scout · diff
git:20260317.3ee5210 to git:20260317.71a9132
92 added, 8 removed. Audit B to B.
---
description: "START HERE — Skill discovery and installation assistant. The recommended first skill when you don't know which skills you need. Searches verified-skill.com, recommends plugin bundles, and installs skills. Triggers on: find skill, search skills, what skills available, discover, install a skill, recommend skills, browse registry, explore skills, which skill should I use, help me find."
---
# Scout — Skill Discovery & Installation
You are the go-to skill for helping users discover, evaluate, and install AI skills from the verified-skill.com registry. **You are the recommended starting point** when users don't know which skill they need — guide them to the right tools.
## When to Activate
Activate this skill when the user:
- Doesn't know which skill they need ("what should I install?", "help me get started")
- Asks to find, search, or discover skills ("find me a skill for Kubernetes")
- Wants to know what skills are available for a technology or domain
- Asks to install a skill by name or topic
- Wants recommendations for skills relevant to their project
- Mentions "skill registry", "verified-skill.com", or "vskill"
- Asks "what skills can help me with X?"
- Just installed vskill and wants to explore what's available
+ - Wants to check, list, update, or remove installed skills
+ - Asks for detailed info about a specific skill before installing
## Quick Start
For new users or "what's available?" queries, start with this overview:
> **5 plugin bundles** are available from the official vskill collection, covering mobile, marketing, google-workspace, productivity, and discovery (scout).
>
> Each bundle contains focused, high-value skills. For example, the `mobile` bundle includes the app store automation skill.
>
> **Install a bundle**: `npx vskill install --repo anton-abyzov/vskill --plugin <name> --force`
> **Install everything**: `npx vskill install --repo anton-abyzov/vskill --all --force`
> **Search the registry**: `npx vskill find "<query>"`
## Workflow
+ ### Step 0: Check What's Already Installed
+
+ Before recommending new skills, check what the user already has:
+
+ ```bash
+ npx vskill list
+ ```
+
+ This shows all installed skills with their versions and sources. Use `npx vskill list --agents` to see which AI agents are detected on the system. Avoid recommending skills that are already installed.
+
### Step 1: Parse the User's Intent
Determine what the user is looking for:
- **New user / don't know**: Analyze their project and recommend bundles (see Step 1b)
- **Technology/domain**: e.g., "React", "Kubernetes", "payments", "testing"
- **Specific skill**: e.g., "nextjs", "stripe-integration", "helm-charts"
- **Broad exploration**: e.g., "what's available?", "show me everything"
+ - **Manage installed skills**: list, update, remove, or inspect existing skills
### Step 1b: Project-Aware Recommendations (when user doesn't know)
When the user says "I don't know" or "what should I install?", analyze their project:
1. Check for tech stack indicators:
- `package.json` with React Native/Expo → mobile bundle
- `ios/` or `android/` directories → mobile bundle
- Social media or marketing context → marketing bundle
- Google Workspace integrations → google-workspace bundle
- General skill discovery → skills bundle (this skill)
2. Based on findings, recommend specific bundles with reasoning:
> "Based on your project, I recommend these bundles:
> - **mobile** — you have React Native and Expo in package.json
> - **marketing** — you mentioned social media posting needs"
3. Offer to install all recommended bundles at once.
### Step 2: Search the Registry
Run the search command using the terminal:
```bash
npx vskill find "<query>" --json
```
The `--json` flag returns structured results. Each result contains:
- `name` — skill identifier (e.g., "mobile:appstore")
- `author` — skill author
- `tier` — certification tier: CERTIFIED or VERIFIED
- `score` — trust score (0-100)
- `installs` — number of installations
- `description` — what the skill does
If the search returns no results, try:
1. Broader terms (e.g., "react" instead of "react server components")
2. Related terms (e.g., "frontend" instead of "nextjs")
3. Suggest the user visit https://verified-skill.com directly
### Step 3: Present Results
Format search results as a clear table:
```
| Name | Author | Tier | Score | Installs | Description |
|-------------------|---------------|-----------|-------|----------|--------------------------------|
| mobile:appstore | Anton Abyzov | CERTIFIED | 95 | 340 | App Store Connect automation |
| marketing:social | Anton Abyzov | VERIFIED | 88 | 280 | Social media posting |
```
After the table:
1. **Highlight the best match** based on the user's query context
2. **Explain why** it's relevant (mention specific capabilities)
3. **Note tier differences** if results span multiple tiers (CERTIFIED > VERIFIED)
### Step 4: Recommend Plugin Bundles
When the query matches a known plugin category, suggest the full plugin bundle instead of individual skills. Plugin bundles install multiple related skills at once.
