
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
A CLI for installing customizable Agent Skills from GitHub.
Agent Skills are instructions that AI coding assistants can follow to perform specific tasks. The taito CLI extends the standard Agent Skills format with support for customizable skills that adapt to your project's specific configuration during installation.
There are a few CLI tools for managing agent skills, such as Vercel's skills CLI and Agent Skills Manager. However, none of them support customizable skills. If you make a cool skill for your project, it probably has a few project-specific details that won't work for other projects which makes sharing it with other developers difficult. Each developer who adds your skill would need to manually edit the skill to make it work for their project.
Taito makes it easy to customize skills to your project's specific details, while maintaining installability with other CLIs that don't support customization. Simply write your skill, add the Taito skill from this repository (taito add danieldunderfelt/taito-cli), and ask your AI agent to make it customizable in the Taito format. Then anyone who adds your skill will be able to customize it to their project's specific details.
As for features, I can add pretty much anything the other CLI's support. If you have a feature request, please open an issue. Yes, that means they can also add customizable skills as well.
I really hope that they do.
Oh btw, "taito" is the Finnish word for "skill". In case you were wondering.
# Using npm
npm install -g taito-cli
# Or run directly with npx
npx taito-cli add owner/repo
The package includes standalone executables for macOS (Apple Silicon), Linux (x64/arm64), and Windows (x64). No runtime dependencies required.
The npm package uses a shell script launcher that works natively on macOS and Linux. On Windows, you have a few options:
Git Bash / WSL (Recommended): If you have Git for Windows installed, the shell launcher works automatically in Git Bash or through WSL.
Use the .cmd launcher: After installing, run the CLI using the included batch script:
node_modules\.bin\taito.cmd add owner/repo
Run the binary directly: The standalone Windows executable can be run without any launcher:
%APPDATA%\npm\node_modules\taito-cli\dist\taito-windows-x64.exe add owner/repo
Download the binary: Download taito-windows-x64.exe from the releases page and add it to your PATH.
# Install a skill from GitHub (auto-detects your agent)
taito add aikoa-platform/agent-skills
# Install a specific skill from a repo containing multiple skills
taito add aikoa-platform/agent-skills/react-localization
taito add aikoa-platform/agent-skills --agent cursor
# Install with preset configuration (non-interactive)
taito add aikoa-platform/agent-skills --config ./my-config.toml
# List installed skills
taito list
# Remove a skill
taito remove react-localization
taito automatically detects which AI coding assistant you're using and installs skills to the correct location. Supported agents:
.cursor/skills/).windsurf/skills/).claude/skills/)<workspace>/skills/) - uses ClawdHub workspace discovery.codex/skills/).opencode/skill/).github/skills/).github/skills/).gemini/skills/).agents/skills/).agents/skills/).trae/skills/).agent/skills/)If multiple agents are detected, you'll be prompted to choose which one to install for. You can also explicitly specify an agent with the --agent flag.
For standard (non-customizable) skills, taito works just like other skill installers: it downloads the skill from GitHub and copies it to the skills directory for your agent.
When a skill contains a .taito/ folder, it becomes customizable. During installation, taito will:
.taito/skill.config.toml configuration fileFor example, a localization skill might ask:
The resulting SKILL.md will contain instructions tailored to your project.
taito add <source>Install a skill from GitHub or a local path.
# From GitHub (auto-detects agent)
taito add owner/repo
taito add owner/repo@v1.0.0 # specific tag/branch
# Install a specific skill from a multi-skill repo
taito add owner/repo/path/to/skill
taito add owner/repo/path/to/skill@v1.0.0
# Install for specific agent (case-insensitive)
taito add owner/repo --agent cursor
taito add owner/repo --agent ClaudeCode
# From local path
taito add ./path/to/skill
# Options
taito add owner/repo --config ./answers.toml # preset config
taito add owner/repo --dry-run # preview without writing
taito add owner/repo --output ./custom/path # custom output directory
taito add owner/repo --ref main # specific git ref
taito add owner/repo --global # install globally (agent-dependent)
taito listList all installed skills across all detected agents.
taito list
Output:
Cursor (1 skill):
react-localization (customized)
Source: aikoa-platform/agent-skills
Installed: 1/21/2026
Directory: /path/to/.cursor/skills
Windsurf (1 skill):
code-review
Source: vercel-labs/agent-skills
Installed: 1/20/2026
Directory: /path/to/.windsurf/skills
taito remove <name>Remove an installed skill. If the skill is installed for multiple agents, you'll be prompted to choose which one to remove from.
taito remove react-localization
taito build [path]For skill authors: generate skill files from .taito/ templates using default values. This will allow the skill to be used with other CLIs that don't support customization.
