
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
CLI, TypeScript SDK, and MCP Server for SkillDB — discover, install, and manage AI agent skills.
5,000+ expert skills across 327 packs for Claude Code, Cursor, Windsurf, and any MCP-compatible AI tool.
Connect SkillDB directly to your AI coding tool via the Model Context Protocol:
# Step 1: Install globally (one time)
npm install -g skilldb
# Step 2: Get your free API key at https://skilldb.dev/api-access
# Step 3: Add to Claude Code (with API key for full content)
claude mcp add skilldb -- skilldb-mcp --api-key sk_live_YOUR_KEY
⚠️ Without an API key, you can search and browse skills (metadata only). With a free API key, you get full skill content — the actual markdown instructions your agent uses. Get your key in 30 seconds at skilldb.dev/api-access.
Cursor — add to .cursor/mcp.json:
{
"mcpServers": {
"skilldb": {
"command": "skilldb-mcp"
}
}
}
Windsurf — add to mcp_config.json:
{
"mcpServers": {
"skilldb": {
"command": "skilldb-mcp",
"args": ["--api-key", "sk_live_xxx"]
}
}
}
Once connected, your AI assistant can search and load skills natively. Just ask:
5 tools exposed: skilldb_search, skilldb_get, skilldb_list, skilldb_suggest, skilldb_recommend
# Search for skills (with inline preview)
npx skilldb search "code review"
# Install a skill pack
npx skilldb add software-skills
# Activate a smart profile (only loads what you need)
npx skilldb use frontend
# Or auto-detect from your project
npx skilldb use auto
npm install -g skilldb
Or use npx skilldb without installing.
Loading 500 skills into your agent's context is worse than loading the right 5. SkillDB uses a 3-layer architecture to manage this:
.skilldb/
├── skills/ ← Full cache (everything downloaded)
├── active/ ← Active profile (what your agent sees — 5-15 focused skills)
├── slim/ ← Compressed cheat sheets (10x smaller)
├── config.json ← Profile + budget settings
└── manifest.json ← What's installed
Your CLAUDE.md or .cursorrules points at .skilldb/active/, not the full cache. The agent gets focused, relevant skills — not noise.
skilldb initDetect your IDE (Claude Code, Cursor, Codex CLI, OpenClaw), create .skilldb/, and add integration config.
skilldb init
skilldb search <query>Search skills by keyword. Shows inline slim preview so you know what you're getting before downloading.
skilldb search "debugging"
skilldb search "api design" --category "Technology & Engineering"
skilldb search "testing" --limit 10
skilldb add <pack>Download a skill pack to local cache. Idempotent — skips already-cached skills.
skilldb add software-skills
skilldb add autonomous-agent-skills
skilldb add vibe-coding-security-skills
skilldb get <id>Download a single skill.
skilldb get software-skills/code-review
skilldb info <id>Show metadata, slim summary, and full preview for a skill.
skilldb info software-skills/code-review
skilldb listList available categories, packs, and skills.
skilldb list
skilldb list --category "Autonomous Agents"
skilldb list --pack software-skills
skilldb loginSave your API key for authenticated access.
skilldb login
skilldb use <profile>Activate a focused profile — only loads relevant skills into .skilldb/active/.
skilldb use frontend # React, testing, web-polish, accessibility
skilldb use backend # API design, databases, security, performance
skilldb use devops # Kubernetes, Docker, CI/CD, monitoring
skilldb use security # Trust audit, input validation, credentials
skilldb use data # SQL, pipelines, analytics, visualization
skilldb use fullstack # Frontend + backend combined
skilldb use ai-agent # Autonomous agent meta-skills
skilldb use auto # Auto-detect from your project files
skilldb use --list # Show available profiles
skilldb use --current # Show active profile
skilldb use none # Deactivate (clear active/)
auto mode scans your package.json, file extensions, and imports to recommend the right profile.
skilldb budgetSet a maximum context budget so your agent doesn't get overloaded.
skilldb budget # Show current usage
skilldb budget set 5000 # Max 5,000 lines
skilldb budget set 50k # Max 50,000 tokens
skilldb budget optimize # Re-rank and trim active skills to fit
skilldb slimGenerate compressed cheat-sheet versions of skills (~30 lines instead of 300).
skilldb slim # Slim all active skills
skilldb slim software-skills # Slim a specific pack
skilldb slim --ratio 0.3 # Keep 30% of content
skilldb updateCheck for newer versions of installed skills and update them.
skilldb update # Update everything
skilldb update software-skills # Update one pack
skilldb removeUninstall skills from local cache.
skilldb remove software-skills/code-review # Remove single skill
skilldb remove software-skills # Remove entire pack
skilldb remove --unused # Remove skills not in active profile
skilldb doctorHealth check and audit of your skill setup.
skilldb doctor
Shows: outdated skills, unused skills, missing dependencies, budget status, coverage gaps.
skilldb statsLocal statistics dashboard.
skilldb stats
Shows: installed count, total lines, tokens, active profile, categories covered.
skilldb diff <id>Compare your local (possibly customized) version with the latest remote.
skilldb diff software-skills/code-review
skilldb diff # Diff all installed
skilldb exportExport your setup for sharing or IDE integration.
skilldb export claude # CLAUDE.md snippet with skill references
skilldb export cursor # .cursorrules block
skilldb export profile # Shareable .skilldb-profile.json
skilldb export inject <id> # Print skill to stdout (for piping)
skilldb recommendScan your project and get personalized skill recommendations.
skilldb recommend # Analyze project and suggest
skilldb recommend --install # Auto-install recommendations
import { createClient } from 'skilldb';
const db = createClient(); // auto-loads key from env/config
// Search with slim previews
const results = await db.search('code review');
for (const skill of results.skills) {
console.log(skill.title);
console.log(skill.slim); // Quick summary
}
// Get full skill content
const skill = await db.get('software-skills/code-review.md');
console.log(skill.content);
// List with filters
const listing = await db.list({ category: 'Autonomous Agents', limit: 10 });
The SDK and CLI resolve your API key in order:
SKILLDB_API_KEY environment variable (CI-friendly).skilldbrc in project root (project-specific)~/.skilldbrc in home directory (user-wide)Browsing and searching works without authentication. Full skill content requires a Pro or Studio key.
Built-in profiles map to curated skill sets:
| Profile | Skills loaded | Best for |
|---|---|---|
frontend | react-patterns, web-polish, testing, accessibility | React/Vue/Angular apps |
backend | api-design, databases, security, performance | Node/Python/Go services |
devops | kubernetes, docker, ci-cd, monitoring, cloud | Infrastructure & deployment |
security | trust-audit, input-validation, credentials, hardening | Security review & hardening |
data | sql, pipelines, analytics, visualization | Data engineering & analysis |
fullstack | frontend + backend combined | Full-stack applications |
ai-agent | autonomous-agent-skills, task-decomposition, planning | Building AI agents |
auto | Detected from project | Any project |
MIT
FAQs
SDK and CLI for SkillDB — discover, install, and manage AI agent skills
The npm package skilldb receives a total of 35 weekly downloads. As such, skilldb popularity was classified as not popular.
We found that skilldb demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.