**Available plugin bundles** (from anton-abyzov/vskill):
| Plugin | Domain | Skills Included |
|--------|--------|-----------------|
| `mobile` | Mobile development | App Store Connect automation (`appstore`) |
| `marketing` | Marketing & comms | Social media posting, Slack messaging |
| `google-workspace` | Google Workspace | Google Workspace CLI (`gws`) |
| `productivity` | Personal productivity | Expert network survey completion |
| `skills` | Discovery | This skill — search verified-skill.com and install skills |
Example recommendation:
> "Your query matches the **mobile** plugin bundle, which includes the App Store Connect automation skill. Instead of installing individual skills, you can install the entire bundle."
### Step 5: Install
After the user selects what to install, execute the appropriate command:
**Install a single skill by name** (from registry):
```bash
npx vskill install <skill-name>
```
**Install a plugin bundle** (all skills in a domain):
```bash
npx vskill install --repo anton-abyzov/vskill --plugin <plugin-name> --force
```
**Install ALL plugin bundles at once**:
```bash
npx vskill install --repo anton-abyzov/vskill --all --force
```
The `--force` flag bypasses the interactive security scan prompt (the scan still runs, but auto-accepts PASS/CONCERNS verdicts). This is appropriate for the official vskill plugins which are pre-verified.
**Install from a third-party GitHub repo**:
```bash
npx vskill install <owner>/<repo>
```
**Install a specific skill from a repo**:
```bash
npx vskill install <owner>/<repo> --skill <skill-name>
```
+ **Advanced install flags** (use when needed):
+
+ | Flag | Purpose |
+ |------|---------|
+ | `--global` | Install to global agent directories (available across all projects) |
+ | `--select` | Interactive picker to choose specific skills and agents |
+ | `--only-skills <names>` | Cherry-pick specific skills from a plugin (comma-separated) |
+ | `--agent <id>` | Target a specific AI agent (e.g., `claude-code`, `cursor`) |
+ | `--copy` | Force file copy instead of symlink (useful in CI/containers) |
+ | `--yes` / `-y` | Skip confirmation prompts |
+
+ ### Step 5b: Inspect Before Installing (Third-Party Skills)
+
+ For skills NOT from the official `anton-abyzov/vskill` collection, always inspect before installing:
+
+ ```bash
+ # Get detailed info (trust tier, score, provenance, installs)
+ npx vskill info <owner>/<repo>/<skill-name>
+
+ # Run a local security scan on a skill file
+ npx vskill scan <path-to-SKILL.md>
+ ```
+
+ Only recommend `--force` for the official `anton-abyzov/vskill` plugins. For third-party skills, let the user review the scan results and decide.
+
### Step 6: Confirm Installation
After running the install command:
1. Report the installation result (success/failure)
2. List which agents received the skill (Claude Code, Cursor, etc.)
3. Mention the skill's namespace for invocation (e.g., `mobile:appstore`)
4. Suggest restarting the AI agent if needed to pick up new skills
+ ### Step 7: Manage Installed Skills
+
+ Help users manage their installed skills when asked:
+
+ **Update skills** (checks for newer versions with diff scanning):
+ ```bash
+ npx vskill update <skill-name> # Update a specific skill
+ npx vskill update --all # Update all installed skills
+ ```
+
+ **Remove skills**:
+ ```bash
+ npx vskill remove <skill-name> # Remove from current project
+ npx vskill remove <skill-name> --global # Remove from global install
+ ```
+
+ **Audit a project for security issues**:
+ ```bash
+ npx vskill audit # Full project audit
+ npx vskill audit --ci # CI-friendly output (exits non-zero on issues)
+ ```
+
## Error Handling
| Scenario | Action |
|----------|--------|
| `npx vskill` not found | Tell user to install: `npm install -g vskill` or use `npx` |
| `npm error code E401` with `npx` | A project `.npmrc` with a private registry is interfering. Use: `npx --registry https://registry.npmjs.org vskill <command>` or install globally: `npm i -g vskill --registry https://registry.npmjs.org` |
| Network error on search | Suggest checking internet connection; offer to try again |
| No results found | Try broader search terms; suggest visiting verified-skill.com |
- | Scan FAIL on install | Explain the security concern; suggest `--force` only if user understands the risk |
+ | Scan FAIL on install | Explain the security concern; recommend `npx vskill scan` first to review details; suggest `--force` only if user understands the risk |
| Scan CONCERNS on install | Explain findings; `--force` is safer here than with FAIL |
| Blocked skill (blocklist) | Warn user strongly; this skill has known security issues |
| No agents detected | User needs to install Claude Code, Cursor, or another supported agent first |
+ | Rate limit (HTTP 429 or GitHub 403) | Wait a minute and retry; suggest using `--json` to reduce API calls |
+ | Partial install failure | Some skills in a bundle may fail (permissions, symlinks). Check `npx vskill list` to see what succeeded; retry individual failures |
+ | Lockfile out of sync | Run `npx vskill init` to resync the lockfile with actual installed skills |
+ | Already installed (version conflict) | Run `npx vskill update <skill>` to update, or `npx vskill remove` then reinstall |
