
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
growthly-skills-cli
Advanced tools
A command-line tool to manage AI agent skills for Claude Code, Gemini CLI, and other AI assistants.
add commandnpm install -g growthly-skills-cli
Or use without installing:
npx growthly-skills-cli init
cd your-project
skillsync init
cd existing-project-with-agents
skillsync init # Automatically detects and merges
init - Initialize Workspaceskillsync init [options]
Options:
-f, --force - Overwrite existing setup (destructive)-m, --merge - Explicitly enable merge mode (non-destructive)What it creates:
your-project/
├── .growthly-sync/
│ └── skills/ # Skills source
│ ├── meta/
│ │ ├── skill-creator/
│ └── workflow/
│ └── project-planner/
├── .claude/
│ └── skills/ # Claude Code symlinks
├── .gemini/
│ └── skills/ # Gemini CLI symlinks
├── .codex/
│ └── skills/ # Codex (OpenAI) symlinks
├── AGENTS.md # Main documentation
├── CLAUDE.md # Claude-specific copy
└── GEMINI.md # Gemini-specific copy
add - Add Skills to Projectskillsync add [options]
Options:
-d, --department <department> - Target specific department (meta, workflow, etc.)-a, --all - Install all available skills without promptsInteractive Mode (no flags):
skillsync add
list - List Installed Skillsskillsync list
Displays all currently installed skills grouped by department.
remove - Remove Skillsskillsync remove [options]
Options:
-a, --all - Remove ALL installed skills (prompts for confirmation unless --yes is used)-y, --yes - Skip confirmation promptsInteractive Mode (no flags): Allows you to select specific skills to remove from a checklist.
purge - Uninstall CLI Setupskillsync purge [options]
Options:
-y, --yes - Skip confirmation promptsWhat it does:
.growthly-sync/ directory.claude/, .gemini/, etc.AGENTS.md (preserves your custom content)sync - Sync Skills and Documentationskillsync sync [options]
Options:
-d, --dry-run - Preview changes without modifying files-s, --scope <scope> - Sync specific scope (root, ui, api, sdk, mcp_server)What it does:
.claude/, .gemini/, .codex/The CLI automatically detects existing setups and uses merge mode to integrate without destroying your content.
HTML Markers: The CLI uses HTML comments to mark sections it manages:
# Your Custom Content (preserved)
<!-- growthly-skills-cli:available-skills:start -->
## Available Skills
[CLI manages this section]
<!-- growthly-skills-cli:available-skills:end -->
<!-- growthly-skills-cli:auto-invoke:start -->
### Auto-invoke Skills
[CLI manages this section]
<!-- growthly-skills-cli:auto-invoke:end -->
# More Custom Content (preserved)
What's Preserved:
.growthly-sync/skills/What's Updated:
.growthly-sync/skills/.growthly-sync/skills/your-department/your-skill/SKILL.md file with frontmatter:---
name: your-skill
description: What your skill does
metadata:
author: your-name
version: "1.0"
scope: [root]
auto_invoke:
- "When to trigger this skill"
---
## Your skill content
skillsync sync
Your skill will automatically appear in AGENTS.md and be symlinked to all AI assistant folders!
Enable detailed logging:
DEBUG=1 skillsync init
DEBUG=1 skillsync sync
Contributions are welcome! Please feel free to submit a Pull Request.
Apache-2.0
growthly-skills-cli
Need help? Check the documentation or open an issue on GitHub.
FAQs
CLI for Growthly Skills
We found that growthly-skills-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.