Docs · skillport CLI
One command, checksum verified
One command installs a vetted skill into your agent’s skills directory, with the package checksum verified end to end. Node 20 or later is required; no global install needed.
npx @skillporthq/cli add anthropic-oss/pdf-toolsQuickstart
Three steps to a first install
Sign in with GitHub
Create a free account; your first API key is issued during onboarding and shown exactly once.
Store your key
Run npx @skillporthq/cli login and paste the key, or set SKILLPORT_API_KEY in your environment for CI.
Install a skill
Run npx @skillporthq/cli add <publisher>/<skill>. The checksum is verified before anything touches disk.
Keys
Authentication
Installs are authenticated with a per-user API key (free). Sign in with GitHub and your first key is issued during onboarding; it is shown exactly once, so store it somewhere sensible. The CLI resolves your key in this order:
- The
--keyflag on the command - The
SKILLPORT_API_KEYenvironment variable (recommended for CI) ~/.skillport/config.json, written byskillport login
Reference
Commands
| Command | Usage |
|---|---|
| login | npx @skillporthq/cli login |
| add | npx @skillporthq/cli add <publisher>/<skill>[@version] |
| list | npx @skillporthq/cli list |
| remove | npx @skillporthq/cli remove <publisher>/<skill> |
| update | npx @skillporthq/cli update [publisher/skill] |
| info | npx @skillporthq/cli info <publisher>/<skill> |
skillport login
npx @skillporthq/cli loginPrompts for your API key, validates it against the marketplace, and stores it in ~/.skillport/config.json (permissions 0600 on POSIX systems). Create keys from your account page after signing in.
skillport add
npx @skillporthq/cli add <publisher>/<skill>[@version]Installs a skill. Without a version it installs the latest published version and pins it in the lockfile. The CLI verifies the package's SHA-256 checksum against the marketplace's record before extracting, and refuses archives containing absolute paths, path traversal, or symlinks.
skillport list
npx @skillporthq/cli listShows every skill recorded in the lockfile for the current project, with its pinned version.
skillport remove
npx @skillporthq/cli remove <publisher>/<skill>Deletes the skill's directory and removes its lockfile entry.
skillport update
npx @skillporthq/cli update [publisher/skill]Updates one skill, or every skill in the lockfile when no name is given, to the latest published version. This is also the remediation path when a version you have installed is yanked for a security issue.
skillport info
npx @skillporthq/cli info <publisher>/<skill>Prints the skill's metadata: latest published version, scan and review dates, price, and supported platforms.
Targets
Where skills are installed
The CLI detects the agents present in your project and installs into the matching directory:
| Platform | Project directory |
|---|---|
| Claude Code | .claude/skills/<skill>/ |
| Generic | ./skills/<skill>/ |
Further platform targets are on the roadmap; the catalogue’s platform labels already tell you where a skill is designed to run.
Provenance
The lockfile
Every install writes skillport.lock in the project root, recording the skill name, exact version, package checksum, and install time. It answers the question that matters for trust: which exact scanned and reviewed version is on this machine. Commit it to your repository for deterministic reinstalls across your team and CI.
Troubleshooting
Errors you might see
- Invalid or revoked key. Run
skillport loginwith a fresh key from your account page. - Entitlement required. The skill is paid and your account does not hold a licence; the error includes the purchase link.
- Rate limited. The CLI waits and retries per the server’s instruction; heavy CI loops should cache installs.
- Version yanked. The requested version was withdrawn for a safety issue; the error names the version to move to, and
skillport updategets you there. - Cannot reach marketplace. A network or DNS failure, reported distinctly so it is never mistaken for an authentication problem.