ai-agent-skills: a curated skills library with a package manager bolted on
Universal skill installer and package manager for AI coding agents. One command, 12+ runtimes. npx ai-agent-skills
At a glance
- What is it?
- MoizIbnYousaf/ai-agent-skills is an MIT-licensed npm CLI that installs Agent Skills into global and project targets, and also lets you build a shelved library of your own. The interesting part is the second job, not the first.
- Who is it for?
- Adopt ai-agent-skills if you want a small, hand-shelved library with visible provenance and you are willing to run the init-library, add and build-docs loop yourself. Skip it if you need one installer that covers the whole ecosystem, since the README explicitly points at skills.sh for that.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 29 days ago.
- What is it written in?
- Mainly JavaScript, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The problem is curation, not installation
Installing a skill is a solved problem. The README says the project launched on December 17, 2025, before skills.sh existed and before the ecosystem had a clear default universal installer, and it admits plainly that it still does the installer job. That is not where the value sits now. The stated goal is a smaller library with shelves, provenance and notes, in the author's own words: use skills.sh for the broad ecosystem, use ai-agent-skills when you want a smaller library with shelves, provenance, and notes. So the target reader is someone who has already pulled too many skills from too many repos and wants a bounded set they can actually browse. The README describes the bundled library as organized the way the author works, with the set kept small enough to browse quickly, provenance kept visible, and notes explaining why a skill is on the shelf. That is a personal-collection pattern, not an ecosystem-wide registry pattern, and the tool is honest about which one it is.
House copies versus cataloged upstream picks
Every entry in the library is one of two things, and the split determines whether an install needs the network. House copies are local folders under skills/<name>/. The README states they install fast, work offline, and ship with the npm package. Cataloged upstream entries are metadata in skills.json with no local folder; they stay in the source repo and install from there when you ask for them. The 4.3.1 release notes put the bundled library at 115 cataloged skills, broken down as 17 house copies and 98 cataloged upstream, and the README badge block carries a slightly different figure of 140 skills across 6 shelves with 17 house copies and 123 cataloged upstream. Those two numbers do not agree, and the README does not explain the gap, so treat the count as approximate rather than a spec. The design consequence matters more than the arithmetic: because upstream work stays upstream, the npm package stays lean, but the majority of what you can install is a pointer to someone else's repository, and it will break if that repository moves or restructures. The 4.3.1 release shows this risk in practice. It renamed the upstream marketing pack source from MoizIbnYousaf/mktg to MoizIbnYousaf/marketing-cli across catalog metadata, install sources, and source URLs, which means anyone pinned to the old path had a migration to do.
Where the CLI actually writes files
The README lists two default install targets: global at ~/.claude/skills/ and project at .agents/skills/. Agent-specific legacy targets still work through a --agent <name> flag. The -p flag selects the project shelf, so npx ai-agent-skills install pdf -p puts the pdf skill under the project target instead of the global one. Collections install in bulk: npx ai-agent-skills install --collection swift-agent-skills -p installs an entire curated pack into the project shelf. There are also shortcut subcommands that skip the install verb entirely, including npx ai-agent-skills swift, npx ai-agent-skills mktg and npx ai-agent-skills marketing-cli. You can point the installer at an arbitrary upstream repo with npx ai-agent-skills anthropics/skills, and npx ai-agent-skills install openai/skills --list browses a repo before you commit to adding or installing from it. Two things are worth noting here. First, the global default is a Claude-specific path, so the claim of working with any Agent Skills-compatible agent rests on the --agent flag rather than on the default. Second, the README warns against hand-editing skills.json, README.md or WORK_AREAS.md when a command already exists, which tells you these generated files are the source of truth for the library and will fight you if you edit them directly.
