One skill library for your AI coding tools.
Claude Code, Codex, Grok and AGY read the same signed skills from one install on each machine. Every skill version is signed offline, and your machine checks the signature before your agent reads it.
Free tier, no cardChecked on every readTwo-step sign-in for every account
A skill is only as safe as the path it took to you.
Most skill marketplaces are a list of links. SkilVault signs every version offline and makes your machine prove it — so even a hacked server cannot change what your agent reads.
Read and run
Every skill is read, run and reviewed before it can be published.
Signed offline
SkilVault signs each version with a key that never touches the server.
Published
The server serves exactly what was signed, and takes no writes from the internet.
Checked on your machine
The client verifies the signature and the pack's checksum before anything is read.
No rollbacks
Once you have used a newer version, an older one is refused.
If a skill is altered, your client refuses it.
Verification is silent when everything checks out and loud when it does not. A skill that is not signed by a trusted key is never handed to your agent.
$ skilvault read changelog-entry-on-completion
skilvault: refusing 'changelog-entry-on-completion' v1.0.1: it is not signed by a trusted keyConnect once. Your agent does the rest.
No cloning, no vendoring, no hunting through lists of unreviewed links.
Connect once
Choose your skills, then connect from your dashboard: it installs the client and saves your key. Works on any machine or CI runner.
skilvault listFind by task
Claude Code and Codex also get a prompt hook that names the skills fitting each request. Grok and AGY have no usable prompt hook, so there the agent runs skilvault use to find one. Either way the whole catalog is matched on your machine, and the request is not sent.
skilvault use "review a pull request"Read on demand
Skills are fetched when used and checked against SkilVault's offline signature. Nothing is loaded into your agent's context until it is needed.
skilvault read commit-lintSee what a skill does before you install it.
skilvault-library
Signed topic indexes for discovering SkilVault skills and resolving exact names.
slide-visual-makeover
Condenses text-heavy presentation slides into visual storytelling by rewriting titles as claims, recommending a layout for each slide, matching data to the right chart type, and suggesting icons and imagery while moving cut text into speaker notes. Use when the user shares slide text or an outline and asks to make it more visual, trim wording, or improve layout and chart choices. Not for building a full deck from a one-line prompt, writing slide code such as HTML or Slidev, or exporting rendered files.
add-uploadthing-components
Guides a developer through choosing, installing and verifying UploadThing file upload components from the Elements registry in a React project that already has shadcn set up, by checking components.json, recommending from the seven available slugs, assembling the exact npx shadcn add command for the user to run personally, and confirming what the install produced. Use when the user mentions UploadThing or wants an upload button, drag-and-drop dropzone, avatar uploader with crop, file card, image gallery, paste-to-upload area or upload progress indicator in a shadcn-based React app. Not for building upload backends or file routers, for non-React frameworks, or for managing UploadThing accounts, keys or billing.
angular-signal-components
Builds Angular v20+ standalone UI components with signal inputs, outputs and models, host objects in the component decorator, native template control flow, content projection with signal queries, render-phase callbacks, defer blocks, accessible custom controls, and signal-held state in root services. Use when creating an Angular component, converting decorator-style inputs, outputs, host bindings or structural directives to the signal APIs, or wiring data flow between parent and child components. Not for AngularJS, NgModule-first apps, routing, reactive forms, or unit testing.
ask-before-building
Runs a short multiple-choice interview through the AskUserQuestion tool to turn a vague, ambiguous, or underspecified request into a confirmed specification, then records the change as a verbatim before-and-after with a per-point decisions table. Every decision in the final spec must trace to the requester's own words or an option they selected, never to a default supplied by the agent. Use when the user asks to clarify, refine, or scope requirements, or when a fuzzy feature ask, bare bug report, or open-ended goal needs converting into an actionable spec before work begins. Not for executing an already well-specified task, for strategy blind-spot analysis, or for content-versus-form reframing.
audit-npm-dependencies
Read-only review of npm dependency health in JavaScript and TypeScript projects. Detects unused and misfiled packages, imports with no declared dependency, dead exports and orphaned files, libraries duplicating one role, tree-shaking misses, published advisories, and stale versions, using analyzers already installed in the project plus grep and glob fallbacks, grades each verified finding by severity, and checks Vitest configuration deprecations and leftover Jest artifacts when Vitest is present. Use when the user asks to audit, prune, or review dependencies, investigate bundle bloat, or question specific package.json entries. Not for installing, updating, or removing packages, applying security fixes, non-JavaScript ecosystems, or dictating the report's layout.
More than a list. A library that works with you.
Skill chains
Link skills into an ordered chain your agent reads step by step. A step your plan cannot read is named, and the chain carries on. Available on plans that include chains.
Loaded only when needed
Each CLI gets its own folder of lightweight entries, so your agent's context stays small until a skill is actually read.
Learns on your machine
Rules you confirm are kept as notes on your machine and shown after the skill. Sharing back is off unless you turn it on.
Suggestions that fit the project
Open a repo and SkilVault names the skills that match its stack — once per session, never on every edit.
Two-step sign-in, everywhere
Every account uses two-step verification, with passkeys supported, and keys travel in a header rather than the address.
Start free. No card required.
Start free with five active skills for automatic loading and manual access to the whole library.