google-workspace

vskill

The package manager for AI skills.
Author. Eval. Publish. Install — across 53 agent platforms.

npx vskill@latest studio        # open the local IDE for AI skills
npx vskill@latest install remotion-best-practices

Why vskill

36.82% of AI skills have security flaws (Snyk ToxicSkills). And the ones that aren't malicious often don't even improve the model — they just feel like they should.

vskill is built around three problems:

• Trust — every install runs a 3-tier scan (52 patterns → blocklist → LLM intent). No --skip-scan.
• Proof — Skill Studio runs A/B evals so you can show a skill makes a model better, not assume it.
• Reach — one skill, 53 agents (Claude Code, Cursor, Copilot, Codex, Windsurf, Zed, Gemini CLI, Ollama, …).

Skill Studio — the local IDE for skills

npx vskill@latest studio

A localhost workbench opens at a deterministic per-project port. You can:

• Author new skills with an AI-assisted generator (Anthropic skill-creator engine or vskill native — first-class peers, you pick).
• Edit SKILL.md live with a Linear/Raycast-grade UI.
• Run benchmarks with SSE-streamed pass/fail across Claude, GPT, Llama, Gemini, local Ollama / LM Studio.
• A/B compare with vs. without your skill — blind LLM judge ranks outputs as EFFECTIVE / MARGINAL / INEFFECTIVE / DEGRADING.
• Cross-model sweep the same skill across providers (Anthropic Batch API supported — 50% cheaper).
• Find skills from the verified-skill.com registry with a ⌘⇧K palette, install with consent + provenance.
• Publish with one click — git push from the UI, then opens the submit form on verified-skill.com pre-filled.

CORS-free by design: the browser only ever talks to localhost. The server proxies to verified-skill.com and to provider APIs. Every mutation is logged to ~/.vskill/studio-ops.jsonl for audit.

How install works

  ┌──────────┐     ┌──────────┐     ┌──────────┐     ┌──────────┐
  │  Source  │────>│   Scan   │────>│  Verify  │────>│ Install  │
  │          │     │          │     │          │     │          │
  │ GitHub   │     │ 52 rules │     │ LLM      │     │ Pin SHA  │
  │ Registry │     │ Blocklist│     │ intent   │     │ Lock ver │
  │ Local    │     │ Patterns │     │ analysis │     │ Symlink  │
  └──────────┘     └──────────┘     └──────────┘     └──────────┘

Every install runs the full pipeline. SARIF v2.1.0 output is available for CI (vskill audit --ci).

Quick Start

# Install one skill
npx vskill@latest install remotion-dev/skills/remotion-best-practices

# Browse a repo, pick interactively
npx vskill@latest install remotion-dev/skills

# Install a Claude Code plugin (full domain bundle)
npx vskill@latest install --repo anton-abyzov/vskill --plugin frontend

Install globally for repeat use: npm i -g vskill

_{Behind a private npm registry? See Getting Started for the E401 workaround.}

What ships today

Surface	Count	Notes
Agent platforms	53	Claude Code, Cursor, Copilot, Windsurf, Codex, Gemini CLI, Zed, Ollama, LM Studio, …
Plugins	8	Multi-skill bundles for Claude Code
Skills	14	Individual SKILL.md files inside plugins
Top-level CLI commands	22	install, studio, eval, find, scan, audit, submit, skill, keys, …
Tests	307 test files	More tests than source files

Plugins (Claude Code)

Plugin	Skills
frontend	figma-connect, frontend-design, task-skill-announcer
personal	obsidian-brain, greet-anton, tax-filing
marketing	slack-messaging, social-media-posting
skills	skill-builder, scout
mobile	appstore
google-workspace	gws
easychamp	tournament-manager
productivity	survey-passing

Install all eight: npx vskill@latest install --repo anton-abyzov/vskill --all