@hasna/skills weekly downloads statistics

@hasna/skills

Skills library for AI coding agents — discover, pin, and run reusable capabilities through the Skills CLI and MCP server. Registers with Claude, Codewith, Codex, OpenCode and Cursor, and works with any MCP host.

Install The CLI

Requires Bun 1.3+.

Private skill catalogs

The public package provides the CLI, API, SDK, hooks, and runtime. A skill's instructions and executable bundle belong to the organization that publishes them. API reads require authentication and use that organization's catalog, including tag filters, versions, and downloads. An empty account starts empty; neither a repository checkout nor files on the server machine supply defaults. Server startup and upgrades never import a bundled catalog.

Each operator can use their own compatible server and storage. S3 is optional: the server supports durable SQLite or PostgreSQL and database-backed bundles when no S3 bucket is configured. Publishing through an authenticated account does not publish to GitHub or npm. Keep private source documents and executable payloads outside public software repositories.

Quick Start

skills login opens your browser to sign in to https://skills.md and stores an API key for this machine in ~/.hasna/skills/config/credentials (owner-only), together with the server it belongs to. On a terminal it then offers to register Skills with your coding agents (skills setup agents). Check who you are with skills whoami.

skills logout signs out the active profile. It deletes the key that skills login stored, then revokes it on the server that issued it when login minted it (a key you added with --api-key is only deleted, unless you pass --revoke). It exits 0 only when you are signed out. It exits non-zero, naming the reason, when revocation did not complete or is not supported (it then says where to revoke the key by hand), when another credential is still active (an environment variable, the Keychain or another selected profile, which it never changes), when the profile holds a credential skills login did not store (left in place), or when the local deletion failed.

• No browser on this machine: skills login --device prints a code to approve on another device, then skills login --poll finishes the same sign-in. • An API key you already have: printenv MY_SKILLS_KEY | skills login --api-key reads it from stdin, verifies it and stores it. Nothing is echoed. • An email code instead of the browser: skills login --email you@example.com. Interactive code input is masked. For an agent or headless terminal, first request a code with skills login --email you@example.com --json, then send the fresh code through stdin to `skills login --email you@example.com --code-stdin --json`. This finishes the same sign-in without requesting another code. Keep the code out of shell commands, arguments and logs. • Running skills in a terminal opens the interactive browser. It also works signed out and has the same account commands: /login, /logout, /whoami.

Your own server

The software is open source and every command works against your own compatible Skills server. Sign in to it with skills login --url https://skills.example.com; the URL is stored with the key, so later commands use that server without flags. HASNA_SKILLS_API_URL selects a server for one shell. skills setup --api-url records a server without signing in.

Fleet stations

Stations provisioned with a fleet key keep using the internal gateway https://api.hasna.com/skills; versioned requests use /skills/v1. A key with no recorded URL (the Keychain item, HASNA_SKILLS_API_KEY alone, or an older credentials file) always stays on that gateway and is never sent anywhere else. The gateway has no interactive login service, so on such a station skills login says so and sends nothing. A stored gateway credential or vault reference is preserved even with --url. Use a separate credential profile for customer sign-in: skills --profile skillsmd login. Later product commands use that profile too, for example skills --profile skillsmd whoami --json; fleet commands keep their original configuration. Obtain a workspace API key through your administrator's provisioning process and configure it using the credential resolution below. Check the selected identity and available capabilities before syncing:

A workspace administrator creates a shared profile selecting published skills by exact version and SHA-256 digest. Consumers sync that profile into a verified Skills cache, then load instructions through the CLI. Replace default with your assigned profile; these examples assume it selects pdf-generate@0.5.2:…

Description from the npm listing.