You're Invited:Meet the Socket Team at RSAC and BSidesSF 2026, March 23–26.RSVP
Socket
Book a DemoSign in
Socket

skilld

Package Overview
Dependencies
Maintainers
1
Versions
58
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

skilld

Generate AI agent skills from npm package documentation

Source
npmnpm
Version
1.0.0
Version published
Weekly downloads
780
55.38%
Maintainers
1
Weekly downloads
 
Created
Source

skilld

npm version npm downloads license

Generate AI agent skills from your NPM dependencies.

Why?

When using new packages or migrating to new versions, agents often struggle to use the appropriate best practices. This is because agents have knowledge cutoffs and predict based on existing patterns.

Methods of getting the right context to your agent require either manual curation, author opt-in, external servers or vendor lock-in. See the landscape for more details.

Skilld generates agent skills from the references maintainers already create: docs, release notes and GitHub issues. With these we can create version-aware, local-first, and optimized skills.

Made possible by my Sponsor Program 💖
Follow me @harlan_zw 🐦 • Join Discord for help

Features

  • 🌍 Any Source: Opt-in - Any NPM dependency or GitHub source, docs auto-resolved
  • 📦 Bleeding Edge Context - Latest issues, discussions, and releases . Always use the latest best practices and avoid deprecated patterns.
  • 📚 Opt-in LLM Sections - Enhance skills with LLM-generated Best Practices, API Changes, or your own custom prompts
  • 🔍 Semantic Search - Query indexed docs across all skills via retriv embeddings
  • 🧠 Context-Aware - Follows Claude Code skill best practices: SKILL.md stays under 500 lines, references are separate files the agent discovers on-demand — not inlined into context
  • 🎯 Safe & Versioned - Prompt injection sanitization, version-aware caching, auto-updates on new releases
  • 🤝 Ecosystem - Compatible with npx skills and skills-npm

Quick Start

Run skilld in a project to generate skills for your dependencies through a simple interactive wizard:

npx -y skilld

Requires Node 22.6.0 or higher.

Or add a specific package directly:

npx -y skilld add vue

If you need to re-configure skilld, just run npx -y skilld config to update your agent, model, or preferences.

Tips

  • Be selective - Only add skills for packages your agent struggles with. Not every dependency needs one.
  • LLM is optional - Skills work without any LLM, but enhancing with one makes them significantly better.
  • Multi-agent - Run skilld install --agent gemini-cli to sync skills to another agent. The doc cache is shared.

Installation

Global

Install globally to use skilld across all projects without npx:

npm install -g skilld
# or
pnpm add -g skilld

Then run skilld in any project directory.

Per-Project

If you'd like to install skilld and track the lock file references, add it as a dev dependency:

npm install -D skilld
# or
yarn add -D skilld
# or
pnpm add -D skilld

Automatic Updates

Add to package.json to keep skills fresh on install:

{
  "scripts": {
    "prepare": "skilld update -b"
  }
}

FAQ

Why don't the skills run?

Try this in your project/user prompt:

Before modifying code, evaluate each installed skill against the current task.
For each skill, determine YES/NO relevance and invoke all YES skills before proceeding.

How is this different from Context7?

Context7 is an MCP that fetches raw doc chunks at query time. You get different results each prompt, no curation, and it requires their server. Skilld is local-first: it generates a SKILL.md that lives in your project, tied to your actual package versions. No MCP dependency, no per-prompt latency, and it goes further with LLM-enhanced sections, prompt injection sanitization, and semantic search.

Will I be prompt injected?

Skilld pulls issues from GitHub which could be abused for potential prompt injection.

Skilld treats all data as untrusted, running in permissioned environments and using best practices to avoid injections. However, always be cautious when using skills from untrusted sources.

Do skills update when my deps update?

Yes. Run skilld update to regenerate outdated skills, or add skilld update -b to your prepare script and they regenerate in the background whenever you install packages.

