
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
claudekit-cli
Advanced tools
Command-line tool and web dashboard for managing ClaudeKit projects.
Version: 1.17.0
ClaudeKit Config UI (ck) provides both CLI and web dashboard for managing ClaudeKit projects. It is built with Bun, TypeScript, and React for development, while the published CLI runs on plain Node.js so end users do not need Bun installed.
Key Features:
ck config ui for configuration and project managementck config across global and project scopes~/.claudekit/projects.json with file lockingComprehensive documentation in /docs:
ck migrate RECONCILE → EXECUTE → REPORT designBefore using ClaudeKit CLI, you need to:
repo scope to download releasesWithout a purchased kit and repository access, the CLI will not be able to download any project templates.
The ClaudeKit CLI is published on npm at npmjs.com/package/claudekit-cli.
End-user runtime note: global installs from npm, pnpm, yarn, or bun all execute the packaged Node.js CLI. Bun is optional for users and only needed for local ClaudeKit CLI development workflows.
npm install -g claudekit-cli
bun add -g claudekit-cli
yarn global add claudekit-cli
pnpm add -g claudekit-cli
After installation, verify it's working:
ck --version
# Top-level command discovery
ck --help
# Open config dashboard immediately
ck config
# Expose the dashboard intentionally to your LAN/Tailscale
ck config --host 0.0.0.0 --no-open
# Command-level help (recommended)
ck config --help
ck skills --help
ck agents --help
ck commands --help
ck migrate --help
By default, ck config binds the dashboard to 127.0.0.1 for local-only access.
Use --host when you intentionally want remote access from another device on the same trusted network:
# Bind to all interfaces
ck config --host 0.0.0.0 --no-open
# Bind to a specific interface or hostname
ck config --host 100.88.12.4 --no-open
ck config --host dashboard.local --no-open
The dashboard still enforces same-origin browser access. Remote access works when you open the UI from the same host/origin that reaches the server, instead of relying on a hardcoded IP allowlist.
# Interactive mode
ck new
# With options
ck new --dir my-project --kit engineer
# Show beta versions
ck new --beta
# With exclude patterns
ck new --exclude "*.log" --exclude "temp/**"
# Optional packages (OpenCode, Gemini)
ck new --opencode --gemini
# Install skills dependencies (Python, Node packages, system tools)
ck new --install-skills
# Command prefix (/ck: namespace to avoid conflicts)
ck new --prefix
# Offline installation (from local archive or directory)
ck new --archive ~/downloads/engineer-v1.16.0.zip
ck new --kit-path ~/extracted-kit/
Flags:
--install-skills: Auto-install Python packages, system tools (FFmpeg, ImageMagick), Node.js packages--prefix: Move commands to /ck: namespace (/plan → /ck:plan)--beta: Show pre-release versions in selection--opencode/--gemini: Install optional packages--archive <path>: Use local archive (zip/tar.gz) instead of downloading--kit-path <path>: Use local kit directory instead of downloadingNote: Run from project root.
# Interactive mode
ck init
# Non-interactive mode with sensible defaults
ck init --yes
ck init -y
# Combine with other flags
ck init -g --kit engineer -y
# With options
ck init --kit engineer --beta
# Global mode (platform-specific paths)
ck init --global
# Fresh installation (⚠️ DESTRUCTIVE - removes ALL customizations)
ck init --fresh
# With exclude patterns and prefix
ck init --exclude "*.local" --prefix
# Offline installation (from local archive or directory)
ck init --archive ~/downloads/engineer-v1.16.0.zip
ck init --kit-path ~/extracted-kit/
Flags:
--yes/-y: Non-interactive mode with sensible defaults (skip all prompts)--global/-g: Use platform-specific config (macOS/Linux: ~/.claude, Windows: %USERPROFILE%.claude)--fresh: Clean reinstall, removes .claude directory (requires "yes" confirmation)--beta: Show pre-release versions--prefix: Apply /ck: namespace to commands--archive <path>: Use local archive (zip/tar.gz) instead of downloading--kit-path <path>: Use local kit directory instead of downloadingDefault Behavior with -y Flag:
| Prompt | Default |
|---|---|
| Select ClaudeKit | engineer (first option) |
| Target directory | Current directory (.) |
| Version selection | Latest stable release |
| Google Gemini setup | Skip |
| Other optional features | Skip |
Keep the ClaudeKit CLI up to date:
# Check for CLI updates
ck update --check
# Update to latest version
ck update
# Update to specific version
ck update --version 1.17.0
# Update to beta / skip confirmation
ck update --beta
ck update --yes
The CLI notifies you when updates are available via ck --version.
Skills Migration:
# Show all available versions for all kits
ck versions
# Filter by specific kit
ck versions --kit engineer
ck versions --kit marketing
# Show more versions (default: 30)
ck versions --limit 50
# Include prereleases and drafts
ck versions --all
# Full health check (default)
ck doctor
# Verbose mode with execution timing and command details
ck doctor --verbose
# Generate shareable diagnostic report (prompts for gist upload)
ck doctor --report
# Auto-fix all fixable issues
ck doctor --fix
# CI mode: no prompts, exit 1 on failures
ck doctor --check-only
# Machine-readable JSON output
ck doctor --json
# Combine flags
ck doctor --verbose --check-only --json
ck doctor --verbose --fix
Health Checks:
Auto-Fix Capabilities:
| Issue | Fix Action |
|---|---|
| Missing dependencies | Install via package manager |
| Missing gh auth | Run gh auth login |
| Corrupted node_modules | Reinstall dependencies |
| Missing global install | Run ck init --global |
| Missing skill deps | Install in skill directory |
Exit Codes:
0: All checks pass or issues fixed1: Failures detected (only with --check-only)Note:
ck diagnoseis deprecated. Useck doctorinstead.
Remove ClaudeKit installations from your system:
ck uninstall # Interactive mode - prompts for scope and confirmation
ck uninstall --local # Uninstall only local installation (current project)
ck uninstall --global # Uninstall only global installation (~/.claude/)
ck uninstall -l -y # Local only, skip confirmation
ck uninstall -g -y # Global only, skip confirmation
ck uninstall --yes # Non-interactive - skip confirmation (for scripts)
Scope Selection:
.claude/)~/.claude/)--local or --global flags to skip the promptWhat it does:
.claude directory in current project~/.claude ClaudeKit installation--yes flag)commands/, agents/, skills/, workflows/, hooks/, metadata.json)settings.json, settings.local.json, and CLAUDE.mdNote: Only removes valid ClaudeKit installations (with metadata.json). Regular .claude directories from Claude Desktop are not affected.
ck watch)Autonomous daemon that monitors GitHub issues, analyzes them with Claude, generates plans, and creates PRs.
# Start watching (single repo)
ck watch
# Dry-run mode (no posts/PRs)
ck watch --dry-run
# Custom poll interval (ms)
ck watch --interval 60000
# Force restart (clear state)
ck watch --force
# Verbose logging
ck watch --verbose
Features: issue lifecycle management (10 statuses), Claude-powered brainstorming/planning, automatic PR creation, rate limiting (persisted across restarts), maintainer reply filtering, processedIssues TTL, optional git worktree isolation per issue, multi-repo support, graceful shutdown.
Config: .ck.json under watch key. See docs/ck-watch.md for full configuration reference.
ck content)Daemon that scans git activity (commits, PRs, tags), generates social media content with Claude, and publishes to X/Twitter and Facebook.
# Interactive setup wizard
ck content setup
# Start daemon
ck content start
# Check status
ck content status
# View logs
ck content logs
# Queue manual content
ck content queue
# Review workflow
ck content approve <id>
ck content reject <id>
# Dry-run / verbose
ck content start --dry-run
ck content start --verbose
Features: 11-phase pipeline (scan → filter → classify → context → create → validate → review → photo → publish → engage → analyze), noise filtering, context caching (24h TTL), content validation, photo generation, 3 review modes (auto/manual/hybrid), quiet hours scheduling, engagement tracking, SQLite database, platform-specific adapters.
Config: .ck.json under content key. See docs/ck-content.md for full configuration reference.
# Show CLI version (shows local + global kit versions)
ck --version
# Show help
ck --help
ck -h
# Command-specific help
ck new --help
ck init --help
ck config --help
ck skills --help
ck versions --help
ck new --verbose # Enable verbose logging
ck new --verbose --log-file debug.log # Save to file
CLAUDEKIT_VERBOSE=1 ck new # Via environment variable
Release data is cached locally to improve performance. You can configure the cache TTL:
# Set custom cache TTL (in seconds, default: 3600 = 1 hour)
CK_CACHE_TTL=7200 ck versions # Cache for 2 hours
CK_CACHE_TTL=0 ck versions # Disable caching (always fetch fresh)
# Permanent configuration (add to ~/.bashrc or ~/.zshrc)
export CK_CACHE_TTL=1800 # 30 minutes
Cache Location: ~/.claudekit/cache/releases/
The ck --version command checks for newer versions of your installed ClaudeKit and displays a notification if an update is available. The check is cached for 7 days to minimize API calls.
