tools, etc.
// Get skill recommendations
const engine = new RecommendationEngine();
const recommendations = engine.recommend(profile, availableSkills);
// Returns skills sorted by match score
// Manage project context
const ctx = new ContextManager('./my-project');
await ctx.init();
const context = ctx.getContext();
import {
createMemoryCompressor,
createMemoryInjector,
LearningStore,
ObservationStore,
} from '@skillkit/core';
// Compress observations into learnings
const compressor = createMemoryCompressor('./my-project');
const learnings = compressor.compress();
// Inject relevant memories into prompts
const injector = createMemoryInjector('./my-project');
const memories = injector.search('authentication patterns');
// Manage learnings directly
const store = new LearningStore('./my-project');
const learning = store.add({
title: 'React hooks best practices',
content: 'Always cleanup effects...',
tags: ['react', 'hooks'],
});
import { SkillTestRunner, parseTestCases } from '@skillkit/core';
// Run skill tests
const runner = new SkillTestRunner('./my-project');
const results = await runner.runAll();
// Run specific tests
const result = await runner.run('./my-skill', {
tags: ['unit'],
verbose: true,
});
// Parse test cases from skill
const testCases = parseTestCases(skillContent);
import { WorkflowOrchestrator, parseWorkflow, WorkflowStore } from '@skillkit/core';
// Parse and run a workflow
const workflow = parseWorkflow('./workflow.yaml');
const orchestrator = new WorkflowOrchestrator(workflow);
await orchestrator.execute();
// Manage workflows
const store = new WorkflowStore('./my-project');
const workflows = store.list();
import { createMarketplaceAggregator, MarketplaceSource } from '@skillkit/core';
// Browse skill marketplace
const marketplace = createMarketplaceAggregator();
const results = await marketplace.search({ query: 'react' });
// Filter by tags
const filtered = await marketplace.search({
query: 'authentication',
tags: ['security', 'auth'],
limit: 10,
});
The translator supports all 17 SkillKit-compatible agents:
| Agent | Format |
|---|---|
| Claude Code | SKILL.md |
| Cursor | MDC (.mdc) |
| Codex | SKILL.md |
| Gemini CLI | SKILL.md |
| Windsurf | Markdown |
| GitHub Copilot | Markdown |
| OpenCode, Antigravity, Amp, Goose, Kilo, Kiro, Roo, Trae | SKILL.md |
| Universal | SKILL.md |
interface CanonicalSkill {
name: string;
description?: string;
version?: string;
author?: string;
tags?: string[];
globs?: string[];
alwaysApply?: boolean;
content: string;
metadata?: Record<string, unknown>;
}
interface TranslationResult {
content: string;
format: string;
warnings?: string[];
}
interface ProjectProfile {
name: string;
type: 'web-app' | 'api' | 'cli' | 'library' | 'unknown';
stack: {
languages: Detection[];
frameworks: Detection[];
libraries: Detection[];
testing: Detection[];
databases: Detection[];
};
}
Full documentation: https://github.com/rohitg00/skillkit
Apache-2.0
FAQs
Core functionality for SkillKit - skill discovery, parsing, and translation
The npm package @skillkit/core receives a total of 193 weekly downloads. As such, @skillkit/core popularity was classified as not popular.
We found that @skillkit/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.