Skills open-skills
📦

open-skills

Low Risk ⚙️ External commands📁 Filesystem access🌐 Network access🔑 Env variables

Browse and Install AI Skills Across Editors

Managing AI Agent skills across multiple editors is tedious and time-consuming. Open-skills provides an interactive CLI to browse, select, and install skills from a centralized registry to Claude Code, Codex, and other supported editors with a single command.

Supports: Claude Codex Code(CC)
🥉 75 Bronze
1

Download the skill ZIP

2

Upload in Claude

Go to Settings → Capabilities → Skills → Upload skill

3

Toggle on and start using

Test it

Using "open-skills". List coding-related skills

Expected outcome:

  • Available coding skills:
  • code-review - Automated code review and suggestions
  • refactoring-assistant - Code refactoring and improvement
  • test-generator - Generate unit tests automatically
  • documentation-gen - Auto-generate code documentation
  • Select skills with space bar, press Enter to install.

Using "open-skills". Install skills to Claude Code

Expected outcome:

  • Installing 3 skills to Claude Code...
  • code-review installed
  • test-generator installed
  • documentation-gen installed
  • Skills are ready to use. Restart Claude Code to activate.

Using "open-skills". Sync installed skills

Expected outcome:

  • Checking for updates...
  • code-review: up to date
  • test-generator: update available (v4.0 to v4.1)
  • Updating test-generator...
  • test-generator updated
  • Sync complete. 1 skill updated.

Security Audit

Low Risk
v1 • 4/16/2026

Security evaluation confirms this is a legitimate CLI skill marketplace tool. The 2395 static findings are overwhelmingly false positives: markdown backtick documentation flagged as command execution (864 external_commands hits), example commands in documentation triggering crypto alerts, and npm lock file metadata flagged as C2 keywords or high-entropy content. The actual TypeScript implementation uses standard CLI patterns for skill installation via git clone with sparse checkout, GitHub API fetches with proper User-Agent headers, and editor adapter management. Network requests only target github.com and skillstore.io APIs. No malicious intent, credential exfiltration, or prompt injection detected.

88
Files scanned
16,662
Lines analyzed
9
findings
1
Total audits

High Risk Issues (1)

src/dev-server/web/index.html:239-275
XSS Risk in Dev Server HTML
The dev-server/web/index.html uses innerHTML assignments to render category names, skill descriptions, and tags directly from local data. While this is a local development admin panel not exposed to production, untrusted skill data rendered via innerHTML could execute scripts if a malicious skill were installed. Risk is limited to local development use.
Low Risk Issues (4)
README.md:7-100SKILL.md:11-27bundles/skills/deep-research/SKILL.md:26-675
Documentation Patterns Misidentified as Command Execution
Hundreds of markdown files contain backtick-wrapped CLI examples (e.g., `open-skills list`) which the static scanner flagged as Ruby/shell backtick execution. These are documentation examples, not actual code execution. The scanner does not distinguish between markdown code fences and executable code.
package-lock.json:70-121pnpm-lock.yaml:79-893
Lock File Entropy and C2 Keyword False Positives
package-lock.json and pnpm-lock.yaml contain base64-encoded package integrity hashes and npm package names that triggered obfuscation and C2 keyword alerts. These are standard npm package manager artifacts, not indicators of compromise.
bundles/skills/deep-research/ARCHITECTURE_REVIEW.md:4-474
Weak Crypto Alerts in Documentation
Static scanner flagged markdown files for weak cryptographic algorithm references. These appear in documentation examples and architecture descriptions, not actual cryptographic implementation code.
src/cli.ts:19
Environment Variable Access for Dev Mode
src/cli.ts reads process.env.OPEN_SKILLS_DEV to enable development server mode. This is a standard pattern for CLI tools and poses no security risk as it only controls local dev server startup.

Risk Factors

⚙️ External commands (3)
src/commands/create.ts:39-46 src/commands/install.ts:135-153 src/core/github-utils.ts:35-110
📁 Filesystem access (2)
src/commands/install.ts:1-10 src/core/engine.ts:60-69
🌐 Network access (2)
src/core/github-utils.ts:35 src/core/resolvers/skillstore-resolver.ts:71
🔑 Env variables (1)
src/cli.ts:19
Audited by: claude

Quality Score

59
Architecture
100
Maintainability
87
Content
50
Community
72
Security
100
Spec Compliance

What You Can Build

Quick Skill Discovery and Installation

Developer wants to add new coding skills to their AI assistant. They browse categories, select multiple relevant skills, and install them with one command.

