
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.
Tools for working with Agent Skills (SKILL.md) from the SkillMD registry. One package, two binaries:
skillmd — a CLI to lint, scan, search, install, and publish skills.skillmds — an MCP server exposing the registry to MCP clients (Claude Code, Claude Desktop, Cursor, …).Both validate SKILL.md with the same engine (@skillmds/core), so the CLI and the registry apply identical rules. Source lives at github.com/skillmds/skillmd.
npm i -g skillmds
This installs both the skillmd and skillmds commands. To run the CLI without installing:
npx skillmds lint .
npx skillmds <command> runs the CLI; npx skillmds with no command starts the MCP server.
skillmd| Command | Description |
|---|---|
skillmd lint [path] (check) | Validate SKILL.md files; print diagnostics and a quality score. |
skillmd scan [path] | Report scripts, network calls, and secret access. |
skillmd rules [id] | List lint rules, or show one. |
skillmd init [name] | Create a SKILL.md from a template. |
skillmd search <query> | Search the registry. |
skillmd add <source> | Install a skill (registry slug, GitHub repo, or local path). Lints before writing. |
skillmd list (ls) | List installed skills. |
skillmd remove <names...> (rm) | Remove installed skills. |
skillmd update [names...] | Update installed skills from the registry. |
skillmd publish [path] (submit) | Publish to the registry. Exits non-zero on lint errors. |
skillmd login / logout | Store or remove a token. |
All commands accept --json.
skillmd lint ./my-skill
skillmd lint . --format sarif > skillmd.sarif
skillmd lint . --strict
skillmd lint . --fix
Formats: text (default), json, sarif (GitHub Code Scanning), github (Actions annotations).
Exit codes: 0 clean, 1 errors (or warnings with --strict / --fail-on-warning), 2 usage error.
skillmd add anthropic/pdf # registry slug
skillmd add owner/repo # GitHub repo
skillmd add ./path # local
skillmd add anthropic/pdf -a claude-code -g
skillmd add some/skill --deny executes_scripts
skillmd add some/skill --skip-lint
skillmd login # store a token from your skillmd.com account
skillmd publish ./my-skill # blocked on lint errors
skillmd publish ./my-skill --dry-run
skillmd publish ./my-skill --force # publish despite warnings; never bypasses errors
skillmdsClaude Code:
claude mcp add skillmd -- npx -y skillmds
Other MCP clients:
{
"mcpServers": {
"skillmd": { "command": "npx", "args": ["-y", "skillmds"] }
}
}
Tools: skillmd_search, skillmd_get, skillmd_install, skillmd_trending, skillmd_recommend, skillmd_list_saved, skillmd_lint. skillmd_install writes a skill's SKILL.md and never executes scripts.
SkillMD also hosts a remote MCP server over streamable HTTP — point any client that supports remote servers at:
https://api.skillmd.com/mcp
No auth required. It exposes skillmd_search, skillmd_get, skillmd_download, skillmd_trending, and skillmd_recommend (skillmd_download returns file contents for the client to write, instead of writing to disk).
The registry behind these tools is skillmd.com: 25,000+ Agent Skills, each linted, security-scanned and content-pinned.
Resolution order, highest first:
| Setting | Sources |
|---|---|
| Token | --token → SKILLMD_TOKEN → ~/.skillmd/config.json |
| API base | --api → SKILLMD_API → default registry |
SKILLMD_TOKEN enables skillmd_list_saved, personalized recommendations, and publishing.
FAQs
SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.
The npm package skillmds receives a total of 999 weekly downloads. As such, skillmds popularity was classified as not popular.
We found that skillmds demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.