skilly-cli

Savant verdict: Review advised

Security analysis or source-hub review identified patterns requiring attention.

Live evaluation

Not evaluated yet. Workspaces can request a live evaluation.

Security assessment

Scan pending.

Structure

• No license declaredConfirm you may reuse this skill before importing it into your repository.
• The source hub's security checks flagged this skillGen Agent Trust Hub: warn (This skill manages agent skills using a CLI tool that executes code directly from a remote GitHub repository and allows the installation of skills from arbitrary, unverified URLs provided by the user.); Socket: warn (1 alert: gptSecurity)

SKILL.md

---
name: skilly-cli
description: Manage this repo's agent skills with the skilly CLI — add or remove bundles/skills, pull hub updates. Use when the user wants skills or bundles added, removed, or updated. For a skills.sh URL use the skills CLI directly, not skilly. Not for repo bootstrap (that is `skilly setup`, run once).
---

# Skilly CLI

This repo's skills are managed by skilly, a hub at `timschoch/skilly`. Always use the CLI; never install skills by manual copies.

Exception — the user posts a skills.sh URL: that skill lives outside the hub. Hand-pin it with the skills CLI: `npx -y skills add <url> --agent claude-code -y`. It lands in `skills-lock.json` and survives the sync; skilly never touches hand-pins.

- Add a bundle or single skill: `npx -y github:timschoch/skilly add <name...>` — bundle names and what they contain: [catalog](https://github.com/timschoch/skilly/blob/main/docs/bundles.md)
- Remove: `npx -y github:timschoch/skilly remove <name...>` — removing a bundle keeps skills still claimed by another bundle
- Pull the hub's current state: `npx -y github:timschoch/skilly update`

Every verb ends with its own commit, push, and PR — do not commit or push for it. On `main` it branches to `chore/skilly-setup` by itself. On any other branch it stops before the commit when `.agents/skills/verify/scripts/check-branch-name.mjs` refuses the name: rename with `git branch -m <type>/<description>`, then run the verb again.

Never hand-edit skilly-owned files — the nightly sync wipes and rewrites them:

- `.claude/skills/` and `.agents/skills/` (installed skills)
- `.claude/rules/<name>-*.md` (installed router rules)
- `.skilly/config.json`, `skills-lock.json`

A change to a skill belongs in its source repo (see `skills-lock.json` for the source), a repo-local rule in `CLAUDE.md`. A bug in an installed skill, hook, or rule: file it before you work around it, see `.claude/rules/workflow-hazards.md`.