Skip to main content

skillup

Skill your agents up.
A minimal CLI to install, version, and sync skills for your AI agents.
Local-first · GitHub & Azure DevOps · Works with Claude, Gemini, and more.

uv tool install skillup


Features

  • Interactive install — pick skills from any GitHub repo release
  • Multi-repo — manage skills from multiple sources independently
  • Lock file — pins commit SHAs for reproducible installs (~/.agents/skills.lock.json)
  • Auto-update — upgrade all or specific repos to their latest release or branch head
  • Smart cache — skips redundant downloads; override with SKILLUP_CACHE_DIR
  • gh integration — uses gh CLI when available, falls back to requests
  • Azure DevOps — install skills from private Azure DevOps Git repos via DefaultAzureCredential or a PAT

Installation

uv tool install skillup

To use Azure DevOps sources, install the azure extra:

uv tool install 'skillup[azure]'

Usage

Add skills from GitHub

skillup add google/gemini-cli-skills

No releases? Falls back to main automatically. Pin a branch or add specific skills non-interactively:

skillup add anthropics/skills --branch main --skill pdf

Full GitHub URLs are also accepted:

skillup add https://github.com/anthropics/skills

Add skills from Azure DevOps

Pass the full Azure DevOps clone URL — the provider is detected automatically from the domain:

skillup add https://dev.azure.com/myorg/myproject/_git/myrepo
skillup add https://myorg.visualstudio.com/myproject/_git/myrepo   # legacy URL format

# pin a branch or add specific skills non-interactively
skillup add https://dev.azure.com/myorg/myproject/_git/myrepo --branch develop --skill my-skill

Azure DevOps repos are stored in the lock file under the key azdo:org/project/repo and participate in the shared update and sync commands just like GitHub repos.

Authentication

Authentication is resolved in this order:

  1. AZURE_DEVOPS_TOKEN env var — a Personal Access Token (PAT) with Code → Read scope, or any valid bearer token.
  2. DefaultAzureCredential (requires the azure extra) — tries, in order: environment variables (AZURE_CLIENT_ID / AZURE_CLIENT_SECRET / AZURE_TENANT_ID), workload identity, managed identity, Azure CLI (az login), Azure Developer CLI, and interactive browser login.

The recommended approach for developer machines is DefaultAzureCredential via az login:

uv tool install 'skillup[azure]'
az login
skillup add https://dev.azure.com/myorg/myproject/_git/myrepo

Remove skills

skillup remove

Update skills

skillup update                              # all repos
skillup update --repo google/gemini-cli-skills  # one repo

Sync (restore from lock file)

skillup sync

Installs skills at the exact pinned SHAs from the lock file — useful for new machines.

Migrate from NPX skills CLI

skillup migrate                       # reads skills-lock.json from repo root
skillup migrate path/to/skills-lock.json

Skill definition

A folder is recognized as a skill when it lives inside a skills/ directory at the repo root and contains a SKILL.md file.

Development

uv sync          # install deps
uv run skillup --help
uv run pytest
uv run pyright skillup

License

MIT

Metadata

Release files for skillup 0.7.3

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for skillup 0.7.3
File Size Uploaded Provenance Actions
skillup-0.7.3.tar.gz 55.6 kB With provenance Details for skillup-0.7.3.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for skillup 0.7.3
File Interpreter ABI Platform Actions
skillup-0.7.3-py3-none-any.whl Python 3 none any Details for skillup-0.7.3-py3-none-any.whl

Total release size: 73.7 kB

Release files / skillup-0.7.3.tar.gz

Download URL skillup-0.7.3.tar.gz
Size 55.6 kB
Tags Source
SHA-256 checksum
How to use checksums
74038a265ec4a004c1f8a46061e5f894ddbacb8bedf6568e62d59d85824790e6
BLAKE2b-256 checksum
How to use checksums
7d398a7d3c655a42d7fbef75517849ca1bcf78cb1faf7dc4d56917a890626904
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.12

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jun 19, 2026.

Transparency log

Release files / skillup-0.7.3-py3-none-any.whl

Download URL skillup-0.7.3-py3-none-any.whl
Size 18.1 kB
Tags Python 3
SHA-256 checksum
How to use checksums
655aad6ae87d34ff8321a4b322ca606dfa8082b91bf069e43c700d0f561c17ed
BLAKE2b-256 checksum
How to use checksums
dbb184cf61edc2d748fecd3e85e8fbfd2b912eff8f56a6627ba5e570d95830a2
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.12

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jun 19, 2026.

Transparency log

Security for skillup 0.7.3

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for skillup-0.7.3.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jun 19, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page