| name | universal-skills-manager |
| description | The master coordinator for AI skills. Discovers skills from multiple sources (SkillsMP.com, SkillHub, and ClawHub), manages installation, and synchronization across Claude Code, Gemini CLI, Google Anti-Gravity, OpenCode, and other AI tools. Handles User-level (Global) and Project-level (Local) scopes. |
| compatibility | Requires python3, curl, and network access to skillsmp.com, skills.palebluedot.live, clawhub.ai, and github.com |
| metadata | {"homepage":"https://github.com/jacob-bd/universal-skills-manager","disable-model-invocation":"true","requires-bins":"python3, curl","primaryEnv":"SKILLSMP_API_KEY"} |
Universal Skills Manager
This skill empowers the agent to act as a centralized skill manager for AI capabilities. It discovers skills from multiple sources — SkillsMP.com (curated, AI semantic search), SkillHub (community skills, no API key required), and ClawHub (versioned skills, semantic search, no API key required) — and unifies skill management across multiple AI tools (Claude Code, Gemini, Anti-Gravity, OpenCode, Cline, Cursor, etc.), ensuring consistency and synchronization.
When to Use This Skill
Activate this skill when the user:
- Wants to find or search for new skills.
- Wants to install a skill (from a search result or local file).
- Wants to sync skills between different AI tools (e.g., "Copy this Gemini skill to OpenCode").
- Asks to move or copy skills between scopes (User vs. Project).
- Mentions "Google Anti-Gravity", "OpenCode", or "Gemini" in the context of skills/extensions.
- Wants to package a skill for claude.ai, Claude Desktop, or ChatGPT (ZIP upload).
Supported Ecosystem
This skill manages the following tools and scopes. Always verify these paths exist before acting.
| Tool | User Scope (Global) | Project Scope (Local) |
|---|
| Gemini CLI | ~/.gemini/skills/ | ./.gemini/skills/ |
| Google Anti-Gravity | ~/.gemini/antigravity/skills/ | ./.antigravity/extensions/ |
| OpenCode | ~/.config/opencode/skills/ | ./.opencode/skills/ |
| OpenClaw | ~/.openclaw/workspace/skills/ | ./.openclaw/skills/ |
| Claude Code | ~/.claude/skills/ | ./.claude/skills/ |
| OpenAI Codex | ~/.codex/skills/ | ./.codex/skills/ |
| block/goose | ~/.config/goose/skills/ | ./.goose/agents/ |
| Roo Code | ~/.roo/skills/ | ./.roo/skills/ |
| Cursor | ~/.cursor/skills/ | ./.cursor/skills/ |
| Cline | ~/.cline/skills/ | ./.cline/skills/ |
Cloud Platforms (ZIP Upload Required):
| Platform | Installation Method |
|---|
| claude.ai | Upload ZIP via Settings → Capabilities → Upload Skill |
| Claude Desktop | Upload ZIP via Settings → Capabilities → Upload Skill |
| ChatGPT | Upload ZIP via Profile → Skills → New skill → Upload from your computer |
Note: claude.ai, Claude Desktop, and ChatGPT don't have access to local environment variables. Use the "Package for Cloud Upload" capability (Section 5) to create a ZIP. Embedding an API key is optional — SkillHub and ClawHub search work without one. If you do include a key, do NOT share the ZIP publicly (see Section 5 for credential safety guidance).
ChatGPT Skills are currently in beta and available on Business, Enterprise, Edu, Teachers, and Healthcare plans. Skills are off by default for Enterprise/Edu — workspace admins must enable them in Permissions & roles.
IMPORTANT - Universal Skills Manager Platform Limitations:
This skill (Universal Skills Manager) requires network access to call the SkillsMP API, SkillHub API, ClawHub API, and GitHub. Handle these scenarios:
-
If user asks to package/ZIP the Universal Skills Manager itself for claude.ai or ChatGPT:
Tell the user: "The Universal Skills Manager won't work on claude.ai or ChatGPT because it requires network access to call the SkillsMP API, SkillHub API, ClawHub API, and GitHub APIs. These platforms' code execution environments don't allow outbound network requests. However, I can package OTHER skills for cloud upload - those will work as long as they don't require network access."
-
If user wants to try the Universal Skills Manager on Claude Desktop:
Tell the user: "Claude Desktop has network access capabilities, but there is a known bug where custom domains added to the 'Additional allowed domains' setting are not included in the network egress JWT token. This means the skill cannot reach the required APIs even after whitelisting them.
Required domains (for when the bug is fixed):
skillsmp.com (for SkillsMP skill searches)skills.palebluedot.live (for SkillHub skill searches)clawhub.ai (for ClawHub skill searches and direct file downloads)api.github.com and raw.githubusercontent.com (for skill downloads from GitHub)
Workaround: Use Claude Code CLI instead, which has unrestricted network access and works with all three skill sources. You can install via: curl -fsSL https://raw.githubusercontent.com/jacob-bd/universal-skills-manager/main/install.sh | sh -s -- --tools claude"
(Note: If a tool uses a different directory structure, ask the user to confirm the path, then note it for future reference.)
Core Capabilities
1. Smart Installation & Synchronization
Trigger: User asks to install a skill (e.g., "Install the debugging skill" or "Install skill ID xyz").
Procedure:
-
Identify Source:
- If from SkillsMP search result: Use the
githubUrl from the API response
- If from SkillHub search result: Fetch skill details via
/api/skills/{id} to get skillPath and branch, then construct GitHub tree URL
- If from ClawHub search result: Use the
slug to fetch content via ClawHub's /file endpoint (see Section C below)
- If from skill name/ID: Search available sources (SkillsMP, SkillHub, and/or ClawHub) to find the skill
- If local: Identify the source path
-
Verify Repository Structure (CRITICAL):
- Before downloading, browse the GitHub repo to confirm the skill folder location
- Use GitHub API to list directory contents:
GET /repos/{owner}/{repo}/contents?ref={branch}
- Look for folders containing
SKILL.md - this is the actual skill directory
- Common patterns:
skill/, skills/{name}/, root level, or custom folder names
- Confirm the correct path before generating the download URL
-
Download Using Helper Script:
- Use
install_skill.py (located in this skill's scripts/ folder):
python3 ~/.claude/skills/universal-skills-manager/scripts/install_skill.py \
--url "https://github.com/{owner}/{repo}/tree/{branch}/{skill-folder}" \
--dest "{target-path}" \
--dry-run
- The script handles: atomic install, validation, subdirectories, safety checks
- Safety feature: Script will abort (exit code 4) if destination is a root skills directory
- Update detection: If skill exists, shows diff and prompts for confirmation
- Security scan: The install script automatically scans downloaded skills for security threats (invisible characters, data exfiltration, prompt injection). Review any findings before proceeding.
