v1.24.0

Headline: Native Hermes Agent support

Hermes Agent by Nous Research landed this February and crossed 100K stars in weeks. It ships with first-class skills at ~/.hermes/skills/ and self-evolving skill generation. Until now, using SkillKit with Hermes meant hacking the Claude adapter or writing skills twice.

v1.24.0 ends that. Hermes is a first-class target alongside Claude Code, Cursor, and Codex.

What you get

• One-command install. skillkit sync --agent hermes writes skills to .hermes/skills/ (project) or ~/.hermes/skills/ (global). Detection auto-triggers when SkillKit sees a .hermes/ directory or Hermes' AGENTS.md.
• Idempotent AGENTS.md updates. SkillKit wraps its skill manifest in <!-- SKILLS_TABLE_START --> markers inside Hermes' AGENTS.md. Your mission, SOUL, and custom rules stay untouched. Re-running skillkit sync rewrites only the managed block.
• Proper XML parsing. The Hermes adapter scopes <name> tag matching to the managed block. No false positives from <mission><name>...</name> or other tags in your AGENTS.md.
• Translate any skill to Hermes format. skillkit translate <skill> --to hermes produces a valid SKILL.md in .hermes/skills/. All 15K+ marketplace skills work.
• Slash commands. .hermes/commands/ generation via skillkit command generate --agent hermes.
• Primer support. skillkit primer emits Hermes-specific AGENTS.md scaffolding with the right section order (overview, stack, commands, conventions, structure, guidelines).

Under the hood

17 integration touchpoints wired: agent registry, discovery paths, translator format map, command generator, primer templates, sync markers, MCP runtime discovery (.hermes/skills in AGENT_DIR_MAP), and dual-source parity between packages/ and legacy src/ trees. 23+ new adapter tests in packages/agents/src/__tests__/adapters.test.ts.

Huge thanks to @RUFFY-369 for authoring the adapter in #114.

Also in this release

OpenClaw alignment with upstream (#117)

OpenClaw's config was drifting from the real openclaw/openclaw layout. Fixed:

Field	Before	Now
skillsDir	skills	.openclaw/skills
configFile	CLAUDE.md	AGENTS.md
globalSkillsDir	~/.openclaw/skills	~/.openclaw/workspace/skills
openclaw.json detection	missed	via new altConfigFiles

Back-compat preserved — the old bare skills/ path stays in altSkillsDirs so projects installed pre-1.24.0 keep working.

Discovery plumbing fixes

• SKILL_DISCOVERY_PATHS now includes .hermes/skills and .openclaw/skills. Before this fix, findAllSkills would walk past them silently.
• getSearchDirs() respects globalSkillsDir instead of deriving home paths from skillsDir. The right location for Hermes (~/.hermes/skills) and OpenClaw (~/.openclaw/workspace/skills) now gets searched.
• New AgentDirectoryConfig.altConfigFiles schema so agents with multiple marker files (like OpenClaw's openclaw.json) get detected reliably.

Release mechanics

• packages/mcp and packages/api were drifting from the release train. bump-version.sh now covers them.
• Regenerated assets/tags/v1.24.0.svg and fresh banner (docs/img/banner.svg) with Zinc palette and gradient accent on the agent count.

Agent count: 46

Agent	Format	Project dir	Global dir
Hermes Agent	SKILL.md	.hermes/skills/	~/.hermes/skills/
OpenClaw	SKILL.md	.openclaw/skills/	~/.openclaw/workspace/skills/
...44 others

Full list: https://github.com/rohitg00/skillkit#supported-agents

Upgrade

npm i -g skillkit@1.24.0

Then in a Hermes-managed project:

skillkit add <source>                 # install skills
skillkit sync --agent hermes          # write to .hermes/skills + AGENTS.md
skillkit translate <skill> --to hermes

Full changelog

v1.23.0...v1.24.0

v1.23.0 — Slim install, safer picker, brand tags

Highlights

• Slim install path. Four power features (TUI, REST server, peer mesh, agent messaging) are now optional packages. Default install is full-featured; npm install -g skillkit --omit=optional cuts to the core for a 75% smaller footprint.
• Safer first-time agent picker. No more accidental writes to 32 adapter dirs. Default option is the detected agent. All supported agents moved to the bottom with a confirm gate. Multi-select pre-ticks only the detected agent.
• Zero dead LLM SDK deps. Pruned @anthropic-ai/sdk, @google/genai, ollama, openai from @skillkit/core optional deps — referenced only as enum values, never imported. Removed ~57 transitive packages.
• Branded SVG tags under assets/tags/ with a generator script (scripts/gen-tags.mjs). SkillKit monochrome palette; fork-and-remix friendly.
• README rewrite. Punchier fold, collapsible feature blocks, matching the voice used across my other repos.

