
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
CLI tool to search, open, and run extension assets from an agentikit stash directory.
A package manager for AI agent capabilities — tools, skills, commands, agents, knowledge, and scripts — that works with any AI coding assistant that can run shell commands.
You build up useful scripts, prompts, and agent configs. Agent-i-Kit lets you
organize them into a searchable stash, share them as installable kits,
and give any model a way to discover and use them through akm (Agent Kit
Manager). No plugins required — just CLI output any tool-calling model can read.
Agent-i-Kit requires Bun v1.0+ as its runtime. It uses
Bun-specific APIs (bun:sqlite) that are not available in Node.js.
# Install (requires Bun v1.0+)
bun install -g agentikit
# Initialize your stash
akm init
# Add a kit from GitHub
akm add github:owner/repo
# Search for assets
akm search "deploy"
# Show an asset
akm show script:deploy.sh
Don't want Bun? Use the standalone binary instead — it bundles everything and has no runtime dependencies.
Agent-i-Kit is platform agnostic. Any model that can execute shell commands can search your stash and use what it finds. The workflow is three commands:
akm search "what you need" — find relevant assets (returns JSON)akm show <openRef> — get the details (run command, instructions, prompt, etc.)runCmd, follow the skill instructions, fill in the templateAdd this to your AGENTS.md, CLAUDE.md, system prompt, or any instruction
file to give your agent access to your stash without any additional setup:
You have access to a searchable library of tools, skills, commands, agents,
and knowledge documents via `akm`. Use it to find and
use capabilities before writing something from scratch.
**Finding assets:**
```sh
akm search "<query>" # Search by keyword
akm search "<query>" --type tool # Filter by type (tool, skill, command, agent, knowledge, script)
```
Search returns JSON with scored results. Each hit includes an `openRef` you
use to retrieve the full asset.
**Using assets:**
```sh
akm show <openRef> # Get full asset details
```
What you get back depends on the asset type:
- **script/tool** — A `runCmd` you can execute directly
- **skill** — Instructions to follow (read the full content)
- **command** — A prompt template with placeholders to fill in
- **agent** — A system prompt with model and tool hints
- **knowledge** — A reference doc (use `--view toc` or `--view section --heading "..."` to navigate)
Always search the stash first when you need a capability. Prefer existing
assets over writing new code.
That's it. No plugin, no SDK, no integration code. The model reads the JSON
output from akm and acts on it.
For tighter integration, plugins are available for some platforms. These add native tool bindings so the agent doesn't need to shell out, but they're purely optional — the CLI works everywhere.
OpenCode — Add the OpenCode plugin to your opencode.json:
{
"plugin": ["agentikit-opencode"]
}
Claude Code — Add the prompt snippet above to your CLAUDE.md or
project instructions. Claude Code can run akm commands directly.
Everything else — If your agent can run shell commands, it can use akm.
Add the prompt snippet to whatever instruction mechanism your platform uses.
A kit is a directory of assets you can share and install. There's no required
structure — agentikit classifies assets by file extension and content, not
by directory name. A .sh file is a script whether it lives in scripts/,
deploy/, or at the root. A .md file with tools in its frontmatter is an
agent definition wherever you put it.
That said, using these directory names as an opt-in convention improves indexing confidence:
my-kit/
scripts/ # Executable scripts (.sh, .ts, .js, .py, .rb, .go, etc.)
skills/ # Skill definitions (directories with SKILL.md)
commands/ # Slash commands (.md with $ARGUMENTS or agent frontmatter)
agents/ # Agent definitions (.md with model/tools frontmatter)
knowledge/ # Reference documents (.md)
| Type | What it is | What the agent gets |
|---|---|---|
| script | An executable script | A runCmd the agent can execute, or source for unsupported runtimes |
| skill | A set of instructions | Step-by-step guidance the agent follows |
| command | A prompt template | A template with placeholders to fill in |
| agent | An agent definition | A system prompt, model hint, and tool policy |
| knowledge | A reference document | Navigable content with TOC and section views |
Assets are referenced by type and name (e.g. script:deploy.sh,
knowledge:api-guide.md). See Concepts for details on
how classification works.
Your stash is the local library where assets live. It combines three sources in priority order:
AKM_STASH_DIR), created by akm initakm add (cache-managed)The first match wins, so local assets always override installed ones. Use
akm clone to fork an installed asset into your stash for editing.
Search returns scored results with explainability:
akm search "docker" --type tool
{
"hits": [
{
"name": "docker-build",
"type": "tool",
"description": "Build and push Docker images",
"openRef": "tool:docker-build.sh",
"score": 0.92,
"whyMatched": "matched name tokens, fts bm25 relevance"
}
]
}
Show returns everything the agent needs to act:
akm show tool:docker-build.sh
{
"type": "tool",
"name": "docker-build.sh",
"runCmd": "cd \"/path/to/tools\" && bash \"/path/to/tools/docker-build.sh\"",
"kind": "bash"
}
For knowledge assets, navigate without loading the entire document:
akm show knowledge:api-guide.md --view toc
akm show knowledge:api-guide.md --view section --heading "Authentication"
Install kits from npm, GitHub, any git host, or local directories:
akm add @scope/my-kit # npm
akm add github:owner/repo#v1.2.3 # GitHub with tag
akm add git+https://gitlab.com/org/kit # Any git repo
akm add ./path/to/local/kit # Local directory
Search the registry for community kits:
akm search "code review" --source registry
Manage installed kits:
akm list # Show installed kits with status
akm update --all # Update all (reports version changes)
akm remove owner/repo # Remove and reindex
akm clone tool:deploy.sh # Fork an asset into your stash for editing
"akm" to keywords in package.json or add the akm topic to your GitHub repoagentikit.include to control what gets installedakm submit to appear in akm search --source registrySee the Kit Maker's Guide for a full walkthrough.
Agent-i-Kit requires Bun v1.0+ as its runtime. It uses
Bun-specific APIs (bun:sqlite) that are not available in Node.js.
# Install Bun if you don't have it
curl -fsSL https://bun.sh/install | bash
# Install agentikit
bun install -g agentikit
The standalone binary bundles everything and has no runtime dependencies — no Bun, no Node.js.
# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/itlackey/agentikit/main/install.sh | bash
# Windows (PowerShell)
irm https://raw.githubusercontent.com/itlackey/agentikit/main/install.ps1 -OutFile install.ps1; ./install.ps1
The shell installer verifies the binary against release checksums.
Upgrade the binary in place:
akm upgrade # Download and replace the running binary
akm upgrade --check # Check for updates without installing
| Doc | Description |
|---|---|
| Concepts | Asset types, classification, stash sources, metadata |
| CLI Reference | All akm commands and flags |
| Kit Maker's Guide | Build and share a kit on GitHub, npm, or a network share |
| Registry | Finding, installing, and publishing kits |
| Search | Hybrid search architecture and scoring |
| Indexing | How the search index is built |
| Filesystem | Directory layout and .stash.json schema |
| Configuration | Providers, settings, and Ollama setup |
Agent-i-Kit is approaching v1.0. The core CLI, stash model, and registry are stable and in daily use. Feedback, issues, and PRs welcome — especially around real-world usage patterns and integrations with different AI coding assistants.
FAQs
CLI tool to search, open, and run extension assets from an agentikit stash directory.
We found that agentikit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.