skillapt / 1-minute brief · 5-minute deep dive
A Secure Package Manager for AI Agent Skills
skillapt is a package manager for AI agent skills (SKILL.md plus helper files). It lets you install skills from a registry or straight from GitHub, lock them, verify their integrity, and sync them into Claude, Cursor, Codex and Antigravity.
A secure package manager for AI agent skills.
skillapt installs, locks, verifies, packs and publishes AI agent skills for Claude, Cursor, Codex and Antigravity, from a registry or straight from GitHub.
Reproducible installs
A skills.json manifest and skills.lock.json lockfile, with install --frozen for CI and GitHub sources pinned to a commit SHA.
Inspect the decision ↗02Immutable releases on a free tier
Hono on Cloudflare Workers with D1 and R2, where republishing a version returns 409 and yanked versions stay downloadable for lockfiles.
Inspect the decision ↗03Treat every skill as untrusted
SHA-256 verification before extraction, strict archive limits, no symlinks and no lifecycle scripts, ever.
Inspect the decision ↗- Author & packskillapt init, skillapt pack
- PublishRegistry stores an immutable release
- Install & lockSHA-256 checked, lockfile written
- SyncClaude, Cursor, Codex, Antigravity
Registry and GitHub sources share the same install, lock and verify path.
Security checks & verification +
Archives are limited to 5 MB compressed, 25 MB uncompressed and 500 files. Paths are normalized and checked, file types are allow-listed, and API tokens are stored only as hashes.
- Integrity verified before extraction
- SHA-256 digests come from registry metadata and are re-checked from the lockfile on every install.
- Strict archive handling
- Symlinks, hardlinks, devices, absolute paths and .. segments are rejected, and gzip decompression is capped.
- Safe authentication
- GitHub OAuth with HTTP-only cookies and CSRF checks for the dashboard, and hashed apt_live_ tokens that expire after 90 days for the CLI.
All three repositories are built and tested. No public registry is hosted yet, so the portal runs in demo mode and the registry is self-hostable on Cloudflare's free tier.
The starting point
AI agent skills, a SKILL.md file plus helper files, are effectively prompts and code that an agent trusts. Today they are usually copy-pasted from random repositories, which gives you no versioning, no integrity check and no review step.
skillapt is a package manager built for that gap. It installs skills from a registry or from any public GitHub repository, records them in a manifest and a lockfile, verifies them before extraction, and syncs them into the skill directories of Claude, Cursor, Codex and Antigravity.
The project is three repositories that work together: the skillapt CLI, the skillapt-registry API and the skillapt-web portal. I wanted to see one idea through the whole stack, from a terminal command to a database row to a web page.
I built all three parts: the TypeScript CLI, the registry API on Cloudflare Workers, and the React web portal, including the archive validation, lockfile and token-security design.
01 / Node.js 22 · TypeScript · commander
A package manager for agent skills.
Makes skill installs reproducible with a manifest and a lockfile instead of copy-pasting from repositories.
The CLI scaffolds skills with init, resolves registry names or GitHub sources, writes skills.json and skills.lock.json, supports install --frozen for CI, and syncs installed skills into the skill directories of Claude, Cursor, Codex and Antigravity.
The CLI covers the full lifecycle with fourteen commands: init, install, search, info, outdated, update, list, remove, login, logout, pack, publish, yank and doctor.
Installs are reproducible. skills.json declares what a project wants, skills.lock.json records exactly what was resolved, and install --frozen refuses to drift, which is what a CI pipeline needs.
GitHub sources are pinned to a resolved commit SHA in the lockfile, so a branch moving later cannot silently change what gets installed. Skills can then be synced into an agent's directory with the --target flag.
02 / Cloudflare Workers · Hono · D1 · R2
A registry that runs on the free tier.
Stores and serves skill packages as immutable releases without any paid infrastructure.
The registry is a Hono application on Cloudflare Workers with D1 for metadata, R2 for create-only .tgz archives, a Durable Object rate limiter and a daily cleanup cron. Republishing an existing version returns 409.
The registry is built to cost nothing to host. A Hono app runs on Cloudflare Workers, D1 holds metadata, users, tokens and the audit log, and R2 holds the immutable .tgz archives.
