find-skills git:20260918.673b322A

Immutable. This exact content is served forever at /api/v1/blob/3ea4207bc0ce0be6.

---
name: find-skills
description: "Find and install a skill from the open registry. Use when a job needs a method you don't have yet."
---

# Find skills

`npx skills` is the package manager for the open skill registry
(https://skills.sh). Search it, install what this job needs, and use it.

## In this app

Everything the app has to say about installing skills is here; the prompts do
not repeat it.

**Where you run it decides who gets it.** `add` installs into `.agents/skills/`
under the folder it is run from, and the app reads that folder in two places:

- **Your own folder** (the Environment names it) — the skill is yours alone. The
  default: a method this job needs is rarely one every bot should carry.

  ```bash
  (cd <your own folder> && npx skills add <owner>/<repo>@<skill> -y)
  ```

- **The workspace root**, where your shell starts — every bot and the call get it.
  Only when the user asked for that.

  ```bash
  npx skills add <owner>/<repo>@<skill> -y
  ```

Never `-g`. That installs to the machine's own user directory, where this app
never looks — the command reports success and the skill is nowhere.

**Load it as soon as it is installed.** `load_skill` with the installed name
finds it on disk, though your Skills list was read before the install; the list
shows it from the next run.

**Install it, do not offer it.** The user is not at this screen; you are inside
a job someone else is holding. Pick one, install it, use it, and name it in
your report. Go back to them only when nothing fits and the job is stuck
without it.

## Finding one

```bash
npx skills find <query>              # search the registry
npx skills find <query> --owner vercel-labs
npx skills add <owner>/<repo> -l     # list what a repo holds, install nothing
npx skills list                      # what is already installed
```

Search the domain and the task together — `react performance`, `pr review`,
`invoice pdf` — not one broad word. Nothing found is an answer: say so and do
the job with what you have.

## Judge it before you install

An installed skill runs with your permissions, and nothing in the registry is
reviewed by anyone.

- **Who published it.** The vendors on https://skills.sh/official publish their
  own tools — `anthropics`, `vercel-labs`, `microsoft` and the rest. An unknown
  owner with a handful of installs is a stranger's shell script.
- **How many installs.** Thousands means it has been run by other people.
  Under a hundred means you are the one testing it.
- **What it needs to work.** Most vendor skills wrap that vendor's CLI and want
  an API key. Read its SKILL.md before you build a plan on top of it — a skill
  you cannot authenticate is no use in this job.

Writing one instead of installing one is the `skill-creator` skill, and it is
worth the steps only when the user asked for a skill.