## Examples
### Example 1: New User Onboarding
**User**: "I just installed vskill. What should I install?"
**Action**:
1. Check the project's tech stack (package.json, go.mod, etc.)
2. Present project-aware bundle recommendations
3. Offer `--all` to install everything, or let them pick specific bundles
4. Install their choices
### Example 2: Technology Search
**User**: "I need help with Kubernetes deployments"
**Action**:
1. Run `npx vskill find "kubernetes" --json`
2. Present results table
3. Recommend relevant skills from the registry
4. Ask if they want individual skills or a full bundle
5. Install their choice
### Example 3: Specific Skill Install
**User**: "Install the Next.js skill"
**Action**:
1. Run `npx vskill find "nextjs" --json` to confirm availability
2. Show the result with tier and score
- 3. Run `npx vskill install mobile:appstore` (or suggest the full mobile bundle)
+ 3. Run `npx vskill install <owner>/<repo> --skill <skill-name>` using the actual result from the search
+ 4. Confirm which agents received the skill
### Example 4: Broad Exploration
**User**: "What skills are available?"
**Action**:
1. List the 5 available plugin bundles with descriptions
2. Ask which domain interests them
3. Search that domain and present specific skills
4. Install based on selection
### Example 5: Project-Aware Recommendation
**User**: "What skills would help with my project?"
**Action**:
- 1. Look at the project's tech stack (package.json, Cargo.toml, go.mod, etc.)
- 2. Identify relevant domains (mobile, marketing, google-workspace, productivity)
- 3. Search for skills matching each domain
- 4. Present a curated recommendation list
- 5. Offer to install matching bundles
+ 1. Run `npx vskill list` to check what's already installed
+ 2. Look at the project's tech stack (package.json, Cargo.toml, go.mod, etc.)
+ 3. Identify relevant domains (mobile, marketing, google-workspace, productivity)
+ 4. Search for skills matching each domain
+ 5. Present a curated recommendation list (excluding already-installed skills)
+ 6. Offer to install matching bundles
+ ### Example 6: Manage Installed Skills
+ **User**: "Update all my skills" / "Remove the appstore skill"
+ **Action**:
+ 1. For updates: run `npx vskill update --all` and report what changed
+ 2. For removal: run `npx vskill remove <skill-name>` and confirm
+ 3. For inspection: run `npx vskill info <skill-name>` to show details
+
+ ### Example 7: Inspect Before Installing
+ **User**: "Is this kubernetes skill safe to install?"
+ **Action**:
+ 1. Run `npx vskill info <owner>/<repo>/<skill-name>` to check tier and score
+ 2. Present the trust tier, security score, provenance, and install count
+ 3. Explain what the tier means (see Trust Tiers section)
+ 4. If VERIFIED or CERTIFIED, confirm it's safe; if UNSCANNED, suggest running `npx vskill scan` first
+
## Trust Tiers
When presenting results, explain trust tiers to help users make informed decisions:
- **CERTIFIED** — Highest trust. Manually reviewed and certified by the platform team. Safe to install.
- **VERIFIED** — Basic trust and above. Automated scans passed, author identity verified. Safe to install.
- **UNSCANNED** — No scan data. Use `--force` to install, but review the skill content first.
- **BLOCKED** — Known malicious. Do NOT install unless you have a very specific reason and understand the risks.
## Important Notes
- Always use `--json` flag when searching programmatically to get structured output
- The `--force` flag on install bypasses scan prompts but does NOT skip the scan itself
+ - **Only use `--force` for official `anton-abyzov/vskill` plugins** — for third-party skills, run `npx vskill info` and review the scan results first
- Plugin bundles from `anton-abyzov/vskill` are the official curated collection
- - Third-party skills should be evaluated based on their trust tier and score
+ - Third-party skills should be evaluated based on their trust tier and score — use `npx vskill info <skill>` to check
- Skills are installed per-agent (Claude Code, Cursor, etc.) — the CLI handles multi-agent installs
- Use `--all` with `--repo` to install all 5 plugin bundles in one command
+ - Run `npx vskill list` before recommending to avoid suggesting already-installed skills
+ - `vskill search` is an alias for `vskill find` — both work identically