docs/getting-started

Getting Started

v0.4.16

The package manager for AI agent skills.

vskill scans, verifies, and installs AI skills across 49 agent platforms. Every install goes through a security pipeline — static pattern analysis, LLM intent review, and provenance verification.

── Quick install ───────────────────────────────────

# No install required — run with npx
npx vskill install remotion-best-practices

# Install by name from the registry
npx vskill install remotion-best-practices

# Browse a repo interactively
npx vskill install remotion-dev/skills

# Install a plugin (Claude Code)
npx vskill install --repo anton-abyzov/vskill --plugin frontend

# Install globally
npm install -g vskill

── How it works ────────────────────────────────────

Every install flows through four stages. No stage can be skipped. There is no `--skip-scan` flag.

  ┌──────────┐     ┌──────────┐     ┌──────────┐     ┌──────────┐
  │  Source   │────>│   Scan   │────>│  Verify  │────>│ Install  │
  │          │     │          │     │          │     │          │
  │ GitHub   │     │ 52 rules │     │ LLM      │     │ Pin SHA  │
  │ Registry │     │ Blocklist│     │ analysis │     │ Lock ver │
  │ Local    │     │ Patterns │     │ Intent   │     │ Symlink  │
  └──────────┘     └──────────┘     └──────────┘     └──────────┘

── Three-tier verification ─────────────────────────

Scanned

Baseline

52 deterministic pattern checks against known attack vectors. Every install, every time.

Verified

Recommended

Pattern scan + LLM-based intent analysis across 6 semantic dimensions.

Certified

Highest

Full manual security review by the vskill team.

The vskill.lock file records the SHA-256 hash, scan date, and trust tier for every installed skill. Running vskill update diffs against the locked version and re-scans before applying any changes.

── 49 agent platforms ──────────────────────────────

vskill auto-detects your installed agents and installs skills to all of them simultaneously.

├── CLI & TerminalClaude Code, Cursor, Copilot, Windsurf, Codex, Gemini CLI, Amp, Cline, Roo Code, Goose, Aider, Kilo, Devin, OpenHands, and more

├── IDE ExtensionsVS Code, JetBrains, Zed, Neovim, Emacs, Sublime Text, Xcode

└── Cloud & HostedReplit, Bolt, v0, GPT Pilot, Plandex, Sweep

Target a specific agent with --agent cursor. vskill handles agent-specific config paths and formats automatically.

── Plugin marketplace ──────────────────────────────

42 expert skills across 13 domain plugins. Install a plugin and invoke its skills with /plugin:skill in your agent.

# Install a single plugin
npx vskill install --repo anton-abyzov/vskill --plugin mobile

# Install everything
npx vskill install --repo anton-abyzov/vskill --all

# Invoke in your agent
/frontend:nextjs     /infra:aws        /mobile:flutter
/ml:rag              /testing:mutation  /security:patterns

frontendreact-native, nextjs, figma, design, i18n

infraaws, azure, gcp, github-actions, devsecops, opentelemetry, secrets

mobileflutter, swiftui, jetpack, expo, capacitor, deep-linking, testing, appstore

mlrag, langchain, huggingface, fine-tuning, edge

testingperformance, accessibility, mutation

backendjava-spring, rust

kafkastreams-topology, n8n

confluentkafka-connect, ksqldb, schema-registry

paymentsbilling, pci

securitypatterns

blockchainblockchain-core

google-workspacegws

skillsscout

── Commands ────────────────────────────────────────

vskill install <source>Install skill after security scan

vskill find <query>Search the verified-skill.com registry

vskill scan <path>Scan a skill without installing

vskill listShow installed skills and trust status

vskill remove <skill>Remove an installed skill

vskill update [skill]Update with diff scanning (--all for all)

vskill audit [path]Full project security audit with LLM analysis

vskill info <skill>Show skill details and verification status

vskill submit <source>Submit a skill to the registry

vskill blocklistManage blocked malicious skills

vskill initInitialize vskill in a project

Install flags

--yes, -yAccept defaults, no prompts

--global, -gInstall to global scope

--copyCopy files instead of symlinking

--skill <name>Pick a specific skill from a multi-skill repo

--plugin <name>Pick a plugin from a marketplace repo

--repo <owner/repo>Remote GitHub repo as plugin source

--agent <id>Target a specific agent (e.g., cursor)

--forceInstall even if blocklisted

--allInstall all skills from a repo

── Security audit ──────────────────────────────────

Scan entire projects — not just skills. Use in CI to block malicious skills before they reach production.

vskill audit                          # scan current directory
vskill audit --ci --report sarif      # CI-friendly SARIF output
vskill audit --severity high,critical # filter by severity

── SpecWeave integration ───────────────────────────

vskill is the package manager for SpecWeave — the spec-first AI development framework (v1.0.439). Install SpecWeave skills just like any other:

# Install the SpecWeave plugin
npx vskill install --repo anton-abyzov/vskill --plugin specweave

# Scout recommends the right skills for your project
/skills:scout

Skills installed via vskill are automatically scanned before loading into SpecWeave. The vskill.lock file ensures your SpecWeave plugin chain is version-pinned and reproducible.

── Skills vs plugins ───────────────────────────────

├── SkillsSingle SKILL.md files that work with any of the 49 supported agents. Drop a SKILL.md into the agent's commands directory — no configuration needed.

└── PluginsMulti-component containers for Claude Code. Bundle skills, hooks, commands, and agents under a single namespace with enable/disable support.

Security Guidelines >>Submit a skill >>Browse the registry >>