Skill your agents up.
A minimal CLI to install, version, and sync skills for your AI agents.
Local-first · GitHub & Azure DevOps · Works with Claude, Gemini, and more.
uv tool install skillup
Features
- Interactive install — pick skills from any GitHub repo release
- Multi-repo — manage skills from multiple sources independently
- Lock file — pins commit SHAs for reproducible installs (
~/.agents/skills.lock.json) - Auto-update — upgrade all or specific repos to their latest release or branch head
- Smart cache — skips redundant downloads; override with
SKILLUP_CACHE_DIR - gh integration — uses
ghCLI when available, falls back torequests - Azure DevOps — install skills from private Azure DevOps Git repos via
DefaultAzureCredentialor a PAT
Installation
uv tool install skillup
To use Azure DevOps sources, install the azure extra:
uv tool install 'skillup[azure]'
Usage
Add skills from GitHub
skillup add google/gemini-cli-skills
No releases? Falls back to main automatically. Pin a branch or add specific skills non-interactively:
skillup add anthropics/skills --branch main --skill pdf
Full GitHub URLs are also accepted:
skillup add https://github.com/anthropics/skills
Add skills from Azure DevOps
Pass the full Azure DevOps clone URL — the provider is detected automatically from the domain:
skillup add https://dev.azure.com/myorg/myproject/_git/myrepo
skillup add https://myorg.visualstudio.com/myproject/_git/myrepo # legacy URL format
# pin a branch or add specific skills non-interactively
skillup add https://dev.azure.com/myorg/myproject/_git/myrepo --branch develop --skill my-skill
Azure DevOps repos are stored in the lock file under the key azdo:org/project/repo and participate in the shared update and sync commands just like GitHub repos.
Authentication
Authentication is resolved in this order:
AZURE_DEVOPS_TOKENenv var — a Personal Access Token (PAT) with Code → Read scope, or any valid bearer token.DefaultAzureCredential(requires theazureextra) — tries, in order: environment variables (AZURE_CLIENT_ID/AZURE_CLIENT_SECRET/AZURE_TENANT_ID), workload identity, managed identity, Azure CLI (az login), Azure Developer CLI, and interactive browser login.
The recommended approach for developer machines is DefaultAzureCredential via az login:
uv tool install 'skillup[azure]'
az login
skillup add https://dev.azure.com/myorg/myproject/_git/myrepo
Remove skills
skillup remove
Update skills
skillup update # all repos
skillup update --repo google/gemini-cli-skills # one repo
Sync (restore from lock file)
skillup sync
Installs skills at the exact pinned SHAs from the lock file — useful for new machines.
Migrate from NPX skills CLI
skillup migrate # reads skills-lock.json from repo root
skillup migrate path/to/skills-lock.json
Skill definition
A folder is recognized as a skill when it lives inside a skills/ directory at the repo root and contains a SKILL.md file.
Development
uv sync # install deps
uv run skillup --help
uv run pytest
uv run pyright skillup
License
MIT
Metadata
Release files for skillup 0.7.3
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| skillup-0.7.3.tar.gz | 55.6 kB | With provenance | Details for skillup-0.7.3.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| skillup-0.7.3-py3-none-any.whl | Python 3 | none | any | Details for skillup-0.7.3-py3-none-any.whl |
Total release size: 73.7 kB
Release files / skillup-0.7.3.tar.gz
| Download URL | skillup-0.7.3.tar.gz |
|---|---|
| Size | 55.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
74038a265ec4a004c1f8a46061e5f894ddbacb8bedf6568e62d59d85824790e6
|
|
BLAKE2b-256 checksum How to use checksums |
7d398a7d3c655a42d7fbef75517849ca1bcf78cb1faf7dc4d56917a890626904
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 19, 2026.
Transparency logRelease files / skillup-0.7.3-py3-none-any.whl
| Download URL | skillup-0.7.3-py3-none-any.whl |
|---|---|
| Size | 18.1 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
655aad6ae87d34ff8321a4b322ca606dfa8082b91bf069e43c700d0f561c17ed
|
|
BLAKE2b-256 checksum How to use checksums |
dbb184cf61edc2d748fecd3e85e8fbfd2b912eff8f56a6627ba5e570d95830a2
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 19, 2026.
Transparency logSecurity for skillup 0.7.3
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for skillup-0.7.3.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 19, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.