-
Determine Primary Target:
- Ask: "Should this be installed Globally (User) or Locally (Project)?"
- Determine the primary tool (e.g., if user is in Claude Code, Claude is primary)
- If the user specifies claude.ai, Claude Desktop, or ChatGPT as the target, go to Step 4a instead of Step 5.
4a. Cloud Platform Target Flow (claude.ai / Claude Desktop / ChatGPT):
If the user wants the skill for claude.ai, Claude Desktop, or ChatGPT:
- Validate frontmatter by running
validate_frontmatter.py against the downloaded SKILL.md:
python3 scripts/validate_frontmatter.py /path/to/downloaded/SKILL.md
- If the skill passes validation, package it as a ZIP and provide upload instructions (see Step 6a below).
- If the skill fails validation, notify the user with the exact issues before doing anything:
"This skill isn't formatted correctly for cloud upload. I found these issues:
- [list each issue from the validator, e.g., 'Unsupported top-level key: version', 'Description uses a YAML block scalar']
I can fix these automatically — unsupported keys will be moved into metadata, block scalars will be converted to inline strings, etc. The skill's functionality won't change.
Would you like me to fix it and package it?"
- If the user agrees: Run the fix and re-validate:
python3 scripts/validate_frontmatter.py /path/to/downloaded/SKILL.md --fix
Then package as ZIP (Step 6a).
- If the user declines: Skip cloud packaging. Offer to install the skill as-is to other locally detected tools instead.
6a. Package and deliver ZIP:
- Create a ZIP containing the skill folder (with fixed SKILL.md if applicable)
- Provide upload instructions based on the target platform:
For claude.ai / Claude Desktop:
"Your skill is packaged and ready. To install:
- Go to Settings → Capabilities
- Click 'Upload skill' in the Skills section
- Select the ZIP file and upload"
For ChatGPT:
"Your skill is packaged and ready. To install:
- Click your profile icon and select Skills (or go to chatgpt.com/skills)
- Click 'New skill'
- Select 'Upload from your computer'
- Select the ZIP file and upload"
- Continue to Step 5 to offer syncing to other local tools as well.
-
The "Sync Check" (CRITICAL):
- Scan: Check if other supported tools are installed on the system (look for their config folders)
- Propose: "I see you also have OpenCode and Cursor installed. Do you want to sync this skill to them as well?"
-
Execute:
- For each target location, ensure the parent directory exists:
mkdir -p {target-skills-dir}
- Run the install script for each target location
- Ensure the standard structure is maintained
-
Report Success:
- Show installed skill name, author, and location(s)
- Display GitHub URL and stars count for reference
2. The "Updates & Consistency" Check
Trigger: User modifies a skill or asks to "sync" skills.
Procedure:
- Compare: Check the modification times or content of the skill across all installed locations.
- Report: "The 'code-review' skill in Gemini is newer than the one in OpenCode."
- Action: Offer to overwrite older versions with the newer version to ensure consistency.
3. Skill Discovery (Multi-Source)
Trigger: User searches for skills (e.g., "Find a debugging skill" or "Search for React skills").
Procedure:
-
Discover API Key and Select Source:
-
Step 1 - Environment Variable: Check $SKILLSMP_API_KEY
printenv SKILLSMP_API_KEY
If set and non-empty, use SkillsMP as the primary search source.
Note: Use printenv (not echo $VAR) — it queries the process environment directly and is more reliable across shell contexts.
-
Step 2 - Config File: Check for config.json in this skill's directory
cat ~/.claude/skills/universal-skills-manager/config.json 2>/dev/null
If skillsmp_api_key field has a non-empty value, use SkillsMP as primary source.
-
Step 3 - Source Selection: If no API key found, present the user with a choice:
"I don't see a SkillsMP API key configured. You have three options:
A) Provide your SkillsMP API key (get one at skillsmp.com) — curated skills with AI semantic search
B) Search SkillHub's open catalog — community skills, no API key needed
C) Search ClawHub — versioned skills with semantic search, no API key needed
Which would you prefer?"
- If user chooses A: Collect key, validate it (see below), store in memory for this session, proceed with SkillsMP
- If user chooses B: Proceed with SkillHub search (no key needed)
- If user chooses C: Proceed with ClawHub search (no key needed)
-
Key Validation: SkillsMP API keys always start with sk_live_skillsmp_. If the user provides a key that does not match this prefix, reject it immediately:
"That doesn't look like a valid SkillsMP API key. Keys start with sk_live_skillsmp_. You can get one at https://skillsmp.com — or choose SkillHub/ClawHub search instead (no key needed)."
-
Security: Never log, display, or echo the full API key value.
Note for claude.ai/Desktop/ChatGPT users: Environment variables are not available. Use the "Package for Cloud Upload" capability (Section 5) to create a ZIP with your API key embedded, or provide your key when prompted.
-
Execute Search Based on Selected Source:
If using SkillsMP (primary, curated):
If using SkillHub (open catalog, no auth):
If using ClawHub (versioned skills, semantic search, no auth):
-
Display Results (Unified Format):
Display results in a consistent table format regardless of source. Include the Source column to indicate origin:
| # | Skill | Author | Stars | Source | Description |
|---|-------|--------|-------|--------|-------------|
| 1 | debugging-strategies | wshobson | 27,021 | SkillHub | Master systematic debugging... |
| 2 | code-debugging | AuthorX | 15 | SkillsMP | Systematic debugging methodology... |
| 3 | self-improving-agent | clawhub-user | 42 | ClawHub | Agent that improves itself... |
- For SkillsMP AI search: Also show relevance score
- For SkillHub: Show
securityScore if available
- For ClawHub semantic search: Show similarity
score if available
- Limit to top 10-15 results for readability
-
Search More Sources:
After displaying results from any source, offer to search the remaining unsearched sources:
- If 2 sources remain: "Want to also search {source1} or {source2}? Or both?"
- If 1 source remains: "Want to also search {source}?"