Disable Update Notifications:
# Set environment variable to disable
NO_UPDATE_NOTIFIER=1 ck --version
# Windows (permanent)
[System.Environment]::SetEnvironmentVariable("NO_UPDATE_NOTIFIER", "1", [System.EnvironmentVariableTarget]::User)
# macOS/Linux (add to ~/.bashrc or ~/.zshrc)
export NO_UPDATE_NOTIFIER=1
Cache Location: ~/.claudekit/cache/version-check.json (Windows: %USERPROFILE%\.claudekit\cache\)
The CLI requires GitHub authentication to download releases from private repositories.
┌─────────────────────────────────────────────────┐
│ Multi-Tier Authentication │
│ │
│ 1. GitHub CLI (gh auth token) │
│ ↓ (if not available) │
│ 2. Environment Variables (GITHUB_TOKEN) │
│ ↓ (if not set) │
│ 3. Config File (~/.claudekit/config.json) │
│ ↓ (if not found) │
│ 4. OS Keychain (secure storage) │
│ ↓ (if not stored) │
│ 5. User Prompt (with save option) │
└─────────────────────────────────────────────────┘
Step 1: Install GitHub CLI
# Windows
winget install GitHub.cli
# macOS
brew install gh
# Linux
sudo apt install gh
Step 2: Authenticate with GitHub CLI
gh auth login
When prompted, follow these steps:
⚠️ Important: Select "Login with a web browser" - do NOT use "Paste an authentication token" as PAT authentication is no longer supported for accessing private repositories.
Run the doctor command to diagnose issues:
# Interactive diagnostics
ck doctor
# Generate report for support
ck doctor --report
# CI/automation
ck doctor --check-only --json
# Verbose logging
ck new --verbose
ck init --verbose
Common Issues:
ck doctor to check auth, use --fix to auto-repairck doctor --fix to re-authenticate, or manually run gh auth login (select 'Login with a web browser')gh auth login and select 'Login with a web browser' (NOT 'Paste token')ck doctor --fix to reinstall skill dependenciesck doctor --report and share the gist URLClaudeKit offers premium starter kits available for purchase at ClaudeKit.cc:
Each kit provides a comprehensive project template with best practices, tooling, and workflows optimized for Claude Code development.
Configuration is stored in ~/.claudekit/config.json:
{
"github": {
"token": "stored_in_keychain"
},
"defaults": {
"kit": "engineer",
"dir": "."
}
}
The following file patterns are protected and will not be overwritten during updates:
.env, .env.local, .env.*.local*.key, *.pem, *.p12node_modules/**, .git/**dist/**, build/**Use --exclude flag with glob patterns to skip files:
ck new --exclude "*.log" --exclude "temp/**"
ck update --exclude "node_modules/**" --exclude "dist/**"
Patterns: * (any chars), ** (recursive), ? (single char), [abc], {a,b}
Restrictions: No absolute paths, no path traversal (..), 1-500 chars
Note: User patterns are ADDED to default protected patterns
Custom File Preservation:
The CLI automatically preserves your custom .claude/ files during updates:
.claude/ directorySkills Directory Migration: Automatic migration when structure changes (flat → categorized):
Example Migration:
Before (flat):
.claude/skills/
├── gemini-vision/
├── postgresql-psql/
└── cloudflare-dns/
After (categorized):
.claude/skills/
├── ai-multimodal/
│ └── gemini-vision/
├── databases/
│ └── postgresql-psql/
└── devops/
└── cloudflare-dns/
Customizations in any skill are detected and preserved automatically.
See Development Guide for:
bun run build, bun run compile)Architecture Highlights:
Quick Start:
bun install
bun run dev new --kit engineer
bun test
# Optional: run expensive CLI integration tests explicitly
bun run test:integration
Q: Do I need GitHub CLI? A: Yes, GitHub CLI is required. ClaudeKit uses it exclusively for authentication with private repositories.
Q: How do I authenticate?
A: Run gh auth login, select 'Login with a web browser', complete OAuth in browser. Do NOT use 'Paste an authentication token'.
Q: "Access denied" error?
A: Accept GitHub repo invitation, re-run gh auth login with web browser login, wait 2-5min for permissions.
Q: "GitHub CLI not authenticated" error?
A: Run gh auth login and select 'Login with a web browser' (NOT 'Paste token'). PAT authentication is no longer supported.
Q: Is my token secure? A: Yes. GitHub CLI manages tokens securely via OAuth, stored encrypted in OS keychain.
MIT
FAQs
CLI tool for bootstrapping and updating ClaudeKit projects
The npm package claudekit-cli receives a total of 7,367 weekly downloads. As such, claudekit-cli popularity was classified as popular.
We found that claudekit-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.