Install numbers (fresh npm cache)

Mode	Packages	Time	Deprecations	Vulns (crit/high)
v1.22.1	544	37 s	10	5 / 5
v1.23.0 default	418	18 s	2	0 / 0
v1.23.0 --omit=optional	118	9 s	0	0 / 0

Remaining 2 warnings are upstream (prebuild-install from better-sqlite3, glob@9 from @opentui/solid).

PRs merged

• #115 — Slim CLI install by making heavy deps optional
• #116 — 1.23.0 release, README rewrite, tag assets, LLM dep prune

Upgrade

npm i -g skillkit@1.23.0                # full, every feature
npm i -g skillkit@1.23.0 --omit=optional # slim, core only

All optional features degrade with a clean Cannot find package … hint if you skip them. Add any later:

npm i -g @skillkit/tui         # skillkit ui
npm i -g @skillkit/api         # skillkit serve
npm i -g @skillkit/mesh        # skillkit mesh
npm i -g @skillkit/messaging   # skillkit message

v1.22.1

What's New

Complete --json and spinner coverage (#88, #89)

• 47 commands now support --json for structured CI/CD output
• 29 commands have loading spinners for I/O operations
• Added: create, enable/disable, eval, sync, tap, translate, save, read
• Spinners: audit, fix, test, plugin, team, methodology, hook, remove

Bug fix

• save --json --agent now correctly installs to agents (was skipping file copy in JSON mode)

v1.22.0

What's New

Reusable GitHub Action (#92)

Install, scan, and manage skills in your CI/CD:

- uses: rohitg00/skillkit/.github/actions/skillkit@main
  with:
    command: install
    source: anthropics/skills

--json output for 8 commands (#89)

Machine-readable output for CI/CD pipelines:

skillkit install anthropics/skills --json
skillkit check --json
skillkit find react --json
skillkit remove my-skill --json
skillkit list --json
skillkit update --json
skillkit scan ./skills --json
skillkit publish submit --json

All JSON output is stdout-clean — no spinners, warnings, or colors leak into the payload.

Loading spinners for 5 commands (#88)

Progress feedback added to: translate, sync, eval, publish, scan.

Bug fixes

• Shell injection prevention in GitHub Action (inputs via env vars)
• All --json paths emit valid JSON on every exit path (empty results, errors, early returns)
• Spinner cleanup on failure via try/catch in eval and scan

v1.21.0

What's New

Trust Badges on Install

Install confirmation now shows trust level for each skill:

• [Official] for known sources (Anthropic, Vercel, Expo, Remotion, Supabase, Stripe)
• [Trusted] / [Review] / [Caution] for community sources via TrustScorer

Checksum-Based Update Detection

skillkit update no longer blind-clones. It checks GitHub pushed_at first, then compares SHA-256 checksums after clone. Unchanged skills are skipped. Use --force to bypass.

Centralized Lock File

All installed skills tracked in ~/.skillkit/lock.json — source, checksum, agents, timestamps. Written on install, updated on update, cleaned on remove.

Custom Taps

skillkit tap add owner/repo --name "My Skills"
skillkit tap list
skillkit tap remove owner/repo

User-managed source repositories stored at ~/.skillkit/taps.json. Tap sources appear in search results.

Federated Search by Default

skillkit find now always includes GitHub API results. No need for --federated flag. Use --no-federated to disable.

Quarantine Cleanup

Temp directories are always cleaned up via finally, even when users cancel prompts or errors occur mid-flow.

Direct Publish via CLI

skillkit publish submit creates GitHub issues directly via gh CLI with quality score, stars, and push date. Auto-publish workflow merges submissions with quality >= 75 automatically.

Documentation

• Agent count updated to 45 across all docs, website, and metadata
• Full command docs for tap, check, update, remove, publish submit
• Trust badges, lock.json, and taps.json documented in configuration and security docs

v1.20.0

What's New

Live Clone Progress

The spinner now shows real-time git download progress (Receiving objects 45% 1.2 MiB) instead of a static "Fetching from GitHub..." message.

Sparse Checkout for Large Repos

Monorepos like iii-hq/iii now use partial clone (--filter=blob:none) with sparse checkout — only skill directories are downloaded. Clones that previously took forever now complete in ~1.4s.

skillkit remove --source and --all

skillkit remove --source iii-hq/iii   # remove all skills from a repo
skillkit remove --all                  # remove everything
skillkit remove --all --force          # no confirmation

Standalone .md Skill Support

Single-file .md skills are now installed as plain files (preserving format) with sibling metadata dotfiles for tracking. skillkit read and skillkit remove --source work correctly with them.

Scanner False Positive Fixes

• Code examples in fenced blocks no longer trigger CI007/DE003
• Standard YAML frontmatter no longer triggers PI013
• Fence delimiter tracking follows CommonMark spec (backtick vs tilde)
• Unclosed frontmatter can't bypass scanning

Search Path Fix

skillkit read now searches ALL agent skill directories, not just the configured agent's. Skills installed to .claude/skills/ are found regardless of default agent setting.

