
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
universal-skills
Advanced tools
MCP server and CLI tool for discovering and installing skills from GitHub repositories
Universal Skills brings Anthropic's Skills feature to any AI coding agent that supports MCP. Skills are markdown files containing specialized knowledge that can be dynamically loaded into your agent's context only when needed.
For a real-world example on how I personally use skills see Creating a Skill.
A week ago, I reverse engineered Claude Code's skills. A day ago, I spotted this repo openskills which implements skills for other coding agents. Their approach works but is suboptimal. That's why I decided to build a functional equivalent to Claude Code's skills based on MCP. See why not use openskills for details.
Add the skills server to Codex using the MCP add command:
codex mcp add skills -- npx universal-skills mcp
Add the skills server to Claude Code using the MCP add command:
claude mcp add --transport stdio skills -- npx universal-skills mcp
Add the skills server to your OpenCode configuration by creating or editing the opencode.json file in your project root:
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"skills": {
"type": "local",
"command": ["npx", "universal-skills", "mcp"],
"enabled": true
}
}
}
For opencode I had to be quite explicit in instructing the agent to load a skill. I will have a look into their default instructions to improve that.
This should also work fine with Cursor and other Agent's that support MCP. Just not tested yet.
Skills are automatically discovered from four directories in priority order (first match wins):
yourproject/.agent/skills/ - Project-specific skillsyourproject/.claude/skills/ - Project-specific skills~/.claude/skills/ - Global skills~/.agent/skills/ - Global skillsEach skill is a directory containing a SKILL.md file:
.agent/skills/
├── git/
│ └── SKILL.md
└── postgres/
└── SKILL.md
Priority Resolution: If the same skill name exists in multiple directories, the one from the higher priority directory wins. This allows you to override global skills with project-specific versions.
Add additional directories to recursively search for skills using --skill-dir (can be specified multiple times):
codex mcp add skills -- npx universal-skills mcp --skill-dir ~/.claude/plugins
Install a skill from a GitHub repository:
# Interactive mode (prompts for all options)
npx universal-skills install
# With all options
npx universal-skills install --repo https://github.com/user/repo --repo-dir skills/my-skill --local-dir ~/.claude/skills
For frequently asked questions, see the FAQ documentation.
FAQs
MCP server and CLI tool for discovering and installing skills from GitHub repositories
The npm package universal-skills receives a total of 19 weekly downloads. As such, universal-skills popularity was classified as not popular.
We found that universal-skills demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.