Trusted dependency manager for AI agent skills. skillpin installs skills from GitHub repositories at immutable commits and maintains their source metadata locally.
npm install -g skillpinRequires Linux, Node.js 22.14 or newer, and readable/searchable /proc/self/fd. Runtime operations fail closed when these requirements are unavailable; skillpin provides no portability or local fallback.
skillpin init
skillpin add owner/repository path/to/skill --ref commit:<40-character-sha>
skillpin install
skillpin remove owner/repository path/to/skill
skillpin list
skillpin search "review this React component for render performance"add accepts OWNER/REPO GitHub repositories and resolves refs to an exact commit before installing. Use --all to add every valid skill in a repository snapshot. install restores the locked inventory, and remove OWNER/REPO removes every locked skill from that repository (or one selected skill).
skillpin init creates the managed environment:
skillpin.json, the manifest of requested repositories, refs, and skill paths.skills/, the managed skill contents.
The first successful public or authorized-private GitHub add creates skillpin.lock, which records the resolved commit, Git tree, and integrity evidence for the managed inventory.
Use --json for machine-readable output. JSON field names use camelCase, for example skillsDir and created from init.
skillpin search "security review" --jsonSearch results include each managed SKILL.md path so an agent can load the selected skill from the library.
The optional standalone router skill is published at router-skill/SKILL.md. Register it with an agent host when agent-driven skill routing is desired; the CLI does not install or manage it.
skillpin is experimental. It supports GitHub-backed public and private skill installation, exact-commit resolution and recovery, manifest and lockfile tracking, integrity verification, repository-scoped removal, local search, and JSON output.
See CONTRIBUTING.md.
MIT