Other Improvements

• --single-branch --no-tags on all clones for faster downloads
• Logo shows on --all/--yes (TTY-gated, not interactivity-gated)
• isPathInside for location detection instead of substring matching
• toAdapterInfo helper eliminates 4x duplicated object construction
• statSync wrapped in try-catch so one bad source doesn't abort all installs
• -- terminator before sparse paths prevents option injection
• stderr capped at 4KB to bound memory on verbose clones

v1.19.2

Bug Fix

• Fix composioHQ repo rename: Updated composioHQ/awesome-claude-code-skills → composioHQ/awesome-claude-skills across fetcher, marketplace CLI, and skills index (#73, closes #72)
  • skillkit recommend --update was failing with 404 due to the upstream repo rename

v1.19.1

Website

• Simplified homepage from 14 to 9 sections by removing WhySkillKit, StackBuilder, BadgeGenerator, Commands, and TeamEnterprise
• Added lightweight docs CTA linking to full documentation for commands, team workflows, and integrations
• Updated nav: replaced Extension link with Docs, removed duplicate Docs link

v1.19.0 — Server-Side Save Skill API

What's New

Server-Side Save Skill API (PR #66)

Moved Chrome extension's webpage-to-skill conversion from client-side content scripts to a server-side API route. This eliminates the Chrome Web Store rejection (content scripts don't inject on pre-existing tabs) and uses the full SkillKit extraction pipeline.

Architecture change:

Before: Extension → Content Script (Turndown) → Download
After:  Extension → POST /api/save-skill { url } → Server pipeline → Download

New: POST /api/save-skill API route (docs/fumadocs/src/app/api/save-skill/route.ts)

• Turndown HTML→Markdown conversion with GitHub URL auto-detection
• 5-source weighted tag detection (URL segments, headings, code blocks, keywords, language)
• SSRF protection blocking private IPs, link-local, and multicast addresses
• Rate limiting (10 req/min per IP)
• 5MB response body size limit

Simplified Chrome extension:

• Removed content script, scripting permission, and content_scripts manifest block
• Only 3 minimal permissions: activeTab, contextMenus, downloads
• Selection saves still work offline via Chrome's native selectionText
• Non-JSON error responses handled gracefully
• YAML-escaped URLs in frontmatter

Updated privacy policy and store listing to accurately disclose the URL→server data flow.

Upgrade

npm install -g skillkit@1.19.0

Extension

Download skillkit-extension-v1.19.0.zip below, unzip, and load in Chrome via chrome://extensions → "Load unpacked".

v1.18.0 — Issue Planner, Doctor, Session Snapshots

What's New

Issue Planner

Turn any GitHub Issue into a structured execution plan for 44 agents.

skillkit issue plan "#42"
skillkit issue plan rohitg00/skillkit#42 --agent cursor
skillkit issue list --label bug

• Parses checkboxes (- [ ]) into plan tasks
• Extracts file paths from backtick mentions
• Maps labels to tags (bug → fix, enhancement → feature)
• Adds test steps automatically (--no-tests to skip)
• No LLM calls — pure parsing, works offline
• Output works with skillkit plan validate and skillkit plan execute

Doctor Command

Diagnose setup issues and check environment health.

skillkit doctor
skillkit doctor --fix
skillkit doctor --json

• Checks Node.js, npm, pnpm, SkillKit version
• Validates config file and agent detection
• Scans project/global skills directories
• Finds broken symlinks (auto-fix with --fix)
• Validates all installed skills

Enhanced Status Command

Project overview when no active session.

skillkit status

• Shows detected agent, config, version
• Displays project/global skill counts
• Recent execution history

Session Snapshots

Save and restore full session state.

skillkit session snapshot save "before-refactor" --desc "Clean state"
skillkit session snapshot restore "before-refactor"
skillkit session snapshot list
skillkit session snapshot delete "old-snapshot"

Session Explain

Human-readable session summaries.

skillkit session explain
skillkit session explain --json

• Duration, skills used, tasks completed
• Files modified, git commits today
• Observation counts (errors, solutions, patterns)

Skill Activity Log

Track which skills are active during git commits.

skillkit activity
skillkit activity --skill code-simplifier
skillkit activity --json

Bug Fixes

• ObservationStore.readAll() — static method that reads without sessionId mismatch
• doctor uses getAdapter() per agent instead of spread-based getAllAdapters()
• doctor uses AGENT_CONFIG for global skills paths instead of hardcoded formula
• session-explainer defensively handles missing history/decisions arrays
• session-explainer resolves agent name from config with skillSource fallback
• Snapshot restore now properly restores observations

Stats

• 3,451 lines added across 25 files
• 29 new issue planner tests
• 15 activity log tests
• 9 session explainer tests
• 6 snapshot manager tests
• All 971+ tests passing