A lockfile-first package manager for AI agent skills.
One manifest, one lock, every agent's skill directory.

skillcask installs skills (directories with a SKILL.md, read by Claude Code, Codex, Junie and others) the way Cargo or Composer install libraries: a manifest with version constraints, a committed lock with content hashes, and frozen installs in CI that fail on drift. It ships as a single static binary with no runtime, and takes skills from Composer repositories, GitHub (which covers most of what skills.sh lists) and any git repository over HTTPS.

Install

brew install getresponse/tap/skillcask      # macOS, Linux
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/GetResponse/skillcask/releases/latest/download/skillcask-installer.sh | sh
npm install -g skillcask                    # or: cargo install --locked skillcask

Windows, the desktop app, bun, release archives with attestations, the GitHub Action and updating: Install guide.

Quickstart

skillcask init                                # create skills.toml
skillcask add netresearch/agent-jira-skill    # resolve, write skills.toml + skills.lock, install
skillcask add github:mattpocock/skills/tdd    # one skill from a GitHub repository
skillcask status                              # manifest vs lock vs installed files
skillcask install --frozen                    # CI: install exactly the lock or exit non-zero

Commit skills.toml and skills.lock; the installed skills are gitignored. In GitHub Actions, uses: GetResponse/skillcask@<commit sha of a release tag> with version: X.Y.Z runs install --frozen (setup).

Why skillcask

• Locked and verified. The lock pins the version, the commit reference, the sha256 of the downloaded archive and the tree hash of every installed skill; install verifies both hashes.
• Every agent. Skills go to .agents/skills, which most agents read themselves, with links into .claude/skills, .kiro/skills or any directory you name.
• Your sources. Packagist, GitLab's Composer registry, Satis, Private Packagist, GitHub, any git server over HTTPS, or a static repository built by skillcask publish.
• Reviewable updates. A release-age cooldown (init writes 3d), outdated --strict for scheduled jobs, and diff / diff --from old.lock to read the skill text a change brings in.
• Policy for every project. allow-sources, deny-packages, exact versions only, and keys that config.toml enforces so a project cannot loosen them.
• Audit. audit lists what each skill reaches (commands, hosts, paths, env vars, scripts), flags risky lines and invisible characters, and prints SARIF; --advisories also checks published security advisories.
• Data only. No package code runs, ever. No telemetry. No PHP, Composer or Node needed.

How it works

skills.toml ──add/update──▶ skills.lock ──install──▶ .agents/skills/<name>/      read by Codex, Cursor, Gemini CLI, …
 manifest,                   lock, commit it          ├─▶ .claude/skills/<name>   link ([agents] targets)
 commit it                                            └─▶ .kiro/skills/<name>     link

add and update resolve the constraints in skills.toml and write the exact versions and hashes to skills.lock; install installs exactly what the lock pins and fails on any hash mismatch. Details: Use.

macOS app

Review updates	Audit findings	Add skills

A SwiftUI app for macOS 14+ over the CLI: see each skill's state, updates and audit findings, read its SKILL.md and diffs, and add, update or remove skills. Linux and Windows have the terminal UI, skillcask ui.

brew install getresponse/tap/skillcask getresponse/tap/skillcask-app

More in macOS app.

Documentation

Guide
Install	Every install method, the GitHub Action, updating
Use	skills.toml, agents, dependencies, name conflicts, personal skills (--global)
Commands	Every command, --json, exit codes, reviewing updates and lock changes
Sources	Skills from GitHub, skills.sh and any git repository
Policy	Allowed sources and policy for every project
Security	What is verified, warnings, audit, credentials
Publishing skills	Packages, monorepos with skillcask publish, validate
macOS app	Installing and building the app
Design	Goals, non-goals and numbered decisions

Security

HTTPS only, hashes checked on every install, archives that escape their skill rejected, and no package code run. The threat model and every check are in Security; report a vulnerability as SECURITY.md describes.

Contributing

Read AGENTS.md for the checks CI runs and the project's invariants, and the design spec before changing how the manifest, lock, install or publish behave.

License

MIT OR Apache-2.0.