find-skills · diff
git:20260918.673b322 to git:20260922.d760929
6 added, 4 removed. Audit A to A.
---
name: find-skills
- description: "Find and install a skill from the open registry. Use when a job needs a method you don't have yet."
+ description: "Find and install a skill from the open registry. Reach for it when a job needs a written method that is not on your Skills list."
---
# Find skills
`npx skills` is the package manager for the open skill registry
(https://skills.sh). Search it, install what this job needs, and use it.
## In this app
Everything the app has to say about installing skills is here; the prompts do
not repeat it.
**Where you run it decides who gets it.** `add` installs into `.agents/skills/`
under the folder it is run from, and the app reads that folder in two places:
- **Your own folder** (the Environment names it) — the skill is yours alone. The
default: a method this job needs is rarely one every bot should carry.
```bash
(cd <your own folder> && npx skills add <owner>/<repo>@<skill> -y)
```
- **The workspace root**, where your shell starts — every bot and the call get it.
Only when the user asked for that.
```bash
npx skills add <owner>/<repo>@<skill> -y
```
Never `-g`. That installs to the machine's own user directory, where this app
never looks — the command reports success and the skill is nowhere.
**Load it as soon as it is installed.** `load_skill` with the installed name
finds it on disk, though your Skills list was read before the install; the list
shows it from the next run.
**Install it, do not offer it.** The user is not at this screen; you are inside
a job someone else is holding. Pick one, install it, use it, and name it in
your report. Go back to them only when nothing fits and the job is stuck
without it.
## Finding one
```bash
npx skills find <query> # search the registry
npx skills find <query> --owner vercel-labs
npx skills add <owner>/<repo> -l # list what a repo holds, install nothing
npx skills list # what is already installed
```
Search the domain and the task together — `react performance`, `pr review`,
`invoice pdf` — not one broad word. Nothing found is an answer: say so and do
the job with what you have.
## Judge it before you install
An installed skill runs with your permissions, and nothing in the registry is
reviewed by anyone.
- **Who published it.** The vendors on https://skills.sh/official publish their
own tools — `anthropics`, `vercel-labs`, `microsoft` and the rest. An unknown
- owner with a handful of installs is a stranger's shell script.
- - **How many installs.** Thousands means it has been run by other people.
- Under a hundred means you are the one testing it.
+ owner is a stranger's shell script until its repository says otherwise.
+ - **Its repository, not its install count.** Open the GitHub repository the
+ registry names: the stars, the last commit, and what `SKILL.md` and its scripts
+ actually do. A count of installs says only that it was fetched — one skill had
+ half a million installs and five stars.
- **What it needs to work.** Most vendor skills wrap that vendor's CLI and want
an API key. Read its SKILL.md before you build a plan on top of it — a skill
you cannot authenticate is no use in this job.
Writing one instead of installing one is the `skill-creator` skill, and it is
worth the steps only when the user asked for a skill.