The skillpass CLI

Search the directory, inspect passports, and install skills - every install verified byte-for-byte against the validated snapshot before anything touches disk.

Install

npm install -g skillpass

Node 20 or newer. Zero runtime dependencies.

Find: search

skillpass search pdf
skillpass search --packs
skillpass search --target codex --category security-review

Searches the same fields as the website (names, summaries, authors, tools, pack members).--json emits machine output; piped output is always plain and grep-friendly.

Inspect: report

skillpass report pdf
skillpass report pdf@1.0.0 --json

Prints the version's Skill Passport before you install anything: status, risk, declared vs detected permissions, the permission diff against the previous version, and the pinned source hash. Failed versions are blocked from download.

Validate: scan

skillpass scan ./my-skill

Runs the same validator the directory uses on a local folder - check your own skill beforesubmitting it.

Install: add

skillpass add pdf --target claude-code            # .claude/skills/pdf (project)
skillpass add pdf --target claude-code --global   # ~/.claude/skills/pdf
skillpass add pdf --dir ./somewhere               # anywhere you point it
skillpass add ai-blueprint --target codex          # a pack: every member installs

The pre-flight report shows first; medium+ risk asks for confirmation; the download re-verifies against the pinned hash; writes are atomic. With no flags in a terminal you get an interactive location picker. Installing a pack fans every member skill out into the tool's skills area using that tool's variant files.

Track: list and outdated

skillpass list        # installed skills with versions, offline
skillpass outdated    # compares to the directory; exits 1 when updates exist

Installs into the known skills areas are recorded in a per-area .skillpass.jsonreceipt. Your own hand-made skills in the same folders are left alone - the CLI only tracks what it installed.

Update

skillpass update pdf
skillpass update pdf@1.0.0     # pinning works for downgrades too
skillpass update ai-blueprint  # packs: members swap, new ones add, dropped ones remove

An update re-runs the whole trust gate and shows the permission diff against the version you actually have installed - not just the previous publish. The swap is atomic: a failure mid-replace restores what you had.

Remove

skillpass remove pdf
skillpass remove ai-blueprint   # removes the whole pack family

Refuses anything that does not look like an installed skill, so a stray --dir can never wipe a real folder.

Configuration and exit codes

SKILLPASS_API - override the API base URL (defaults to the public API).
NO_COLOR - disable colored output; piped output is always plain.
Exit codes: 0 success, 1 failed validation or a blocked version (for outdated: updates available), 2 usage, network, or refused operations.