Available sources: SkillsMP (requires API key), SkillHub (no key), ClawHub (no key)
If yes:
- Query the selected source(s) with the same search terms
- Deduplicate: Compare results across sources:
- SkillsMP ↔ SkillHub: By full skill ID (
{owner}/{repo}/{path})
- ClawHub ↔ others: By skill name (ClawHub uses slugs, not GitHub paths)
- Append unique results to the display, labeled with their source tag
-
Offer Installation:
- After displaying results, ask: "Which skill would you like to install?"
- For SkillsMP results: Note the skill's
githubUrl for content fetching
- For SkillHub results: Note the skill's
id for detail fetching (needed to get skillPath and branch)
- For ClawHub results: Note the skill's
slug for direct file fetching via ClawHub's /file endpoint
4. Skill Matrix Report
Trigger: User asks for skill report/overview (e.g., "Show my skills", "What skills do I have?", "Skill report", "Compare my tools").
Procedure:
-
Detect Installed Tools:
Check which AI tools are installed by verifying their user-level skills directories exist:
ls -d ~/.claude/skills 2>/dev/null && echo "Claude: ✓"
ls -d ~/.codex/skills 2>/dev/null && echo "Codex: ✓"
ls -d ~/.gemini/skills 2>/dev/null && echo "Gemini: ✓"
ls -d ~/.gemini/antigravity/skills 2>/dev/null && echo "Antigravity: ✓"
ls -d ~/.openclaw/workspace/skills 2>/dev/null && echo "OpenClaw: ✓"
ls -d ~/.cursor/skills 2>/dev/null && echo "Cursor: ✓"
ls -d ~/.config/opencode/skills 2>/dev/null && echo "OpenCode: ✓"
ls -d ~/.roo/skills 2>/dev/null && echo "Roo: ✓"
ls -d ~/.config/goose/skills 2>/dev/null && echo "Goose: ✓"
ls -d ~/.cline/skills 2>/dev/null && echo "Cline: ✓"
-
Collect All Skills:
For each detected tool, list skill folders:
find ~/.{claude,codex
* **Key Validation:** SkillsMP API keys always start with `sk_live_skillsmp_`. If the user provides a key that does not match this prefix, reject it immediately:
> "That doesn't look like a valid SkillsMP API key. Keys start with `sk_live_skillsmp_`. You can get one at https://skillsmp.com — or choose SkillHub/ClawHub search instead (no key needed)."
* **Security:** Never log, display, or echo the full API key value.
**Note for claude.ai/Desktop/ChatGPT users:** Environment variables are not available. Use the "Package for Cloud Upload" capability (Section 5) to create a ZIP with your API key embedded, or provide your key when prompted.
-
Execute Search Based on Selected Source:
If using SkillsMP (primary, curated):
If using SkillHub (open catalog, no auth):
If using ClawHub (versioned skills, semantic search, no auth):
-
Display Results (Unified Format):
Display results in a consistent table format regardless of source. Include the Source column to indicate origin:
| # | Skill | Author | Stars | Source | Description |
|---|-------|--------|-------|--------|-------------|
| 1 | debugging-strategies | wshobson | 27,021 | SkillHub | Master systematic debugging... |
| 2 | code-debugging | AuthorX | 15 | SkillsMP | Systematic debugging methodology... |
| 3 | self-improving-agent | clawhub-user | 42 | ClawHub | Agent that improves itself... |
- For SkillsMP AI search: Also show relevance score
- For SkillHub: Show
securityScore if available
- For ClawHub semantic search: Show similarity
score if available
- Limit to top 10-15 results for readability
-
Search More Sources:
After displaying results from any source, offer to search the remaining unsearched sources:
- If 2 sources remain: "Want to also search {source1} or {source2}? Or both?"
- If 1 source remains: "Want to also search {source}?"
Available sources: SkillsMP (requires API key), SkillHub (no key), ClawHub (no key)
If yes:
- Query the selected source(s) with the same search terms
- Deduplicate: Compare results across sources:
- SkillsMP ↔ SkillHub: By full skill ID (
{owner}/{repo}/{path})
- ClawHub ↔ others: By skill name (ClawHub uses slugs, not GitHub paths)
- Append unique results to the display, labeled with their source tag
-
Offer Installation:
- After displaying results, ask: "Which skill would you like to install?"
- For SkillsMP results: Note the skill's
githubUrl for content fetching
- For SkillHub results: Note the skill's
id for detail fetching (needed to get skillPath and branch)
- For ClawHub results: Note the skill's
slug for direct file fetching via ClawHub's /file endpoint
4. Skill Matrix Report
Trigger: User asks for skill report/overview (e.g., "Show my skills", "What skills do I have?", "Skill report", "Compare my tools").
Procedure:
-
Detect Installed Tools:
Check which AI tools are installed by verifying their user-level skills directories exist:
ls -d ~/.claude/skills 2>/dev/null && echo "Claude: ✓"
ls -d ~/.codex/skills 2>/dev/null && echo "Codex: ✓"
ls -d ~/.gemini/skills 2>/dev/null && echo "Gemini: ✓"
ls -d ~/.gemini/antigravity/skills 2>/dev/null && echo "Antigravity: ✓"
ls -d ~/.openclaw/workspace/skills 2>/dev/null && echo "OpenClaw: ✓"
ls -d ~/.cursor/skills 2>/dev/null && echo "Cursor: ✓"
ls -d ~/.config/opencode/skills 2>/dev/null && echo "OpenCode: ✓"
ls -d ~/.roo/skills 2>/dev/null && echo "Roo: ✓"
ls -d ~/.config/goose/skills 2>/dev/null && echo "Goose: ✓"
ls -d ~/.cline/skills 2>/dev/null && echo "Cline: ✓"
-
Collect All Skills:
For each detected tool, list skill folders:
find ~/.{claude,codex,gemini,gemini/antigravity,openclaw/workspace,cursor,config/opencode,config/goose,roo,cline}/skills -maxdepth 1 -type d 2>/dev/null | \
xargs -I{} basename {} | sort -u
-
Generate Matrix Table:
Create a markdown table where:
- Rows = skill names (deduplicated across all tools)
- Columns = only tools that are installed on the system
- Cells = ✅ (installed) or ❌ (not installed)
Example output:
| Skill | Claude | Codex | Gemini |
|-------|--------|-------|--------|
| humanizer | ✅ | ❌ | ✅ |
| skill-creator | ❌ | ✅ | ❌ |
| using-superpowers | ✅ | ✅ | ✅ |
-
Show Summary:
- Total skills across all tools
- Skills unique to one tool
- Skills installed everywhere
5. Package for Cloud Upload (claude.ai / Claude Desktop / ChatGPT)
Trigger: User wants to use this skill in claude.ai, Claude Desktop, or ChatGPT (e.g., "Package this for claude.ai", "Create a ZIP for Claude Desktop", "Package for ChatGPT", "I want to upload this skill to claude.ai", "Prepare skill for web upload", "Package this for chatgpt.com").
