{"id":"c12e30e0-8517-4066-a73e-7de0189cdfb1","slug":"claude-skillpm","kind":"skill","name":"Claude-SkillPM","summary":"Package manager and registry for Claude AI skills. Discover, publish, and manage reusable skills with versioning, security validation, and community feedback.","owner":"bogdanticu88","repoUrl":"https://github.com/bogdanticu88/Claude-SkillPM","license":"MIT","licenseTier":"permissive","trust":"community","stars":0,"match":null,"fewStars":true,"format":"skill","createdAt":"2026-03-27T23:40:54.000Z","addedAt":"2026-10-21T13:38:54.505Z","logoUrl":"https://avatars.githubusercontent.com/u/248566147?u=0ef9446322ba25d6ca627aeb4795435dbc1e737c&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools","cloud-infra"],"tags":["ai","api","cli","docker","fastapi","go","llm","open-source"],"runtime":"go","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-23T20:06:18.160Z","sample":false,"url":"https://conduits.dev/tools/claude-skillpm","language":"Python","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# SkillPM\n<img width=\"487\" height=\"161\" alt=\"2026-03-28_02-47\" src=\"https://github.com/user-attachments/assets/3951ab24-47ee-417e-9dbf-5dc9b5a1d760\" />\n\n \n [![Tests](https://github.com/bogdanticu88/Claude-SkillsManager/actions/workflows/ci.yml/badge.svg)](https://github.com/bogdanticu88/Claude-SkillsManager/actions)\n [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n [![Go](https://img.shields.io/badge/Go-1.21+-00ADD8?logo=go)](https://golang.org)\n [![Python](https://img.shields.io/badge/Python-3.11+-3776AB?logo=python)](https://www.python.org)\n [![FastAPI](https://img.shields.io/badge/FastAPI-0.100+-009688?logo=fastapi)](https://fastapi.tiangolo.com)\n  [![Tests](https://github.com/bogdanticu88/Claude-SkillsManager/actions/workflows/ci.yml/badge.svg)](https://github.com/bogdanticu88/Claude-SkillsManager/actions)\n [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n [![Release](https://img.shields.io/badge/Release-v1.0.0-blue.svg)](https://github.com/bogdanticu88/Claude-SkillsManager/releases)\n [![Go](https://img.shields.io/badge/Go-1.21+-00ADD8?logo=go)](https://golang.org)\n [![Python](https://img.shields.io/badge/Python-3.11+-3776AB?logo=python)](https://www.python.org)\n [![FastAPI](https://img.shields.io/badge/FastAPI-0.100+-009688?logo=fastapi)](https://fastapi.tiangolo.com)\n [![Docker](https://img.shields.io/badge/Docker-Supported-2496ED?logo=docker)](https://docker.com)\n [![Coverage](https://img.shields.io/badge/Coverage-75%25+-green.svg)](https://github.com/bogdanticu88/Claude-SkillsManager)\n [![Status](https://img.shields.io/badge/Status-Production%20Ready-success.svg)](#)\n \n \nPackage manager for Claude AI skills.\n\nSkillPM is a registry and package manager that lets you discover, publish, and manage reusable skills for Claude in a central location. Instead of searching GitHub issues and gists for skill implementations, you register skills to SkillPM, set versioning and dependencies, collect community feedback, and install them with a single command.\n\nIt solves the problem that skills today are scattered across repositories with no discovery mechanism, no security vetting, and no way to manage versions or dependencies. SkillPM replaces that with a structured workflow: publish a skill with a manifest, run it through security checks, manage versions, track what skills depend on what, and let teams install them reliably.\n\n---\n\n## What it does\n\nSkillPM provides five main pieces:\n\n**Skill registration and discovery.** Register a skill with a manifest file that defines its name, version, entry point, language, and capabilities. Search and browse all registered skills. Filter by language, tags, or author.\n\n**Version management.