A CLI and MCP server that manages a hardened library of skills for AI coding agents, using static analysis and human-curated prompts to mitigate supply-chain vulnerabilities. It downloads instructions and templates from a CDN to configure local agents, but requires a compatible external AI agent to utilize the installed skills.
Project overview
Addresses documented security vulnerabilities in marketplace skills by applying static analysis, path isolation, and lockfile-based integrity checks during skill installation.
Project type
AI Coding
Use cases
Coding & Development
Deployment
Refer to project documentation
License
License pending
Best for
Developers seeking to provision human-curated instructions and templates to coding agents while enforcing path isolation and lockfile integrity during local installation.
Key capabilities
An interactive CLI wizard to browse, filter by category, search, select, and install skills to specific target agents.
Manage skills via CLI including listing available skills, installing one or multiple skills, updating, and removing them.
CLI uses sanitization, path isolation, symlink guards, atomic lockfile, and audit trails to ensure safe skill installation.
Downloads and caches skills locally in ~/.cache/agent-skills/ for offline reuse and fast installation.
Provides an audit trail to view recent CLI operations and cache locations.
An MCP server exposing the skills catalog to AI agents via progressive disclosure using list, search, read, and fetch tools.
Limitations and risks
Requires Node.js version 22 or higher.
Ships instructions and templates rather than runnable code binaries.
Despite safety measures, relies on downloading community/third-party skills which may carry IP or security concerns.
Getting started
Run `npx @tech-leads-club/agent-skills` using Node.js version 22 or higher, then follow the interactive wizard prompts to select agents and finish setup.