Procedure:
-
Explain the Process:
"I'll create a ZIP file with this skill ready for upload to claude.ai, Claude Desktop, or ChatGPT. Since cloud environments don't have access to your local environment variables, I can optionally embed your API key in the package. Note: the API key is optional — SkillHub and ClawHub search work without one."
-
Validate Frontmatter Compatibility (CRITICAL — do this BEFORE packaging):
Run validate_frontmatter.py to check the SKILL.md against the Agent Skills spec (used by both claude.ai/Claude Desktop and ChatGPT):
python3 scripts/validate_frontmatter.py /path/to/SKILL.md
python3 scripts/validate_frontmatter.py /path/to/SKILL.md --fix
python3 scripts/validate_frontmatter.py /path/to/skill.zip --fix
The script checks for unsupported top-level keys, nested metadata, non-string metadata values, and field length violations. With --fix, it automatically moves unsupported keys into metadata, flattens nested objects, and converts values to strings. Tell the user what was fixed. See Operational Rule 5 for the full spec.
-
Collect API Key (Optional):
- Ask: "Would you like to include your SkillsMP API key for curated search? This is optional — SkillHub and ClawHub work without a key. If you skip this, the packaged skill will still work for SkillHub and ClawHub searches."
- If user wants to include a key:
- Ask: "Please provide your SkillsMP API key. You can get one at https://skillsmp.com"
- Wait for user to provide the key
- Validate: Key must start with
sk_live_skillsmp_. If invalid, reject and re-prompt or offer to skip.
- Security: Do not echo or display the key back to the user
- If user skips, create the ZIP without
config.json
- Credential safety warning (IMPORTANT — always display this if a key is included):
"Security note: This ZIP will contain your API key in plain text. Please follow these precautions:
- Do NOT share this ZIP publicly, post it online, or commit it to version control
- Do NOT distribute this ZIP to others — each user should package their own
- Use a scoped/least-privilege key if your provider supports it
- Rotate your key if you suspect the ZIP was exposed
- The key is stored locally in
config.json inside the ZIP and is only used at runtime to authenticate with the SkillsMP API"
-
Create Package Contents:
- Create a temporary directory structure:
universal-skills-manager/
├── SKILL.md # Copy from current skill
├── config.json # Create with embedded API key
└── scripts/
└── install_skill.py # Copy from current skill
- Generate
config.json with the user's API key:
{
"skillsmp_api_key": "USER_PROVIDED_KEY_HERE"
}
-
Create ZIP File:
- Use Python to create the ZIP:
import zipfile
import json
import tempfile
from pathlib import Path
zip_path = Path.home() / "Downloads" / "universal-skills-manager.zip"
skill_dir = Path("~/.claude/skills/universal-skills-manager").expanduser()
with tempfile.TemporaryDirectory() as temp_dir:
temp_path = Path(temp_dir)
for file_path in skill_dir.rglob('*'):
if file_path.is_file() and file_path.name != 'config.json':
rel_path = file_path.relative_to(skill_dir)
dest = temp_path / rel_path
dest.parent.mkdir(parents=True, exist_ok=True)
dest.write_bytes(file_path.read_bytes())
config = {"skillsmp_api_key": "USER_API_KEY"}
(temp_path / "config.json").write_text(json.dumps(config, indent=2))
with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zf:
for file_path in temp_path.rglob('*'):
if file_path.is_file():
arcname = f"universal-skills-manager/{file_path.relative_to(temp_path)}"
zf.write(file_path, arcname)
- Alternatively, provide the ZIP as a downloadable artifact
-
Provide Upload Instructions:
- "Your skill package is ready! To use it:"
- For claude.ai / Claude Desktop:
- "1. Download the ZIP file"
- "2. Go to Settings → Capabilities"
- "3. Click 'Upload skill' in the Skills section"
- "4. Select the ZIP file and upload"
- "5. Enable the skill and start using it!"
- For ChatGPT:
- "1. Download the ZIP file"
- "2. Click your profile icon and select Skills (or go to chatgpt.com/skills)"
- "3. Click 'New skill'"
- "4. Select 'Upload from your computer'"
- "5. Select the ZIP file and upload"
- "6. The skill is now installed and ChatGPT will use it when relevant!"
-
Security Reminder:
- If a key was embedded: "This ZIP contains your API key. Do NOT share it publicly, distribute it to others, or commit it to version control. If you need to share the skill, create a key-free version (without
config.json) and let each user add their own key."
- If no key was embedded: "This ZIP is safe to share — it contains no credentials. Recipients can add their own API key later, or use SkillHub/ClawHub search which requires no key."
Operational Rules
-
Structure Integrity: When installing, always ensure the skill has its own folder (e.g., .../skills/my-skill/). Do not dump loose files into the root skills directory. Always run mkdir -p on the target path before copying files.
-
Conflict Safety: If a skill already exists at a target location, always ask before overwriting, unless the user explicitly requested a "Force Sync."
-
User-Agent Required: Always include -H "User-Agent: Universal-Skills-Manager" in all curl requests. APIs behind Cloudflare (like SkillsMP) return 403 Forbidden for bare curl requests without a User-Agent header.
-
OpenClaw Note: OpenClaw may require a restart to pick up new skills if skills.load.watch is not enabled in openclaw.json. Warn the user of this after installation.
-
Cross-Platform Adaptation:
- Gemini uses
SKILL.md.
- Cline uses the same
SKILL.md format with name and description frontmatter. The name field must match the directory name. No manifest generation required. Note: Cline also reads .claude/skills/ at the project level, so Claude Code project skills work in Cline automatically.
- If OpenCode or Anti-Gravity require a specific manifest (e.g.,
manifest.json), generate a basic one based on the SKILL.md frontmatter during installation.
-
Cloud Platform Frontmatter Compatibility Check (claude.ai / Claude Desktop / ChatGPT):
When a user wants to upload or package a skill for claude.ai, Claude Desktop, or ChatGPT, validate the SKILL.md frontmatter against the Agent Skills specification. All three platforms use strict frontmatter validation that rejects ambiguous YAML constructs like block scalars. Non-compliant skills will be rejected with "malformed YAML frontmatter" or "unexpected key" errors.
