Search, install, and keep Agent Skills current.
skilld v3 has two products:
- The native
skilldCLI manages Skills. - The JavaScript
skilld-harnesspackage runs visible Skill generation and review instructions.
The skilld CLI contains no Skill generation logic or Agent runtime.
npm install --global skilldThe npm package selects a native executable for the current system. It has no JavaScript CLI engine or JavaScript fallback.
Install the skilld-maintained Skill for your Agent:
skilld install skilld --globalUse --agent when you want an explicit Agent target:
skilld install skilld --global --agent codex# Find a Skill
skilld search vue
# Install a Skill in the current project
skilld install skilld:skilld-dev/skills/vue
# Inspect installed Skills
skilld list
skilld view vue
# Keep Skills current
skilld verify vue
skilld update vue
# Check update relations for an Agent or CI
skilld update --check --json
# Remove a Skill
skilld remove vueProject installs update .skills/skilld-lock.yaml and the selected Agent targets.
Use --global for account level Agent targets.
Use --mode copy or --mode symlink to control target writes.
Run skilld install without a source to restore the lockfile state.
The skilld CLI resolves remote Skills through the skilld.dev API. GitHub remains the source of truth.
skilld.dev builds an immutable Artifact from an exact Git commit. The CLI checks its digest, Artifact attestation, check results, and archive before installation. The CLI stops pending Artifact creation after at most 60 seconds.
Private Repository delivery requires both:
skilld auth loginfor a skilld.dev account- Access through the skilld GitHub App installation
Private Artifact responses use short lived, one time grants. The API does not expose private storage addresses.
--direct fetches a public GitHub Repository without the skilld.dev API.
skilld install github:skilld-dev/skilld/skills/skilld --direct --agent codexThe installed Skill receives the unverified source status.
The user reviews the Skill before use.
Direct mode never handles private Repositories. It never falls back to skilld.dev.
verified: skilld checked a skilld.dev Artifact and its attestation.local: the Skill came from a local directory or a bundled skilld-maintained Skill.unverified: direct mode fetched the Skill from public GitHub.
verified describes provenance checks.
It does not endorse the instructions inside a Skill.
skilld auth login
skilld auth status
skilld auth logout
skilld config get agent.targets
skilld config set agent.targets codex,claude-code
skilld config listNative builds store account credentials in the operating system keychain. The CLI does not store tokens in environment variables or plain text files.
Skill generation lives outside the skilld CLI.
Use these skilld-maintained Skills directly with your Agent:
Direct Skill runs remain user reviewed. The instructions and changes stay visible to the user.
Use skilld-harness when an application or CI needs strict output checks.
The Harness runs the same visible Skill files through an AI SDK Harness.
pnpm add skilld-harness @ai-sdk/harness ws zodimport{createSkillHarness}from'skilld-harness'constskillHarness=createSkillHarness({ harness, sandbox })constresult=awaitskillHarness.run({_tag: 'PackageSkill',source: {_tag: 'NpmPackage',spec: 'vue'},destination: {rootDir: '.agents/skills',name: 'vue'},})See the skilld-harness guide for its full contract.
v3 does not import v2 configuration or lockfiles. Back up v2 state before replacing the CLI.
Follow the v2 to v3 migration guide. It maps removed commands and explains rollback limits.
pnpm install
pnpm test:run
pnpm lint
pnpm typecheck
pnpm buildThe Rust workspace owns the skilld CLI.
packages/harness owns generation and review execution.
packages/protocol owns the skilld.dev wire contract.
skills owns the visible skilld-maintained Skills.
The WASIp2 build remains an internal proof. Published packages use native executables only.