
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
skill-manager
Advanced tools
CLI tool for managing Claude Code skills via directory symlinks.
pnpm install -g skill-manager
Or from source:
cd packages/skill-manager
pnpm install
pnpm build
pnpm link --global
You can add either local directories or GitHub URLs:
# Local directory
skm source add ~/my-skills-repo
skm source add /path/to/another/skills-repo
# GitHub URL (HTTPS)
skm source add https://github.com/user/skills.git
# GitHub URL (SSH - automatically converted to HTTPS)
skm source add git@github.com:user/skills.git
When you add a GitHub URL, skill-manager will:
skm source ls
skm list
# or
skm ls
cd /path/to/your/project
skm add
This will:
./.claude/skills/ for selected skillsskm search debugging
skm remove
# or
skm rm
skm config
Your source directories should contain any of these supported skill directories:
Universal Skills (skills/) - Available for all platforms
my-skills-repo/
└── skills/
├── skill-one/
│ └── skill.md
├── skill-two/
│ └── skill.md
└── another-skill/
└── skill.md
Platform-Specific Skills
my-skills-repo/
├── .claude/skills/ # Only for Claude
│ ├── claude-skill-one/
│ └── claude-skill-two/
├── .opencode/skills/ # Only for OpenCode
│ ├── opencode-skill-one/
│ └── opencode-skill-two/
└── .openclaw/skills/ # Only for OpenClaw
├── openclaw-skill-one/
└── openclaw-skill-two/
Directory name = Skill name. When you add a skill, the entire directory is symlinked to your project.
Skill Types:
skills/) - Available for all platforms (Claude, OpenCode, OpenClaw).claude/skills/, .opencode/skills/, .openclaw/skills/) - Only available for the corresponding platformConfiguration is stored in .skmrc.json (project root or home directory).
Example configuration:
{
"sources": [
"~/my-skills-repo",
"/path/to/team-skills",
"./local-skills"
]
}
skm addInteractively select and add skills to current project's .claude/skills/ directory.
skm list (alias: ls)Display all discoverable skills from configured sources, grouped by source.
skm remove (alias: rm)Select and remove skills from current project's .claude/skills/ directory.
skm search <keyword>Search skills by name across all configured sources.
skm configDisplay current configuration (sources list).
skm source add [path]Add a source directory or GitHub URL. If path is not provided, prompts for input.
Supported formats:
~/my-skills or /path/to/skillshttps://github.com/user/skills.gitgit@github.com:user/skills.git (automatically converted to HTTPS)skm source list (alias: ls)List all configured source directories with validation status.
skm source remove (alias: rm)Interactively remove a source directory from configuration.
skm source add (supports local paths and GitHub URLs)skills/, .claude/skills/, .opencode/skills/, and .openclaw/skills/ subdirectoriesskills/) work on all platforms, platform-specific skills only on their respective platforms.claude/skills/ with symlinks to selected skills# One-time setup: add your skills repository
skm source add ~/my-skills-library
# In any project
cd ~/my-project
skm add # Select skills to add
# Work with skills in .claude/skills/
# Later, remove unused skills
skm remove # Select skills to remove
# Add more sources anytime
skm source add /team/shared-skills
skm list # See all available skills
On Windows, creating symlinks requires either:
If symlink creation fails, skm will automatically fall back to copying directories (using junction points for better compatibility).
MIT
FAQs
CLI tool for managing Claude Code skills via symlinks
The npm package skill-manager receives a total of 17 weekly downloads. As such, skill-manager popularity was classified as not popular.
We found that skill-manager demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.