Allowed top-level frontmatter fields (Agent Skills spec):
| Field | Required | Constraints |
|---|
name | Yes | Max 64 chars, lowercase letters/numbers/hyphens only, must match directory name |
description | Yes | Max 1024 chars. No angle brackets (< or >). Avoid literal block scalars (|) — known to fail with blank lines. Folded scalars (>) work but inline strings are safest |
license | No | License name or reference to bundled file |
compatibility | No | Max 500 chars, environment requirements |
metadata | No | Flat key-value pairs only (string keys to string values — no nested objects, no arrays) |
allowed-tools | No | Space-delimited list of pre-approved tools (experimental) |
Use the validation script (preferred — avoids manual YAML errors):
python3 scripts/validate_frontmatter.py /path/to/SKILL.md
python3 scripts/validate_frontmatter.py /path/to/SKILL.md --fix
python3 scripts/validate_frontmatter.py /path/to/skill.zip --fix
The script (scripts/validate_frontmatter.py) is zero-dependency Python 3. It checks all constraints and with --fix automatically applies these corrections:
- Moves unsupported top-level keys (e.g.,
version, author, homepage, category) into metadata as string values
- Flattens nested
metadata objects (e.g., metadata.clawdbot.requires.bins: [x, y] → metadata.clawdbot-requires-bins: "x, y")
- Converts non-string metadata values to quoted strings (e.g.,
true → "true")
- Collapses literal block scalar (
|) descriptions to inline quoted strings (known to fail with blank lines). Folded scalars (>) trigger a warning but work in current Claude Desktop
- Strips angle brackets (
< >) from description (Anthropic's validator rejects them)
- Converts YAML list-format
allowed-tools to space-delimited string
- Truncates
description if over 1024 chars
- Validates the fix and reports if any issues remain
If the script is not available, do the validation manually:
- Read the SKILL.md frontmatter
- Check all top-level keys are in the allowed set:
name, description, license, compatibility, metadata, allowed-tools
- If
metadata is present, verify all values are strings (no nested objects or arrays)
- Verify
name is lowercase with hyphens only, max 64 chars
- Verify
description is max 1024 chars
If validation fails, tell the user exactly what's wrong and offer to fix it (run the script with --fix, or apply the fixes manually).
Available Tools
bash (curl): Make API calls to SkillsMP.com, SkillHub (skills.palebluedot.live), and ClawHub (clawhub.ai); fetch skill content from GitHub or ClawHub directly.web_fetch: Fetch skill content from GitHub raw URLs, SkillHub API, or ClawHub API (alternative to curl).read_file / write_file: Manage local skill files.glob: Find existing skills in local directories.
Implementation Details
Skill Structure
Skills typically contain:
- SKILL.md (required): Main instructions with frontmatter.
- Reference docs: Additional documentation files.
- Scripts: Helper scripts (Python, shell, etc.).
- Config files: JSON, YAML configurations.
Installation Logic
A. Installing from SkillsMP API
-
Fetch Skill Content:
-
Create Directory:
- Use skill
name from API response for directory: .../skills/{skill-name}/
- Example:
.../skills/code-debugging/
-
Save SKILL.md:
- Write the fetched content to
SKILL.md in the new directory
- Preserve the original YAML frontmatter and content
-
Handle Additional Files (Optional):
- Check if GitHub repo has additional files (reference docs, scripts)
- Optionally fetch and save them to maintain complete skill package
-
Confirm:
- Report: "Installed '{name}' by {author} to {path}"
- Show GitHub URL and stars count
- Offer sync to other AI tools
B. Installing from SkillHub
-
Fetch Skill Details:
-
Construct GitHub URL:
-
Download Using Helper Script:
-
Confirm:
- Report: "Installed '{name}' from SkillHub to {path}"
- Show GitHub URL and stars count
- Offer sync to other AI tools
C. Installing from ClawHub
ClawHub hosts skill files directly (not on GitHub), so the install flow bypasses install_skill.py and fetches content via ClawHub's API.
-
Fetch SKILL.md Content:
-
Handle Multi-File Skills (if applicable):
-
Run Security Scan:
-
Validate YAML Frontmatter:
- Verify the SKILL.md has valid YAML frontmatter (name, description fields).
- If invalid, warn the user and ask whether to proceed.
-
Create Directory and Install:
-
Confirm:
- Report: "Installed '{displayName}' (v{version}) from ClawHub to {path}"
- Show version info and stars count
- Offer sync to other AI tools
-
Cleanup:
D. Installing from Local Source (Sync/Copy)
- Retrieve: Read all files from the source directory.
- Create Directory: Create the target directory
.../skills/{slug}/.
- Save Files: Copy all files to the new location, preserving filenames.
SkillsMP API Configuration
Base URL: https://skillsmp.com/api/v1
Authentication:
Authorization: Bearer $SKILLSMP_API_KEY
Available Endpoints:
GET /api/v1/skills/search?q={query}&page={1}&limit={20}&sortBy={recent|stars}GET /api/v1/skills/ai-search?q={query}
Response Format (Keyword Search):
{
"success": true,
"data": {
"skills": [
{
"id": "...",
"name": "skill-name",
"author": "AuthorName",
"description": "...",
"githubUrl": "https://github.com/user/repo/tree/main/path",
"skillUrl": "https://skillsmp.com/skills/...",
"stars": 10,
"updatedAt": 1768838561
}
],
"pagination": {
"page": 1,
"limit": 20,
"total": 3601,
"totalPages": 1801,
"hasNext": true
}
}
}
Response Format (AI Search):
{
"success": true,
"data": {
"search_query": "...",
"data": [
{
"file_id": "...",
"filename": "...",
"score": 0.656,
"skill": {
"id": "...",
"name": "...",
"author": "...",
"description": "...",
"githubUrl": "...",
"skillUrl": "...",
"stars": 0,
"updatedAt": 1769542668
}
}
]
}
}
Error Handling:
401: Invalid or missing API key400: Missing required query parameter500: Internal server error
SkillHub API Configuration
Base URL: https://skills.palebluedot.live/api
Authentication: None required (open API)
Available Endpoints:
GET /api/skills?q={query}&limit={20} — Search skills by keywordGET /api/skills/{id} — Get full skill details (includes skillPath, branch, rawContent)GET /api/categories — List skill categoriesGET /api/health — Health check
Search Response Format:
{
"skills": [
{
"id": "wshobson/agents/debugging-strategies",
"name": "debugging-strategies",
"description": "Master systematic debugging...",
"githubOwner": "wshobson",
"githubRepo": "agents",
"githubStars": 27021,
"downloadCount": 0,
"securityScore": 100,
"securityStatus": null,
"rating": 0,
"isVerified": false,
"compatibility": { "platforms": [] }
}
],
"pagination": {
"page": 1,
"limit": 20,
"total": 1000,
"totalPages": 50
},
"searchEngine": "meilisearch",
"processingTimeMs": 10
}
Detail Response Format (GET /api/skills/{id}):
{
"id": "wshobson/agents/debugging-strategies",
"name": "debugging-strategies",
"description": "...",
"githubOwner": "wshobson",
"githubRepo": "agents",
"skillPath": "plugins/developer-essentials/skills/debugging-strategies",
"branch": "main",
"githubStars": 27021,
"rawContent": "---\nname: debugging-strategies\n..."