CLI Usage

# Interactive mode - auto-discover from package.json
skilld

# Add skills for specific package(s)
skilld add vue nuxt pinia

# Update outdated skills
skilld update
skilld update tailwindcss

# Search docs across installed skills
skilld search "useFetch options" -p nuxt

# Target a specific agent
skilld add react --agent cursor

# Install globally to ~/.claude/skills
skilld add zod --global

# Skip prompts
skilld add drizzle-orm --yes

# Check skill info
skilld info

# List installed skills
skilld list
skilld list --json

# Manage settings
skilld config

Commands

CommandDescription
skilldInteractive wizard (first run) or status menu (existing skills)
skilld add <pkg...>Add skills for package(s), space or comma-separated
skilld update [pkg]Update outdated skills (all or specific)
skilld search <query>Search indexed docs (-p to filter by package)
skilld listList installed skills (--json for machine-readable output)
skilld infoShow skill info and config
skilld configConfigure agent, model, preferences
skilld installRestore references from lockfile
skilld removeRemove installed skills
skilld uninstallRemove all skilld data
skilld cacheCache management (clean expired LLM cache entries)
skilld eject <pkg>Eject skill as portable directory (no symlinks)

Eject

Export a skill as a portable, self-contained directory with references copied as real files instead of symlinks. Useful for sharing skills via git repos.

# Eject to the default skill directory
skilld eject vue

# Custom skill directory name
skilld eject vue --name vue

# Eject to a custom path
skilld eject vue --out ./skills/vue/

# Only collect releases/issues/discussions since a date
skilld eject vue --from 2025-07-01

The ejected skill contains SKILL.md plus a references/ directory with docs, issues, and releases as real files. Share it via skilld add owner/repo — consumers get fully functional skills with no LLM cost.

CLI Options

OptionAliasDefaultDescription
--global-gfalseInstall globally to ~/<agent>/skills
--agent-aauto-detectTarget specific agent (claude-code, cursor, etc.)
--yes-yfalseSkip prompts, use defaults
--force-ffalseIgnore all caches, re-fetch docs and regenerate
--model-mconfig defaultLLM model for skill generation (sonnet, haiku, opus, etc.)
--name-nCustom skill directory name (eject only)
--out-oOutput directory path override (eject only)
--fromCollect releases/issues/discussions from this date (YYYY-MM-DD, eject only)
--debugfalseSave raw LLM output to logs/ for each section

The Landscape

Several approaches exist for steering agent knowledge. Each fills a different niche:

ApproachVersionedCuratedNo Opt-inLocal
Manual rules
llms.txt~
MCP servers
skills.sh~
skills-npm
skilld

Versioned — tied to your installed package version. Curated — distilled best practices, not raw docs. No Opt-in — works without the package author doing anything. Local — runs on your machine, no external service dependency.

  • Manual rules (CLAUDE.md, .cursorrules): full control, but you need to already know the best practices and maintain them across every dep.
  • llms.txt: standard convention for exposing docs to LLMs, but it's full docs not curated guidance and requires author adoption.
  • MCP servers: live, version-aware responses, but adds per-request latency and the maintainer has to build and maintain a server.
  • skills.sh: easy skill sharing with a growing ecosystem, but community-sourced without version-awareness or author oversight.
  • skills-npm: the ideal end-state: zero-token skills shipped by the package author, but requires every maintainer to opt in.
  • skilld: generates version-aware skills from existing docs, changelogs, issues, and discussions. Works for any package without author opt-in.

Telemetry

Skilld sends anonymous install events to skills.sh so skills can be discovered and ranked. No personal information is collected.

Telemetry is automatically disabled in CI environments.

To opt out, set either environment variable:

DISABLE_TELEMETRY=1
DO_NOT_TRACK=1
  • skills-npm - Convention for shipping agent skills in npm packages
  • mdream - HTML to Markdown converter
  • retriv - Vector search with sqlite-vec

License

Licensed under the MIT license.

Keywords

ai

FAQs

Package last updated on 02 Mar 2026

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts