
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
simba-skills
Advanced tools
AI skills manager - central store with symlink-based distribution across 15+ coding agents
AI skills manager with a central store and symlink-based distribution across 17+ coding agents.
Most skill installers are one-shot: they clone a repo and copy files. Simba is a skill lifecycle manager:
~/.config/simba/skills/# Requires Bun runtime
bunx simba-skills detect
Or install globally:
bun install -g simba-skills
# Detect installed agents
simba detect
# Adopt existing skills into the central store
simba adopt
# Install skills from GitHub
simba install vercel-labs/agent-skills
# Assign skills to specific agents
simba assign my-skill claude,cursor
# Check for updates (uses tracked install sources)
simba update
# View skill matrix across all agents
simba status
# Install from GitHub (HTTPS)
simba install user/repo
# Install from private repos (SSH)
simba install user/repo --ssh
# Install from local path (creates symlinks, auto-syncs)
simba install ~/my-skills
# Update all installed skills from their sources
simba update
Simba records the source repository and path during installation, enabling simba update to fetch and compare changes with diffs.
# Assign skill to multiple agents
simba assign my-skill claude,cursor,copilot
# Interactive TUI for bulk management
simba manage
# Remove skill from agents
simba unassign my-skill claude
# Check symlink integrity
simba doctor
# Auto-repair broken symlinks
simba doctor --fix
# Backup all skills
simba backup ./skills.tar.gz --includeConfig
# Restore from backup
simba restore ./skills.tar.gz
# Undo last operation
simba undo
Supports Claude Code, Codex, OpenCode, Cursor, Gemini CLI, GitHub Copilot, Amp, Kimi Code CLI, Replit, and 30+ others.
Includes agents using the .agents/skills universal standard, plus agent-specific paths.
See full agent definitions and paths in src/core/config-store.ts.
~/.config/simba/
├── config.toml # Settings
├── registry.json # Skill metadata, sources & assignments
├── skills/ # Central store
│ └── my-skill/
│ └── SKILL.md
└── snapshots/ # Automatic rollback points
~/.claude/skills/
└── my-skill → ~/.config/simba/skills/my-skill (symlink)
~/.cursor/skills/
└── my-skill → ~/.config/simba/skills/my-skill (symlink)
| Command | Description |
|---|---|
detect | Scan for installed agents |
adopt | Move existing skills into central store |
install | Install from GitHub or local path |
uninstall | Remove skill from store and agents |
update | Check and apply updates from sources |
list | List managed skills |
status | Skill matrix across agents |
assign | Symlink skill to agents |
unassign | Remove skill from agents |
manage | Interactive TUI |
sync | Union merge across agents |
migrate | Copy all skills from one agent to another |
doctor | Verify and repair symlinks |
backup | Export skills to archive |
restore | Restore from backup |
snapshots | List rollback points |
undo | Restore from last snapshot |
import | Copy global skill to project for customization |
Config at ~/.config/simba/config.toml:
[snapshots]
maxCount = 10
autoSnapshot = true
[sync]
strategy = "union" # or "source"
sourceAgent = "" # for source strategy
MIT
FAQs
AI skills manager - central store with symlink-based distribution across 15+ coding agents
We found that simba-skills demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.