}
Key Fields for Installation:
skillPath: The actual directory path within the GitHub repo (CRITICAL — the id does NOT match the file path)branch: The branch name (e.g., main)githubOwner + githubRepo: Used to construct the GitHub URLrawContent: Full SKILL.md content (can be used as fallback if GitHub is unreachable)
Error Handling:
404: Skill not found500: Internal server error
ClawHub API Configuration
Base URL: https://clawhub.ai/api/v1
Authentication: None required (open API)
Rate Limits: 120 reads/min per IP (shown in x-ratelimit-remaining and x-ratelimit-reset response headers)
Available Endpoints:
GET /api/v1/search?q={query}&limit={20} — Semantic/vector search (ranked by similarity score)GET /api/v1/skills?limit={20}&sort={stars|downloads|updated|trending}&cursor={cursor} — Browse/list with cursor paginationGET /api/v1/skills/{slug} — Get full skill details (owner, version, moderation status)GET /api/v1/skills/{slug}/file?path={filepath}&version={ver} — Get raw file content (text/plain, NOT JSON)GET /api/v1/download?slug={slug}&version={ver} — Download full skill as ZIP
Search Response Format (GET /api/v1/search):
{
"results": [
{
"score": 0.82,
"slug": "self-improving-agent",
"displayName": "Self-Improving Agent",
"summary": "An agent that iteratively improves itself...",
"version": "1.0.0",
"updatedAt": "2026-01-15T10:30:00Z"
}
]
}
Browse Response Format (GET /api/v1/skills):
{
"items": [
{
"slug": "self-improving-agent",
"displayName": "Self-Improving Agent",
"summary": "...",
"version": "1.0.0",
"stats": {
"stars": 42,
"downloads": 150
}
}
],
"nextCursor": "eyJ..."
}
Detail Response Format (GET /api/v1/skills/{slug}):
{
"skill": {
"slug": "self-improving-agent",
"displayName": "Self-Improving Agent",
"summary": "...",
"version": "1.0.0"
},
"owner": {
"handle": "username",
"displayName": "User Name"
},
"latestVersion": "1.0.0",
"moderation": "approved"
}
File Endpoint (GET /api/v1/skills/{slug}/file?path=SKILL.md):
- Returns raw
text/plain content (NOT JSON)
- Response headers include
x-content-sha256 (integrity hash) and x-content-size (byte count)
- Use
version query param to fetch a specific version (defaults to latest)
Key Differences from SkillsMP/SkillHub:
- Direct hosting: ClawHub hosts skill files directly — no GitHub URL construction needed
- Versioned skills: Each skill has explicit version numbers; use
version param to pin
- Slug-based IDs: Skills are identified by
slug (e.g., self-improving-agent), not GitHub paths
- Semantic search built-in: The
/search endpoint uses vector similarity, not keyword matching
- VirusTotal integration: ClawHub scans skills via VirusTotal partnership;
moderation field indicates status
Error Handling:
404: Skill or file not found429: Rate limit exceeded (120 reads/min)500: Internal server error
Guidelines
- Multi-Source Search: Use SkillsMP as the primary source when an API key is available. Offer SkillHub and ClawHub as alternative or additional sources.
- Prefer AI/Semantic Search: For natural language queries, use SkillsMP
/ai-search or ClawHub /search (both support semantic matching). SkillHub only supports keyword search.
- Source Labeling: Always label results with their source (
[SkillsMP], [SkillHub], or [ClawHub]) so users can distinguish between sources.
- SkillHub Detail Lookup: When installing from SkillHub, always fetch the detail endpoint first to get the correct
skillPath and branch. Never try to parse the id field as a file path.
- ClawHub Direct Hosting: ClawHub hosts skill files directly — use the
/file endpoint to fetch content. No GitHub URL construction is needed. Use the slug field as the skill identifier.
- ClawHub Versioning: ClawHub skills have explicit version numbers. Show the version in install confirmations. Use the
version query param to pin a specific version if needed.
- Deduplication: When showing results from multiple sources, deduplicate: SkillsMP ↔ SkillHub by full skill ID (
{owner}/{repo}/{path}); ClawHub ↔ others by skill name (since ClawHub uses slugs, not GitHub paths).
- Verify Content: After fetching from any source, verify the SKILL.md has valid YAML frontmatter.
- Structure Integrity: Maintain the
.../skills/{skill-name}/SKILL.md structure.
- Syncing: After installing a skill, offer to sync (copy) it to other detected AI tools.
- GitHub URLs: For SkillsMP/SkillHub installs, always convert tree URLs to raw.githubusercontent.com URLs for content fetching.
- Security: Security scanning runs on all installs regardless of source (SkillsMP, SkillHub, or ClawHub). SkillHub's
securityScore and ClawHub's VirusTotal moderation status are informational only — our own scan_skill.py at install time is authoritative.
Operational Rules
-
Structure Integrity: When installing, always ensure the skill has its own folder (e.g., .../skills/my-skill/). Do not dump loose files into the root skills directory. Always run mkdir -p on the target path before copying files.
-
Conflict Safety: If a skill already exists at a target location, always ask before overwriting, unless the user explicitly requested a "Force Sync."
-
User-Agent Required: Always include -H "User-Agent: Universal-Skills-Manager" in all curl requests. APIs behind Cloudflare (like SkillsMP) return 403 Forbidden for bare curl requests without a User-Agent header.