The workspace commands and the required --why flag
Starting your own library is a four-command loop. npx ai-agent-skills init-library my-library creates a managed workspace and a directory to cd into. npx ai-agent-skills add frontend-design --area frontend --branch Implementation --why "I want this on my shelf." records the pick with its shelf, its branch and a justification. npx ai-agent-skills install frontend-design -p installs it, npx ai-agent-skills sync frontend-design -p refreshes it, and npx ai-agent-skills build-docs regenerates the documentation. Upstream picks go in the same way, with a --skill flag to name the specific skill inside a repo: npx ai-agent-skills add anthropics/skills --skill webapp-testing --area workflow --branch Testing --why "I use this when I want browser-level checks in the workspace." The --why flag is the part I would keep. It is a small forcing function that turns a library into something with an audit trail, and it is the mechanism behind the README's claim that notes explain why a skill is here. The same pattern appears in the agent protocol, which instructs an agent to add 3 to 8 skills with explicit --area, --branch and --why on every mutation, run npx ai-agent-skills build-docs before finishing, and report which shelves were touched. There is a second entry point for existing collections: the README shows cd ~/projects/my-skills followed by npx ai-agent-skill to bootstrap a flat repo of skills in place. That last command is spelled without the plural s and the README cuts off mid-block, so verify the exact form against the package before running it on a repo you care about.
The agent protocol is the real interface
The most unusual thing in this repository is not the CLI. It is FOR_YOUR_AGENT.md, a protocol meant to be pasted into a coding agent so the agent curates the library on your behalf. The README supplies the paste block verbatim. It tells the agent to fetch that file from raw.githubusercontent.com, create a workspace, ask at most three short questions about what kinds of work you do and whether the library should be local or shared, map your stack onto the shelves frontend, backend, mobile, workflow and agent-engineering, then run a discovery loop of list --area <shelf>, search <query> and collections before adding anything. It also ships companion workflow skills that are described as installed automatically when you use the library, covering install-from-remote-library, curate-a-team-library, share-a-library, browse-and-evaluate, update-installed-skills, build-workspace-docs, review-a-skill, audit-library-health and migrate-skills-between-libraries. Each is installable by name, for example npx ai-agent-skills install curate-a-team-library. This is a bet that the person operating the tool is increasingly an agent, and the human supplies intent rather than keystrokes. It also means the quality of your library depends on how well the agent follows a markdown protocol, which is not something the package can enforce.
What it does not do well
The README is unusually direct about the boundary: use skills.sh for the broad ecosystem. If your requirement is one installer that reaches everything, this is not that tool, and the author says so. The second limitation is structural. Because 98 of the 115 cataloged skills live upstream, your install depends on repositories you do not control, and the 4.3.1 rename of the marketing pack source shows how a single upstream move ripples into catalog metadata, install sources and source URLs at once. Third, the library is explicitly personal. The shelves frontend, backend, mobile, workflow and agent-engineering reflect one developer's working style, and the README describes the bundled set as the skills the author actually keeps around. If your work does not map onto those five shelves, you are using someone else's filing system. Fourth, the default global target is ~/.claude/skills/, which means the multi-runtime claim is carried by the --agent flag rather than by the defaults, and the README does not enumerate which agent names that flag accepts. Finally, the version history shows a fast-moving surface. The published releases run from v4.0.0 in March 2026 through v4.2.0 in April to v4.3.1 in May, with the 4.3.1 entry described as a marketing-cli sync. A CLI that renames upstream sources and renumbers major versions on that cadence will occasionally require you to re-run sync or re-add an entry.
Licence, maintenance and what a pin costs you
The package is MIT-licensed, which permits commercial use, modification and redistribution provided the copyright notice and permission notice are retained. That covers the CLI and the 17 house copies that ship inside the npm package. It does not automatically cover the 98 cataloged upstream skills, because those are installed from their own source repositories and carry whatever licence their authors chose. If you build a shared team library, the licences you need to check are the ones on the upstream skills you added, not the one on this tool. This is a description of the licence terms, not legal advice. On maintenance: the repository was last pushed on 2026-08-17 and is not archived, so it is active. The upgrade cost is low for the CLI itself, since npx always resolves the current published version, but the cost sits in the library. A workspace you built with init-library is a directory of generated files, and the README names skills.json, README.md and WORK_AREAS.md as things you should not hand-edit. That means upgrades go through the CLI, and a breaking change in the catalog format, like the marketing source rename, is something you resolve with a sync or a re-add rather than with a text editor. Budget for that rather than assuming the workspace is inert.
Editorial conclusion
Adopt ai-agent-skills if you want a small, hand-shelved library with visible provenance and you are willing to run the init-library, add and build-docs loop yourself. Skip it if you need one installer that covers the whole ecosystem, since the README explicitly points at skills.sh for that. Before committing, run npx ai-agent-skills install <skill> --list against a repo you care about and check where the default global target ~/.claude/skills/ lands on your machine.
Community notes