Docs

CLI Reference

The skills CLI is the only thing you need to install anything in this catalog. It writes plain markdown into your agent's skills directory — no daemon, no runtime, nothing to trust beyond the file you just read.

Installation

Nothing to install — the CLI runs directly through npx.

npx skills add <source>

Basic usage

A source is a GitHub owner/repo, or a raw URL. Each skill page on this site shows the exact URL form.

npx skills add securityskills/skills

— the entire catalog, 19 skills

npx skills add https://github.com/securityskills/skills --skill ssrf-hunting

— one skill from the catalog

npx skills add https://securityskills.vercel.app/api/skills/ssrf-hunting/raw

— one skill by direct URL — useful for scripts and agents

Try without installing

Loads the skill for a single run and leaves nothing on disk.

npx skills use https://github.com/securityskills/skills --skill ssrf-hunting

Target specific agents

By default the CLI auto-detects installed agents. Pass -a to narrow it, and -g to install globally instead of into the project. Every supported agent, its -a id, and the exact directory it reads from are listed in the agents reference.

npx skills add <source> -a claude-code -a codex

npx skills add <source> -g

— global instead of project-local

Updating

Pulls the latest content for everything installed. Update tracking is strongest for GitHub-backed sources — the lockfile records the source and its tree hash for comparison.

npx skills update

Where skills land

Project installs go next to your code, global installs into your home directory. The path differs per agent — Claude Code uses .claude/skills/, while Codex, Cursor, Cline, Zed and others share .agents/skills/, so one install serves all of them. See the agents reference for the full table.

npx skills add <url>

— project — ./<agent>/skills/

npx skills add <url> -g

— global — ~/<agent>/skills/

Telemetry

The CLI reports anonymous install telemetry to rank skills on the public skills.sh leaderboard — skill name, files, timestamp; no personal or device information. Opt out with an environment variable. This site sees none of that: installs go straight from you to GitHub. The counts shown here are copies of the install command, which is the last thing we can honestly observe, and no ranking or leaderboard is published from them.

DISABLE_TELEMETRY=1 npx skills add <source>