-
OpenClaw Note: OpenClaw may require a restart to pick up new skills if skills.load.watch is not enabled in openclaw.json. Warn the user of this after installation.
-
Cross-Platform Adaptation:
- Gemini uses
SKILL.md.
- Cline uses the same
SKILL.md format with name and description frontmatter. The name field must match the directory name. No manifest generation required. Note: Cline also reads .claude/skills/ at the project level, so Claude Code project skills work in Cline automatically.
- If OpenCode or Anti-Gravity require a specific manifest (e.g.,
manifest.json), generate a basic one based on the SKILL.md frontmatter during installation.
-
Cloud Platform Frontmatter Compatibility Check (claude.ai / Claude Desktop / ChatGPT):
When a user wants to upload or package a skill for claude.ai, Claude Desktop, or ChatGPT, validate the SKILL.md frontmatter against the Agent Skills specification. All three platforms use strict frontmatter validation that rejects ambiguous YAML constructs like block scalars. Non-compliant skills will be rejected with "malformed YAML frontmatter" or "unexpected key" errors.
Allowed top-level frontmatter fields (Agent Skills spec):
| Field | Required | Constraints |
|---|
name | Yes | Max 64 chars, lowercase letters/numbers/hyphens only, must match directory name |
description | Yes | Max 1024 chars. No angle brackets (< or >). Avoid literal block scalars (|) — known to fail with blank lines. Folded scalars (>) work but inline strings are safest |
license | No | License name or reference to bundled file |
compatibility | No | Max 500 chars, environment requirements |
metadata | No | Flat key-value pairs only (string keys to string values — no nested objects, no arrays) |
allowed-tools | No | Space-delimited list of pre-approved tools (experimental) |
Use the validation script (preferred — avoids manual YAML errors):
python3 scripts/validate_frontmatter.py /path/to/SKILL.md
python3 scripts/validate_frontmatter.py /path/to/SKILL.md --fix
python3 scripts/validate_frontmatter.py /path/to/skill.zip --fix
The script (scripts/validate_frontmatter.py) is zero-dependency Python 3. It checks all constraints and with --fix automatically applies these corrections:
- Moves unsupported top-level keys (e.g.,
version, author, homepage, category) into metadata as string values
- Flattens nested
metadata objects (e.g., metadata.clawdbot.requires.bins: [x, y] → metadata.clawdbot-requires-bins: "x, y")
- Converts non-string metadata values to quoted strings (e.g.,
true → "true")
- Collapses literal block scalar (
|) descriptions to inline quoted strings (known to fail with blank lines). Folded scalars (>) trigger a warning but work in current Claude Desktop
- Strips angle brackets (
< >) from description (Anthropic's validator rejects them)
- Converts YAML list-format
allowed-tools to space-delimited string
- Truncates
description if over 1024 chars
- Validates the fix and reports if any issues remain
If the script is not available, do the validation manually:
- Read the SKILL.md frontmatter
- Check all top-level keys are in the allowed set:
name, description, license, compatibility, metadata, allowed-tools
- If
metadata is present, verify all values are strings (no nested objects or arrays)
- Verify
name is lowercase with hyphens only, max 64 chars
- Verify
description is max 1024 chars
If validation fails, tell the user exactly what's wrong and offer to fix it (run the script with --fix, or apply the fixes manually).
Available Tools
bash (curl): Make API calls to SkillsMP.com, SkillHub (skills.palebluedot.live), and ClawHub (clawhub.ai); fetch skill content from GitHub or ClawHub directly.web_fetch: Fetch skill content from GitHub raw URLs, SkillHub API, or ClawHub API (alternative to curl).read_file / write_file: Manage local skill files.glob: Find existing skills in local directories.
Installation Logic
A. Installing from SkillsMP API
-
Fetch Skill Content:
-
Create Directory:
- Use skill
name from API response for directory: .../skills/{skill-name}/
- Example:
.../skills/code-debugging/
-
Save SKILL.md:
- Write the fetched content to
SKILL.md in the new directory
- Preserve the original YAML frontmatter and content
-
Handle Additional Files (Optional):
- Check if GitHub repo has additional files (reference docs, scripts)
- Optionally fetch and save them to maintain complete skill package
-
Confirm:
- Report: "Installed '{name}' by {author} to {path}"
- Show GitHub URL and stars count
- Offer sync to other AI tools
B. Installing from SkillHub
-
Fetch Skill Details:
-
Construct GitHub URL:
-
Download Using Helper Script:
-
Confirm:
- Report: "Installed '{name}' from SkillHub to {path}"
- Show GitHub URL and stars count
- Offer sync to other AI tools
C. Installing from ClawHub
ClawHub hosts skill files directly (not on GitHub), so the install flow bypasses install_skill.py and fetches content via ClawHub's API.
-
Fetch SKILL.md Content:
-
Handle Multi-File Skills (if applicable):
-
Run Security Scan:
-
Validate YAML Frontmatter:
- Verify the SKILL.md has valid YAML frontmatter (name, description fields).
- If invalid, warn the user and ask whether to proceed.
-
Create Directory and Install:
-
Confirm:
- Report: "Installed '{displayName}' (v{version}) from ClawHub to {path}"
- Show version info and stars count
- Offer sync to other AI tools
-
Cleanup:
D. Installing from Local Source (Sync/Copy)
- Retrieve: Read all files from the source directory.
- Create Directory: Create the target directory
.../skills/{slug}/.
- Save Files: Copy all files to the new location, preserving filenames.
