Agent Skills¶

ID: skills
Home page: https://skills.sh
Platforms: 🐧 Linux · 🍎 macOS · 🪟 Windows
Operations: installed · upgrade_all · remove
purl types: pkg:skills
CLI name: skills
Issues and PRs: 📦 manager: skills
Source: meta_package_manager/managers/skills.toml

The Agent Skills directory’s own installer (https://skills.sh), which places reusable skill folders into the directories the coding agents on a machine read.

A package is one installed skill, named as the listing reports it, and that name is what remove takes. It is not what add takes: see below.

Parsing notes, verified against skills 1.5.23 on macOS:

Every operation is scoped with --global. Without it the tool answers for the working directory, and run from a repository carrying its own .claude/skills it reports that repository’s skills as the inventory. list --global is directory-independent, checked by running it from two directories for the same answer, and it is the only machine-wide reading.
No install. skills add takes a source repository and installs every skill in it at once: one add vercel-labs/agent-skills brought in nine. Nothing names a single skill to install, so the operation mpm needs does not exist, while remove is per skill and keyed on the listed name. The 0install split, with the halves the other way round.
No outdated, nothing reporting staleness without acting, and no search: find is documented as interactive.
The inventory carries no version at all, only a name, a path, the agents it was linked into and the repository it came from. That is a supported shape rather than a gap, installed_version being optional, and the same reading rustup and pyenv settled.
Colors are unconditional, so the pattern reads the id out of the path rather than off the padded first column: anchoring on /skills/ steps over the escapes instead of fighting them. That the path repeats the name is what makes this work, and --global is what keeps a project skill’s ./.claude/skills/<name> path out of the same match.

Note

The tool chooses its own interactivity by sniffing the environment: removal announces Agent detected — removing non-interactively before proceeding. --yes is passed regardless rather than relying on that detection, which is upstream behavior no flag pins.

What `mpm` adds to `skills`¶

mpm reaches across every manager at once, not skills alone: mpm installed and mpm outdated cover skills alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `skills` commands, in `mpm`¶

You already know skills: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `skills`	With `mpm`
List what’s installed	`skills list --global`	`mpm --skills installed`
Upgrade everything	`skills update --global --yes`	`mpm --skills upgrade --all`
Remove a package	`skills remove <package_id> --global --yes`	`mpm remove pkg:skills/<package_id>`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported
`installed`	✓
`outdated`
`orphans`
`search`
`install`
`upgrade`
`upgrade_all`	✓
`remove`	✓
`sync`
`cleanup`
`doctor`

Selecting and configuring `skills`¶

Deselect skills for a single run with --no-skills, or persist the choice in your configuration:

[mpm]
skills = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.skills]
timeout = 900

mpm config-template skills prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around skills, one mpm command each:

Snapshot and clone a machine: mpm --skills dump skills.toml, then mpm restore skills.toml on the next one.
Export a compliance SBOM: mpm --skills sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations needs root.

See privilege escalation for the full policy.

Cooldown¶

State of Agent Skills’s release-age gating, from the cooldown support table:

Status: ❌ None (skills carry no version, let alone a publication date)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Agent skill repositories
Retraction: Repository edit: a skill is a folder in a git repository the directory indexes, so it is withdrawn by its owner deleting the folder or the repository, with no release artifact in between
Publish date: ❌ the inventory carries no version at all, so there is nothing to date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --cooldown best-effort opts back in.

Version probe¶

The version is probed by running:

$ skills --version
1.5.23

and extracted with:

r"(?P<version>\d+\.\d+\.\d+)"

Reference traces¶

Raw native outputs captured in the bundled definition: the reference mpm’s parsers were written against. If you know Agent Skills well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ skills list --global
[1mGlobal Skills[0m

[36mdeploy-to-vercel      [0m [38;5;102m~/.agents/skills/deploy-to-vercel      [0m
  [38;5;102mAgents:[0m Claude Code  [38;5;102mSource:[0m vercel-labs/agent-skills
[36mvercel-cli-with-tokens[0m [38;5;102m~/.agents/skills/vercel-cli-with-tokens[0m
  [38;5;102mAgents:[0m Claude Code  [38;5;102mSource:[0m vercel-labs/agent-skills

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --skills installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog¶

8.0.0.dev0 (unreleased)
- Add Agent Skills manager, listing, removing and upgrading the skills installed for the coding agents on a machine.