A private, versioned skills registry for your team. Write and validate SKILL.md packages, share them across your organization, then install an exact version into Claude Code, Codex and OpenCode with one command. Self-host it or use skillpack.app.
The problem
One engineer's review checklist lives in a gist. The deploy skill was pasted in Slack. Every agent runs a different copy, and nobody knows which one is current.
Great skills exist. They just don't travel.
How it works
Write a SKILL.md or upload a package. Skillpack checks the archive, manifest, dependencies and declared secrets before anything ships.
Publish immutable versions. Keep a skill in My Skills, or share it with your organization so every member can use and improve it.
One command installs an exact version into the agents you pick with --tools, and a lockfile records its version and sha256. Add --pin to hold a version; skillpack update --all --dry-run previews updates, and skillpack sync --frozen verifies locked project packages and restores missing ones.
Agents can report each activation without signing in, and anyone can opt out. Find the skills that actually earn their place.
Use cases
A skill is a folder with a SKILL.md file: a name, a description that says what it does and when to use it, then the instructions. These are common places to start. Most snippets are illustrative; adapt them to how your team works.
Write the review checklist down once. Every agent then checks the same things on every pull request, not whatever one reviewer remembers.
code-review/SKILL.mdIllustrative example---
name: code-review
description: Review a diff against the team checklist for tests, security and naming. Use when asked to review a pull request or local changes.
---
1. Read the diff and the linked issue.
2. Post one summary comment, most severe first.Capture the preflight checks and rollback steps your team already follows, so agents run them in the same order before anything reaches production.
deploy/SKILL.mdIllustrative example---
name: deploy
description: Deploy the current branch to production with preflight checks and a rollback plan. Use when asked to ship, deploy or release a build.
---
1. Confirm CI is green and migrations are reviewed.
2. Deploy, watch error rates, note the rollback.Turn raw logs into a first postmortem draft while the details are fresh. This one is a real example from the Skillpack repository; it works on local files only, with no network access.
incident-summary/SKILL.mdFrom our repo ↗---
name: incident-summary
description: Summarize an incident timeline from logs into a concise postmortem draft.
---
# incident-summary
Reads a directory of log excerpts and produces a terse incident summary: timeline, impact, suspected cause, and follow-ups.Turn merged pull requests into release notes in your team's format, with the same sections every time.
release-notes/SKILL.mdIllustrative example---
name: release-notes
description: Draft release notes from pull requests merged since the last tag. Use when preparing a release or summarizing what changed between versions.
---
Group changes under Added, Changed and Fixed.
Link each line to its pull request.Give new teammates and their agents a guided tour of the codebase: where things live, how to set up, and which conventions matter.
repo-onboarding/SKILL.mdIllustrative example---
name: repo-onboarding
description: Walk a new contributor through this repository's layout, setup commands and conventions. Use when someone asks how to get started or where code lives.
---
1. Explain each top-level folder in one line.
2. Run the README setup steps and confirm they pass.For coding agents
Agents sign in through Agent Auth, personal access tokens or the Skillpack MCP server. Each connection acts with the consenting member's rights, inside the one workspace chosen at consent.
Skillpack never launches your agents or runs skill package scripts.
Keep a skill private in My Skills or share it with your organization. Skillpack can run its control plane and skill registry on your own servers, so governance stays on infrastructure you control.
Read the code, fork it, run it. No black box.
Personal skills are visible to their creator only, with no admin override.
Envelope-encrypted, referenced by id, never shown again.
Public releases pin exact, immutable versions.
Sync organization skills to a repository you own.
An open format your skills can always leave with.
Compare
Public directories help people discover skills. Gists and Slack threads pass a copy along. Skillpack is the private, versioned registry for the skills your team actually runs.
| Capability | Skillpack | Public skills directories | Gists & Slack |
|---|---|---|---|
| Private, organization-scoped skills | Creator-only My Skills plus an organization library every member shares | Public listing | Varies |
| Immutable versions | Each published version is immutable and carries a sha256 checksum | Varies | Editable in place |
| Lockfile with sha256 checksums | Installs are recorded in a lockfile; skillpack sync --frozen verifies them | Varies | None |
| Self-hostable | Yes, MIT-licensed open source | Varies | Varies |
| Install into several agents in one command | skillpack install <slug> --tools codex,claude-code,opencode | Varies | Manual copy |
| Write-only secrets | Envelope-encrypted and write-only; agents retrieve them through constrained grants | Varies | None |
| Validation before publish | skillpack skills validate checks the package; publishing validates SKILL.md, manifest, dependencies and secrets | Varies | None |
FAQ
SKILL.md is the file that defines an Agent Skill: YAML frontmatter with a name and a description, followed by Markdown instructions. The skill folder can also bundle scripts, references and templates that the agent loads only when a task needs them.
Yes. Skillpack's source code is on GitHub under the MIT License.
Yes. Skillpack runs as a Next.js web app, an API, a background worker and a one-shot migration service, backed by PostgreSQL and S3-compatible object storage. The repository includes deployment configs for Railway. If you'd rather not run it yourself, use skillpack.app.
The skillpack CLI installs skills into Claude Code, Codex and OpenCode. Choose targets with --tools claude-code,codex,opencode, and run skillpack setup to configure those integrations. Agents can also reach the Skills Hub through Agent Auth, a personal access token or Skillpack's MCP server.
Every published version is immutable. skillpack install code-review --scope project records the exact version and its sha256 checksum in .companion/skills.lock.json. Installing with --version or --pin pins that version, and skillpack update skips pinned skills unless you pass a --version. skillpack sync --frozen checks each installed copy against its locked checksum, stops on drift and restores missing skills at their locked version.
A public directory lists skills anyone can browse. Skillpack is a private registry for your organization: personal skills stay visible only to their creator, organization skills are shared with every member, and published versions never change. To share outside your organization, you can publish one pinned version as a public release.
Secrets are write-only. Skillpack accepts a secret's value only when you create or rotate it, stores it with envelope encryption and never returns it through ordinary reads. Skills reference secrets by slot, and approved agents get values only through short-lived, non-replayable grants. Logs and audit records never contain secret values.
A skill is a folder of instructions, plus optional scripts and references, that an agent reads when a task matches its description. An MCP server is a running service that exposes tools to an agent over the Model Context Protocol. Skillpack manages skills, and it also runs an MCP server so an agent platform can work with your Skills Hub, acting as the member who approved it inside one workspace.
Setup takes an afternoon. Your first shared skill can ship today.
Free and open source · MIT · runs on your own infrastructure if you want