Public beta
Your team's agent skills, versioned like code.
Publish SKILL.md packages to private registries your team owns, review changes like code, and sync the same versions into every coding agent on every teammate's machine — while git status stays clean.
Free during public beta · no card · GitHub or email.
Fans out to whatever you already run
init detects the coding agents installed on your machine and links into each one's skills directory. Nothing to configure per agent, and nothing to change when you add the next one.
- Claude Code
- Cursor
- Codex CLI
- GitHub Copilot
- Gemini CLI
- OpenCode
- Windsurf
- Universal
.agents/skills
Detected agents, with a universal target for anything that reads .agents/skills.
Publish. Install. Sync.
Three commands, in order. Simpler than a git repo because there is nothing to branch and nothing to merge.
Publish
skillhub publish validates against the skill spec, security-scans, and packs deterministically. A blocking finding exits before any network call, so nothing leaves your machine unscanned. Every publish is an immutable semver version with a content hash.
Install
skillhub install @studio/design-systems installs a whole registry as one unit, into a gitignored store, symlinked into every agent you use. It records a subscription, so skills added to that registry later arrive on your next sync.
Sync
A teammate publishes; skillhub sync picks it up, verifies the hash, and moves on. Pin a skill and it never moves without you. --frozen turns sync into a CI check that fails if the lockfile would change at all.
No branches. No merges. Nothing stageable in your client's repo.
What ships today
Six surfaces that ship today, not a roadmap.
Review changes like code
Server-computed SKILL.md diffs between any two versions, unified or split. Turn on review for a registry and publishers ship prereleases only — a reviewer approves from the queue before latest moves.
Immutable versions, movable tags
A published version never changes. Dist-tags — latest, beta, any name you like — move between them, and latest can never point at a prerelease.
Search your registries and skills.sh
One query spans both. External hits come back flagged unreviewed, and importing one copies it into a registry you control.
Nothing ships unscanned
A blocking scan exits before any network call, so nothing leaves your machine unclean. Publishes, promotions and role changes land in a dashboard audit log.
Bring skills in with their history
Import from GitHub and keep the source repo, ref, subpath, and upstream hash on the record.
Organizations, registries, roles
Add a freelancer to the org and each registry's default role grants them access. An explicit per-registry grant overrides it. Anything outside your grants returns a plain 404 — not forbidden, just not there.
Built like infrastructure
- Nothing ships unscanned
- A blocking scan exits before any network call, so an unclean skill never leaves your machine. The same engine runs server-side on publish, so a local pass is the real verdict.Scanning →
- Deterministic packing
- The same skill packs to the same sha256 on any machine, and every install verifies the hash it resolved.Never touch your repo →
- Not found, never forbidden
- A private registry you lack access to returns a plain 404, indistinguishable from one that does not exist. Access is not merely restricted — it is invisible.Errors & responses →
- Typed end to end
- One contract drives the API, the web app, and the CLI; REST and OpenAPI 3.1 are generated from it, and every command takes --json with a stable envelope.CLI overview →
- The same skills everywhere
- Installs resolve from a lockfile, so every teammate and every CI run works from the same versions. In CI, sync --frozen fails the build rather than quietly installing something different — so an agent never runs on instructions the rest of the team doesn't have.sync →
Straight answers
Does this put anything in my repo?
Nothing stageable. Skills land in a gitignored store and are symlinked into each agent's directory, and init maintains a managed .gitignore block covering the store and every agent directory it links into — so git status --porcelain stays silent. doctor re-checks the block, every symlink, and the lockfile whenever you want to be sure.
Which agents work with it?
init detects the coding agents installed on your machine and links into each one's skills directory, so there is no supported-list to be on. Anything that reads .agents/skills works via the universal target. Symlinks by default, copy as fallback.
What happens if a teammate ships a bad skill?
Pin the version and it never moves without you. A published version can be deprecated or yanked, and latest can be moved back to any earlier version — the bytes behind each one are immutable, so rolling back is a tag move rather than a rebuild.
Are my registries private?
Private by default. Access is role-based, granted by each registry's default for org members and overridable with an explicit per-registry grant. Anything you lack access to returns a plain 404 — invisible, not merely forbidden. If a registry is deleted or your access is revoked, the skills already on your disk stay put until you prune them.
What does "public beta" mean?
It's free and open to sign up, and pricing isn't final. The CLI installs from npm as @uzolab/skillhub. Things may change; your published versions stay immutable.
Stop emailing skill folders around.
Free during public beta · no card · GitHub or email.