Releases are immutable by design. R2 writes are create-only and metadata is written in one atomic batch, so republishing a version returns 409 instead of replacing it. Owners can yank a bad version, which hides it from version ranges but keeps it downloadable for existing lockfiles.
A Durable Object provides sliding-window rate limits, and a daily cron trigger cleans up. A read-only maintenance mode and a runbook cover operations.
03 / React 19 · React Router 7 · Vite · Tailwind CSS v4
A portal for discovering skills.
Lets people search, filter and inspect skills before installing them.
The React portal offers fuzzy search with a command palette, category and compatibility filters, skill pages with install commands and version history, and docs rendered from markdown. With no registry configured it runs entirely on bundled sample data.
The portal is a fast static site. It has fuzzy search with a Ctrl+K command palette, category and compatibility filters, sorting, pagination and URL-synced filters.
Each skill page renders its README as GitHub-flavored markdown without raw HTML, shows the install command, the version history with yank status and a security summary, and includes an abuse-report form.
Documentation lives as markdown files in the repository and is rendered at /docs. Light and dark themes load without a flash of the wrong theme, and automated axe-core checks run against every route in both themes.
04 / SHA-256 · zod · Archive Validation · CSP
Security at every layer.
Treats every skill as untrusted input and makes tampering detectable.
Archives are checked against strict limits, symlinks, devices and path traversal are rejected, lifecycle scripts never run, integrity digests are re-checked from the lockfile, and the portal ships a strict Content-Security-Policy with no third-party requests.
The threat model starts from the assumption that a skill is hostile. SHA-256 digests are verified before extraction, archives have strict size and file-count limits, and symlinks, hardlinks, devices, absolute paths and .. segments are rejected.
Lifecycle scripts never run, gzip decompression is capped to defend against decompression bombs, and declared permissions such as network, shell and filesystem are shown and need confirmation when elevated.
Registry responses are validated with zod, redirects are HTTPS-only and drop the token when the origin changes, and the web portal uses a strict Content-Security-Policy where script-src is self and fonts are self-hosted.
05 / GitHub OAuth · API Tokens · Dashboard
Publishing and token management.
Gives publishers a safe way to ship, yank and restore versions.
Packages are created with pack and shipped with publish. GitHub OAuth protects the dashboard, where publishers view their skills, yank or restore versions, and create CLI tokens that are shown once and stored only as hashes.
A publisher scaffolds a skill with init, creates an archive with pack and ships it with publish. Unscoped names are first-come, while @scope/name packages are tied to the owning GitHub account.
The dashboard signs in with GitHub OAuth using HTTP-only, Secure, SameSite cookies and CSRF checks. Publishers can yank and restore versions and create or revoke CLI tokens.
Tokens look like apt_live_..., expire after 90 days by default, are shown once, and only their SHA-256 hash is stored.
A closer look
How the three repositories fit together
The CLI talks to the registry over HTTPS under /v1 with a bearer token. The web portal reads the same API through a CORS allowlist, and the build writes the registry URL into the portal's Content-Security-Policy so the browser can call only that one origin.
- skillapt: the CLI, distributed through npm and requiring Node.js 22.12 or newer.
- skillapt-registry: the registry API on Cloudflare Workers, D1 and R2.
- skillapt-web: the React portal and documentation, deployed as static assets.
Registry versus GitHub sources
A registry install uses name@range, supports SemVer ranges, yanking and dependencies, and checks the SHA-256 from registry metadata. A GitHub install uses owner/repo/subpath@ref, needs no registry at all, and pins to a commit SHA.
Content rule violations are errors for registry packages and warnings for GitHub sources, where a strict flag turns them into errors.
What I take from it.
Building skillapt taught me how much of a package manager is really about trust: integrity checks, immutable releases, safe archive handling and careful token storage matter more than the install command itself.
It also gave me practice shipping one product across a CLI, an edge API and a web frontend, with tests and CI in each repository.
All three repositories are built and tested. No public hosted registry is running yet: the portal runs in demo mode on bundled sample skills, and the registry is self-hostable on Cloudflare's free tier.