SkillsMP API Configuration
Base URL: https://skillsmp.com/api/v1
Authentication:
Authorization: Bearer $SKILLSMP_API_KEY
Available Endpoints:
GET /api/v1/skills/search?q={query}&page={1}&limit={20}&sortBy={recent|stars}GET /api/v1/skills/ai-search?q={query}
Response Format (Keyword Search):
{
"success": true,
"data": {
"skills": [
{
"id": "...",
"name": "skill-name",
"author": "AuthorName",
"description": "...",
"githubUrl": "https://github.com/user/repo/tree/main/path",
"skillUrl": "https://skillsmp.com/skills/...",
"stars": 10,
"updatedAt": 1768838561
}
],
"pagination": {
"page": 1,
"limit": 20,
"total": 3601,
"totalPages": 1801,
"hasNext": true
}
}
}
Response Format (AI Search):
{
"success": true,
"data": {
"search_query": "...",
"data": [
{
"file_id": "...",
"filename": "...",
"score": 0.656,
"skill": {
"id": "...",
"name": "...",
"author": "...",
"description": "...",
"githubUrl": "...",
"skillUrl": "...",
"stars": 0,
"updatedAt": 1769542668
}
}
]
}
}
Error Handling:
401: Invalid or missing API key400: Missing required query parameter500: Internal server error
SkillHub API Configuration
Base URL: https://skills.palebluedot.live/api
Authentication: None required (open API)
Available Endpoints:
GET /api/skills?q={query}&limit={20} — Search skills by keywordGET /api/skills/{id} — Get full skill details (includes skillPath, branch, rawContent)GET /api/categories — List skill categoriesGET /api/health — Health check
Search Response Format:
{
"skills": [
{
"id": "wshobson/agents/debugging-strategies",
"name": "debugging-strategies",
"description": "Master systematic debugging...",
"githubOwner": "wshobson",
"githubRepo": "agents",
"githubStars": 27021,
"downloadCount": 0,
"securityScore": 100,
"securityStatus": null,
"rating": 0,
"isVerified": false,
"compatibility": { "platforms": [] }
}
],
"pagination": {
"page": 1,
"limit": 20,
"total": 1000,
"totalPages": 50
},
"searchEngine": "meilisearch",
"processingTimeMs": 10
}
Detail Response Format (GET /api/skills/{id}):
{
"id": "wshobson/agents/debugging-strategies",
"name": "debugging-strategies",
"description": "...",
"githubOwner": "wshobson",
"githubRepo": "agents",
"skillPath": "plugins/developer-essentials/skills/debugging-strategies",
"branch": "main",
"githubStars": 27021,
"rawContent": "---\nname: debugging-strategies\n..."
}
Key Fields for Installation:
skillPath: The actual directory path within the GitHub repo (CRITICAL — the id does NOT match the file path)branch: The branch name (e.g., main)githubOwner + githubRepo: Used to construct the GitHub URLrawContent: Full SKILL.md content (can be used as fallback if GitHub is unreachable)
Error Handling:
404: Skill not found500: Internal server error
ClawHub API Configuration
Base URL: https://clawhub.ai/api/v1
Authentication: None required (open API)
Rate Limits: 120 reads/min per IP (shown in x-ratelimit-remaining and x-ratelimit-reset response headers)
Available Endpoints:
GET /api/v1/search?q={query}&limit={20} — Semantic/vector search (ranked by similarity score)GET /api/v1/skills?limit={20}&sort={stars|downloads|updated|trending}&cursor={cursor} — Browse/list with cursor paginationGET /api/v1/skills/{slug} — Get full skill details (owner, version, moderation status)GET /api/v1/skills/{slug}/file?path={filepath}&version={ver} — Get raw file content (text/plain, NOT JSON)GET /api/v1/download?slug={slug}&version={ver} — Download full skill as ZIP
Search Response Format (GET /api/v1/search):
{
"results": [
{
"score": 0.82,
"slug": "self-improving-agent",
"displayName": "Self-Improving Agent",
"summary": "An agent that iteratively improves itself...",
"version": "1.0.0",
"updatedAt": "2026-01-15T10:30:00Z"
}
]
}
Browse Response Format (GET /api/v1/skills):
{
"items": [
{
"slug": "self-improving-agent",
"displayName": "Self-Improving Agent",
"summary": "...",
"version": "1.0.0",
"stats": {
"stars": 42,
"downloads": 150
}
}
],
"nextCursor": "eyJ..."
}
Detail Response Format (GET /api/v1/skills/{slug}):
{
"skill": {
"slug": "self-improving-agent",
"displayName": "Self-Improving Agent",
"summary": "...",
"version": "1.0.0"
},
"owner": {
"handle": "username",
"displayName": "User Name"
},
"latestVersion": "1.0.0",
"moderation": "approved"
}
File Endpoint (GET /api/v1/skills/{slug}/file?path=SKILL.md):
- Returns raw
text/plain content (NOT JSON)
- Response headers include
x-content-sha256 (integrity hash) and x-content-size (byte count)
- Use
version query param to fetch a specific version (defaults to latest)
Key Differences from SkillsMP/SkillHub:
- Direct hosting: ClawHub hosts skill files directly — no GitHub URL construction needed
- Versioned skills: Each skill has explicit version numbers; use
version param to pin
- Slug-based IDs: Skills are identified by
slug (e.g., self-improving-agent), not GitHub paths
- Semantic search built-in: The
/search endpoint uses vector similarity, not keyword matching
- VirusTotal integration: ClawHub scans skills via VirusTotal partnership;
moderation field indicates status
Error Handling:
404: Skill or file not found429: Rate limit exceeded (120 reads/min)500: Internal server error
Guidelines
- Multi-Source Search: Use SkillsMP as the primary source when an API key is available. Offer SkillHub and ClawHub as alternative or additional sources.
- Prefer AI/Semantic Search: For natural language queries, use SkillsMP
/ai-search or ClawHub /search (both support semantic matching). SkillHub only supports keyword search.
- Source Labeling: Always label results with their source (
[SkillsMP], [SkillHub], or [ClawHub]) so users can distinguish between sources.
- SkillHub Detail Lookup: When installing from SkillHub, always fetch the detail endpoint first to get the correct
skillPath and branch. Never try to parse the id field as a file path.
- ClawHub Direct Hosting: ClawHub hosts skill files directly — use the
/file endpoint to fetch content. No GitHub URL construction is needed. Use the slug field as the skill identifier.
- ClawHub Versioning: ClawHub skills have explicit version numbers. Show the version in install confirmations. Use the
version query param to pin a specific version if needed.
- Deduplication: When showing results from multiple sources, deduplicate: SkillsMP ↔ SkillHub by full skill ID (
{owner}/{repo}/{path}); ClawHub ↔ others by skill name (since ClawHub uses slugs, not GitHub paths).
- Verify Content: After fetching from any source, verify the SKILL.md has valid YAML frontmatter.
- Structure Integrity: Maintain the
.../skills/{skill-name}/SKILL.md structure.
- Syncing: After installing a skill, offer to sync (copy) it to other detected AI tools.
- GitHub URLs: For SkillsMP/SkillHub installs, always convert tree URLs to raw.githubusercontent.com URLs for content fetching.
- Security: Security scanning runs on all installs regardless of source (SkillsMP, SkillHub, or ClawHub). SkillHub's
securityScore and ClawHub's VirusTotal moderation status are informational only — our own scan_skill.py at install time is authoritative.