** Track multiple versions of a skill. When you publish version 1.1.0 after 1.0.0, SkillPM detects whether the changes are breaking, compatible, or patches. Display breaking changes clearly so users know when they need to update code that depends on the skill.\n\n**Security and validation.** Validate skill manifests against a schema. Hash API keys with Argon2 so credentials are never stored plaintext. Limit requests per user. Check skill names against a reserved list. Enforce input constraints on all fields.\n\n**Community feedback.** Let users review and rate skills. Capture review text and a numeric rating. Display average rating and review count on the skill page. Track who reviewed what to prevent duplicate reviews.\n\n**Automated evidence collection.** Connect to GitHub, Azure DevOps, Jira, and ServiceNow to pull evidence of testing, security, and maintenance. Connectors are opt-in per skill, and credentials are encrypted.\n\n---\n\n## Architecture\n\nSkillPM is a standard two-tier application with a Go CLI and a Python FastAPI backend.\n\n```\nskillpm/\n├── main.go                 # Go CLI application\n│   ├── validate            # Validate skill manifests\n│   ├── search              # Search registry\n│   ├── install             # Install skills with dependency resolution\n│   ├── publish             # Publish a skill to the registry\n│   └── list                # List installed skills\n├── registry/               # FastAPI backend\n│   ├── routers/            # REST endpoints\n│   │   ├── skills.py       # Skill CRUD\n│   │   ├── authors.py      # User registration and API keys\n│   │   ├── reviews.py      # Ratings and feedback\n│   │   ├── search.py       # Search across skills\n│   │   └── compatibility.py# Breaking change analysis\n│   ├── models/             # SQLAlchemy ORM\n│   ├── schemas/            # Pydantic request/response models\n│   ├── services/           # Business logic (versioning, breaking changes)\n│   ├── middleware/         # Auth, rate limiting, logging\n│   └── db/                 # Database setup, migrations\n├── tests/                  # Pytest test suite (108+ tests)\n├── docs/                   # Architecture and design documents\n├── examples/               # Example skills for reference\n├── docker-compose.yml      # Local development stack\n└── .github/workflows/ci.yml# GitHub Actions CI pipeline\n```\n\n**Data model:**\n\n```\nUser (author account, API key hash, rate limit counters)\nSkill (name, version, description, entry point, language)\nSkillMetadata (tags, target LLMs, capabilities, dependencies)\nSkillVersion (version history, changelog, signature)\nReview (user, skill, rating, comment)\nDownload (analytics, usage tracking)\nOrganization (team workspace, member list)\n```\n\nThe backend uses FastAPI. The database is SQLite for development and PostgreSQL for production. The frontend provides a REST API for the CLI and a web dashboard for browsing and publishing skills. Authentication uses API keys with JWT bearer tokens.\n\n---\n\n## Features\n\nCurrent release includes Stage 1 and Stage 2 capabilities:\n\n**Stage 1:**\n- Skill search, filtering, and discovery\n- Semantic versioning with breaking change detection\n- User registration and API key management\n- Reviews and ratings system\n- Strict input validation on all endpoints\n- Per-user rate limiting (100 requests/hour)\n- Request size limiting (1 MB)\n- Request ID tracking for debugging\n- Standardized error responses\n- Argon2 API key hashing\n- CORS configuration (not wide-open)\n- Database migration infrastructure with Alembic\n- Docker Compose setup for local development\n- Docker multi-stage build for production\n- Complete test suite (108+ tests, 75%+ coverage)\n- Deployment guide for production\n- Operations runbook for incident response\n\n**Stage 2:**\n- GPG signing and verification for skill integrity\n- Docker sandboxing for secure skill execution with seccomp profiles\n- Skill workflow execution with isolation\n- Organization and team workspace support\n- Web dashboard frontend for skill browsing and publishing\n- Advanced skill composition and dependencies\n\n**Planned (Stage 3):**\n\n- Automated evidence collection from GitHub, Azure DevOps, Jira, ServiceNow\n- Connector configuration UI\n- Multi-tenant workspace isolation\n- Skill templates and scaffolding\n- Advanced analytics and telemetry\n\n---\n\n## Quick start\n\nPrerequisites: Go 1.21+, Python 3.11+, Docker and Docker Compose.