Skillsmith

Manage skills in your private registry (list, get, install, deprecate, undeprecate, namespace, submissions, approve, reject). Requires Enterprise tier (private_registry feature). Published versions require a team admin to approve them via "approve" before other members can install them (see "submissions" to check status).

Publish a skill to your organization's private registry. Requires Enterprise tier (private_registry feature). Skills are scoped to your team's registry namespace and published versions are immutable. A published version is not installable by teammates until a team admin approves it — see private_registry_manage action "submissions" to check its status.

Mark a skill as private on this machine: hides it from local community-search results. This is a local-only setting today -- it does not sync or share the skill with your teammates. For a real shared team registry, see the Enterprise-tier private_registry_publish tool. Requires Team tier license.

Assign or revoke a team member's role, or list current members and their roles. Roles are fixed: admin or member (owner is managed separately and can never be changed here). Requires the team:manage_rbac permission and Enterprise tier (rbac feature).

Bulk-write or clear permission overrides: create expands resources x actions into "resource:action" permission grants for one role, delete clears them, list shows the overrides currently set. Valid expansions: registry:approve, registry:deprecate, team:manage_rbac, team:manage_sso. Requires the team:manage_rbac permission and Enterprise tier (rbac feature).

Inspect and configure team role permissions: list_roles, get_role, set_role_permission, reset_role_permission. Roles are fixed (owner, admin, member) — owners always hold every permission and cannot be narrowed. Configurable permissions: registry:approve, registry:deprecate, team:manage_rbac, team:manage_sso. Requires the team:manage_rbac permission and Enterprise tier (rbac feature).

[Skillsmith — Discover stage] Search the Skillsmith registry of agent skills (SKILL.md format) — curated, security-scanned, trust-scored skills indexed daily from GitHub. Skillsmith is a registry for sharing, scanning, and tracking agent skills across any MCP-capable runtime. Use this tool for ANY user request to find/search/discover/list skills — e.g. 'search for testing skills', 'find git workflow skills', 'show me devops skills with quality above 80'. Returns ranked installable skills with trust badges, NOT general programming guidance. Results are installable-only by default (pass installa…

Add, remove, or list skills in a team workspace. Requires Team tier license.

Export audit events for SIEM ingestion (CloudWatch, Splunk, Datadog). Requires Enterprise tier (siem_export feature). SIEM destination is configured via environment variables, not tool arguments.

Check installed skills for known security advisories. Requires Team tier or higher (skill_security_audit feature). The advisory system is in early access — the Skillsmith team publishes advisories as security issues are identified. Run `skillsmith sync` to fetch the latest advisories.

[Skillsmith — Evaluate stage] Compare two Skillsmith-registry skills side-by-side. Use when the user wants to compare/contrast/decide-between two specific skills — e.g. 'compare getsentry/commit and microsoft/playwright-cli', 'which is better, X or Y', 'what's the difference between these two skills'. Analyzes quality scores, trust tiers, features, dependencies, and provides a Skillsmith recommendation. Skillsmith is a registry for sharing, scanning, and tracking agent skills across any MCP-capable runtime.

Show a section-level diff between two versions of an installed skill. Returns added, removed, and modified headings along with a change type (major/minor/patch) and update recommendation. Requires Individual tier or higher (version_tracking feature).

Rebuild or refresh the local .ruvector/skillsmith-docs.rvf index. Fails in CI. Fails if the docs/internal submodule is uninitialized.

PREFERRED first step for any question about the Skillsmith repo's internal docs (CLAUDE.md, .claude/development, docs/internal — ADRs, retros, plans, standards, implementation guides). Returns cited chunks with file:line — much cheaper than Read+Grep over the same corpus. Examples: "git-crypt worktree workflow", "file-length limits", "plan-review anti-patterns", "SMI-4434 decisions". Use Read/Grep/Glob ONLY when you need actual source code or non-indexed files.

Report chunk count, file count, last-indexed SHA, and last run time for the local corpus index.

[Skillsmith — Maintain stage] Audit your installed AI coding clients' skill inventories (Claude Code, Cursor, Copilot, and every other Skillsmith-supported client) — plus Claude Code's own commands, agents, and CLAUDE.md trigger rules — for local namespace collisions. Returns rename + prose-edit suggestions keyed by a fresh `auditId`. Never modifies your skills, commands, agents, or CLAUDE.md — it only writes its own audit artifacts under `~/.skillsmith/audits/<auditId>/`. Feed the returned suggestions into `apply_namespace_rename` / `apply_recommended_edit`.