Team Skill Standardization

Development team lead exports a skill configuration and shares it with team members to ensure consistent AI assistant capabilities across the team.

Cross-Editor Skill Migration

Developer switching from one AI editor to another imports their existing skill configuration to quickly set up the new environment.

Try These Prompts

Browse Available Skills 
Show me all available skills for coding tasks
Search for Specific Skills 
Search for skills related to testing or debugging
Install Multiple Skills 
Install the code review, testing assistant, and documentation generation skills to Claude Code
Sync Skills with Registry 
Sync all my installed skills with the latest versions from the registry

Best Practices

  • Review skill permissions before installation to understand what access the skill requires
  • Test new skills in a non-critical project first to verify they work as expected
  • Keep your skill registry synchronized to receive security updates and new features

Avoid

  • Avoid installing skills from untrusted sources outside the verified registry
  • Do not ignore skill compatibility warnings - incompatible skills may not function correctly
  • Avoid bulk installing many skills at once without reviewing their functionality

Frequently Asked Questions

Which editors does open-skills support?
Open-skills supports Claude Code, Codex, Cursor, Windsurf, Cline, and Roo Code. Support for additional editors is planned.
How do I create and share my own skills?
Use the create command to scaffold a new skill. Skills follow a standard structure with SKILL.md for instructions and can be shared via GitHub or the skill registry.
Can I install skills offline?
Yes, you can install skills from local files or directories using the install command with a local path.
How do I remove an installed skill?
Use the update command to manage skill removal, or manually delete the skill directory from your editor skills folder.
Are skills from the registry safe?
The registry reviews skills for security issues, but always review skill permissions and code before installation. Report suspicious skills to the maintainers.
How do I update an individual skill?
Run the sync command with the skill name to update a specific skill to its latest version.

Developer Details

Author

lumacoder

License

MIT

Repository

https://github.com/lumacoder/open-skills/tree/main/

Ref

main

File structure

📁 bundles/

📁 skills/

📁 deep-research/

📁 reference/

📁 scripts/

📁 templates/

📁 tests/

📄 ARCHITECTURE_REVIEW.md

📄 AUTONOMY_VERIFICATION.md

📄 COMPETITIVE_ANALYSIS.md

📄 CONTEXT_OPTIMIZATION.md

📄 QUICK_START.md

📄 requirements.txt

📄 SKILL.md

📄 WORD_PRECISION_AUDIT.md

📁 docs/

📄 ide-engine.md

📄 PRD-V1.md

📄 PRD-V2.md

📄 PRD-V3.md

📁 registry/

📁 _v2_backup/

📄 _index.yaml

📄 docker-basics.yaml

📄 node-api-design.yaml

📄 react-best-practices.yaml

📄 test.yaml

📄 typescript-patterns.yaml

📄 web-security.yaml

📄 skills.json

📁 scripts/

📄 validate-registry.ts

📁 src/

📁 commands/

📄 create.ts

📄 dev-panel.ts

📄 export.ts

📄 import.ts

📄 install.ts

📄 list.ts

📄 migrate.ts

📄 search.ts

📄 sync.ts

📄 update.ts

📄 validate.ts

📁 core/

📁 adapters/

📄 antigravity-adapter.ts

📄 base-adapter.ts

📄 claude-adapter.ts

📄 cline-adapter.ts

📄 cursor-adapter.ts

📄 cursor-skills-adapter.ts

📄 hermes-adapter.ts

📄 index.ts

📄 roo-cline-adapter.ts

📄 windsurf-adapter.ts

📁 dev/

📄 scaffold.ts

📁 presets/

📄 editors.ts

📁 resolvers/

📄 clawhub-resolver.ts

📄 github-resolver.ts

📄 remote-resolver.ts

📄 skillstore-resolver.ts

📄 cleaner.ts

📄 engine.ts

📄 fs-utils.ts

📄 github-utils.ts

📄 marker-system.ts

📄 registry-v3.ts

📄 registry.ts

📄 transformer.ts

📄 validator.ts

📁 dev-server/

📁 web/

📄 index.html

📄 api.ts

📄 server.ts

📁 types/

📄 index.ts

📁 ui/

📄 category-select.ts

📄 confirm-panel.ts

📄 editor-select.ts

📄 scope-select.ts

📄 skill-select.ts

📄 cli.ts

📄 package-lock.json

📄 package.json

📄 pnpm-lock.yaml

📄 README.md

📄 SKILL.md

📄 tsconfig.json

📄 tsup.config.ts