# Build in current directory
taito build
# Build specific skill
taito build ./my-skill/
To make your skill customizable, add a .taito/ folder that mirrors your skill structure with EJS templates.
my-skill/
├── SKILL.md # Default output (for standard CLIs)
├── scripts/
│ └── helper.sh # Default script
└── .taito/ # Customization folder
├── skill.config.toml # Variable definitions
├── SKILL.md.ejs # Template for SKILL.md
└── scripts/
└── helper.sh.ejs # Template for script (optional)
Create .taito/skill.config.toml to define customizable variables:
[meta]
name = "my-skill"
version = "1.0.0"
# String variable
[variables.PROJECT_NAME]
type = "string"
prompt = "What is your project name?"
default = "my-app"
# Choice variable
[variables.FRAMEWORK]
type = "choice"
prompt = "Which framework are you using?"
default = "react"
[[variables.FRAMEWORK.options]]
value = "react"
label = "React"
[[variables.FRAMEWORK.options]]
value = "vue"
label = "Vue"
[[variables.FRAMEWORK.options]]
value = "svelte"
label = "Svelte"
# Boolean variable
[variables.USE_TYPESCRIPT]
type = "boolean"
prompt = "Are you using TypeScript?"
default = true
# Array variable
[variables.SUPPORTED_LANGUAGES]
type = "array"
prompt = "Which languages do you support? (comma-separated)"
default = ["en", "es"]
| Type | Prompt Style | Value |
|---|---|---|
string | Text input | string |
choice | Select menu | string |
boolean | Yes/No confirm | boolean |
array | Comma-separated text | string[] |
Variables can reference each other using ${VAR_NAME} syntax. This allows later questions to use answers from earlier questions in their prompts or default values:
[meta]
name = "my-skill"
[variables.PACKAGE_MANAGER]
type = "choice"
prompt = "Which package manager do you use?"
default = "npm"
[[variables.PACKAGE_MANAGER.options]]
value = "npm"
label = "npm"
[[variables.PACKAGE_MANAGER.options]]
value = "yarn"
label = "yarn"
[[variables.PACKAGE_MANAGER.options]]
value = "pnpm"
label = "pnpm"
[variables.LINT_COMMAND]
type = "string"
prompt = "What command runs your linter?"
default = "${PACKAGE_MANAGER} run lint"
[variables.TEST_COMMAND]
type = "string"
prompt = "What command runs your tests?"
default = "${PACKAGE_MANAGER} run test"
When the user selects pnpm as their package manager, the default for LINT_COMMAND will be shown as pnpm run lint.
Interpolation works in:
prompt - the question shown to the userdefault - the default value for string and choice variableslabel valuesTemplates use EJS syntax. Create .taito/SKILL.md.ejs:
---
name: my-skill
description: A skill for <%= PROJECT_NAME %>
---
# My Skill
This skill is configured for **<%= FRAMEWORK %>**.
<% if (USE_TYPESCRIPT) { %>
## TypeScript Configuration
Make sure your `tsconfig.json` includes...
<% } %>
## Supported Languages
<% SUPPORTED_LANGUAGES.forEach(lang => { %>
- <%= lang %>
<% }) %>
After editing templates, run taito build to regenerate the default SKILL.md:
taito build ./my-skill/
This ensures your skill remains compatible with other CLIs that don't support customization.
taito fully supports standard Agent Skills that don't have a .taito/ folder. It simply copies SKILL.md, scripts/, references/, and assets/ to the output directory.
Customizable skills are designed to be backwards compatible:
Other CLIs (like Vercel's skills CLI) will see only the root-level files (SKILL.md, scripts/, etc.) and install them normally. The .taito/ folder is (hopefully) ignored as a hidden directory.
taito checks for .taito/skill.config.toml. If present, it uses the templates for customization. If not, it behaves like a standard skill installer.
This means you can publish a single skill that works with any CLI—users with taito get customization, while users with other CLIs get sensible defaults.
For CI/CD or team-wide configurations, create a TOML file with preset values:
# team-config.toml
PROJECT_NAME = "acme-app"
FRAMEWORK = "react"
USE_TYPESCRIPT = true
SUPPORTED_LANGUAGES = ["en", "es", "fr", "de"]
Then install non-interactively:
taito add owner/repo --config ./team-config.toml
taito automatically detects which AI coding assistant is being used by checking for marker directories:
# Single agent detected - installs automatically
$ taito add owner/repo
✓ Detected agent: Cursor
✓ Installing to .cursor/skills/...
# Multiple agents detected - prompts for choice
$ taito add owner/repo
✓ Multiple agents detected: Cursor, Windsurf
? Which agent do you want to install the skill for?
> Cursor
Windsurf
# Force specific agent
$ taito add owner/repo --agent windsurf
✓ Installing to .windsurf/skills/...
The detection order prioritizes the most commonly used agents first. If you're using multiple agents in the same project and want skills installed for all of them, run the command multiple times with different --agent flags.
For private GitHub repositories, set the GITHUB_TOKEN environment variable:
export GITHUB_TOKEN=ghp_xxxxxxxxxxxx
taito add private-org/private-skill
By default, skills are installed to the appropriate directory for your detected agent:
.cursor/skills/<skill-name>/.windsurf/skills/<skill-name>/.claude/skills/<skill-name>/The workspace root is detected by looking for:
.cursor, .windsurf, etc.).git/ directorypackage.jsonClawdbot uses a unique workspace model. Unlike other agents that store skills in a hidden directory (e.g., .cursor/skills/), Clawdbot stores skills in <workspace>/skills/. When installing for Clawdbot, taito follows the official ClawdHub workspace discovery chain:
CLAWDHUB_WORKDIR environment variable (if set).clawdhub/ marker)~/.clawdbot/clawdbot.json:
agents.defaults.workspace (or legacy agent.workspace)default: truemainThis ensures skills are installed to the same location that Clawdbot's clawdhub CLI would use.
Some agents support global installation with the --global flag:
taito add owner/repo --global
This installs to the agent's global directory (typically in your home directory) instead of the project-local directory. Not all agents support global installation.
Use --output to specify a custom location (bypasses agent detection):
taito add owner/repo --output ~/.my-skills/
MIT
FAQs
CLI for installing customizable Agent Skills from GitHub.
We found that taito-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.