Check installed skills for available updates and dependency satisfaction status. Reads the local manifest, hashes each installed SKILL.md, and compares against the latest registry state. Community tier — no license required.

Audit a skill pack directory for (a) version drift — bundled SKILL.md versions vs. the Skillsmith registry cache — and (b) trigger-quality issues — generic trigger words in skill names/descriptions and generic pack namespaces that misfire Claude's skill-trigger heuristic (SMI-4124). Response is additive: new triggerQuality and namespaceQuality fields appear when check_trigger_quality is true (default); existing fields (skills, driftCount, etc.) are unchanged. Requires Individual tier or higher.

Prepare a skill for publishing. Validates the skill, generates a checksum, creates a publish manifest, and optionally checks for project-specific references. Can also create a GitHub repository for registry discovery.

[Skillsmith — Discover stage] Recommend skills from the Skillsmith registry based on the user's project context and currently installed skills, using semantic similarity. Use when the user asks for recommendations or 'what skills should I use' — e.g. 'recommend skills for my React project'. Auto-detects installed skills from ~/.claude/skills/ when not provided. Optional role-based filtering. Returns ranked Skillsmith candidates with description + security, NOT general programming advice. Narrate security per item: absent = never scanned (say so, imply neither safe nor unsafe); passed:null = sc…

[Skillsmith — Maintain stage] Recover the canonical GitHub source of locally-installed skills (SMI-5407). Read-only — never mutates ~/.skillsmith/manifest.json. Returns { skills, summary } where each skill entry reports confidence (exact/high/medium/low), method, and the recovered source URL. Feed exact/high results into `sklx audit sources --apply` to backfill the manifest.

Re-scan installed skills with the latest security patterns. Detects issues like SSRF instructions, prompt injection, data exfiltration, and other threats that may not have been caught when the skill was originally installed. Run without arguments to scan all installed skills, or specify a skill name to scan one.

Proactively suggest relevant skills based on current context (files, commands, errors, project structure). Counts against your monthly API quota (Community: 100/mo — see www.skillsmith.app/pricing).

Check installed skills for available updates by comparing locally-recorded content hashes against the current registry state. Requires Individual tier or higher. Returns a list of skills with their installed vs. latest hash and whether an update is available.

[Skillsmith — Install stage] Validate a SKILL.md file or skill directory against the Skillsmith specification before installing or publishing. Use when the user wants to check/validate a skill's structure — e.g. 'validate my skill at ./my-skill', 'check if this skill is valid', 'use Skillsmith to validate this SKILL.md'. Checks YAML frontmatter, required fields, file structure, and security-pattern signatures. For end-to-end skill authoring including scaffolding/publishing, use the CLI `skillsmith author` commands. Skillsmith is a registry for sharing, scanning, and tracking agent skills acros…

View current SSO/SAML configuration for your organization. Requires Enterprise tier (sso_saml feature).

View team usage analytics: per-user tool usage counts, top tools, and daily trend. Requires Team tier (usage_analytics feature).

Generate a weekly/monthly usage summary with period-over-period comparison. Requires Team tier (usage_analytics feature).

Manage team workspaces (create, list, get, delete). Requires Team tier license.

[Skillsmith — Maintain stage] Undo the most recent apply_namespace_rename / apply_recommended_edit changeset(s) made in THIS server session. Session-scoped: restarting the MCP server clears the undo history — for a namespace rename applied in a PRIOR session, use the durable, cross-session revert instead: apply_namespace_rename({ auditId, collisionId, action: 'revert' }) (SMI-5671). Restores from the apply tool's own pre-mutation backup and refuses (never throws) if the target was modified since the apply, the backup is missing, or the restore target falls outside the confined skill roots. Pas…

[Skillsmith — Retire stage] Uninstall an agent skill from the local Claude Code skills directory (~/.claude/skills/) or runtime-equivalent path. Use when the user asks to uninstall/remove/delete a specific skill — e.g. 'uninstall playwright-cli', 'remove getsentry/commit', 'use Skillsmith to delete the testing skill'. Optional `force` flag overrides protection on locally-modified skills. Skillsmith is a registry for sharing, scanning, and tracking agent skills across any MCP-capable runtime.

Comprehensive enterprise usage report with all metrics. Requires Enterprise tier (advanced_analytics feature).

Configure webhooks for skill lifecycle events (skill.install, skill.publish, etc.). Webhooks are signed with HMAC-SHA256. Requires Enterprise tier (custom_integrations feature).