\n\nClone the repository:\n\n```bash\ngit clone https://github.com/yourusername/skillpm.git\ncd skillpm\n```\n\nStart the development stack:\n\n```bash\ndocker compose up -d\n```\n\nThis starts a PostgreSQL database, the FastAPI registry API (port 8000), and loads initial data.\n\nBuild the CLI:\n\n```bash\ngo build -o skillpm\n```\n\nRegister an author account:\n\n```bash\ncurl -X POST http://localhost:8000/api/v1/authors/register \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"username\": \"yourname\",\n    \"email\": \"you@example.com\"\n  }'\n```\n\nThe response includes your API key. Save it.\n\nPublish a skill:\n\n```bash\n./skillpm publish examples/image-analyzer/skill.yaml --api-key $API_KEY\n```\n\nSearch for skills:\n\n```bash\n./skillpm search vision\n```\n\nList skills:\n\n```bash\n./skillpm list\n```\n\n---\n\n## Development setup\n\nIf you want to work on the codebase without Docker:\n\nRequirements: Python 3.12+, Go 1.21+, PostgreSQL, Redis.\n\nBackend:\n\n```bash\ncd registry\npip install -r requirements.txt\nexport DATABASE_URL=\"postgresql://user:password@localhost/skillpm\"\npython -m uvicorn main:app --reload\n```\n\nAPI docs are at http://localhost:8000/docs.\n\nCLI:\n\n```bash\ngo build -o skillpm\n./skillpm --help\n```\n\nRunning tests:\n\n```bash\ncd registry\npython -m pytest ../tests/ -v --cov=. --cov-report=html\n```\n\n---\n\n## Configuration\n\nAll configuration is passed via environment variables. See `.env.example` for the full list.\n\nRequired:\n\n```bash\nSECRET_KEY            # Application secret, at least 32 characters\nJWT_SECRET            # JWT signing key, at least 32 characters\nDATABASE_URL          # PostgreSQL connection string\nREDIS_URL             # Redis connection string\n```\n\nOptional:\n\n```bash\nLOG_LEVEL             # DEBUG, INFO, WARNING, ERROR (default: INFO)\nCORS_ORIGINS          # Comma-separated allowed origins\nMAX_BODY_SIZE         # Request size limit in bytes (default: 1000000)\nRATE_LIMIT_REQUESTS   # Requests per window (default: 100)\nRATE_LIMIT_WINDOW     # Window size in seconds (default: 3600)\n```\n\n---\n\n## Testing\n\nThe test suite covers API endpoints, security validation, error handling, and business logic.\n\nRun all tests:\n\n```bash\ncd registry\npython -m pytest ../tests/ -v\n```\n\nRun with coverage:\n\n```bash\npython -m pytest ../tests/ --cov=. --cov-report=html\n```\n\nRun a specific test file:\n\n```bash\npython -m pytest ../tests/test_security.py -v\n```\n\nThe CI pipeline (`.github/workflows/ci.yml`) runs tests on Python 3.11, 3.12, and 3.13 whenever code is pushed or a PR is opened.\n\n---\n\n## Deployment\n\nFor production deployment, see DEPLOYMENT.md.\n\n---\n\n## Roadmap\n\n**Stage 1 (Complete):** Basic registry, skill discovery, reviews, versioning.\n\n**Stage 2 (Complete):** GPG signing, Docker sandboxing, workflow execution, web dashboard, organizations.\n\n**Stage 3 (Planned):** Evidence connectors (GitHub, Azure DevOps, Jira, ServiceNow), connector UI, multi-tenant workspaces, skill templates.\n\n---\n\n## License\n\nMIT. See LICENSE file.\n\n---\n\n## Contributing\n\nWe welcome contributions. Please read CONTRIBUTING.md for:\n\n- Code style guidelines\n- Testing requirements\n- Pull request process\n- Setting up your development environment\n\n---\n\nBuilt for the Claude community.\n\n\n"}