How to run a Claude Code skill on any machine

You built a skill with your agent — a repetitive task, captured once so it’s done correctly every time. Now you want it on your laptop, your desktop, the box you SSH into, and your teammates’ machines. “Everywhere,” it turns out, means a few different things. This post covers the first and simplest: getting the same skill onto every machine you control.

The instinct is to git clone it around and symlink. That works until the day the skill drifts on one machine and you can’t tell which copy is right. A registry solves exactly this — one canonical version, installed the same way everywhere, with a hash to prove nothing changed in transit.

Install it anywhere with one command

Every SkillSafe skill is cloneable over git, so Vercel’s skills CLI installs it natively:

npx skills add https://api.skillsafe.ai/@your-ns/your-skill

It auto-detects Claude Code, Cursor, Windsurf, and Codex and writes the skill into each tool’s directory. On install, the files are verified against the publisher’s tree hash — a SHA-256 over the file manifest — so a tampered mirror can’t slip a modified skill past you.

That’s the manual path. It’s fine for one skill on one machine. It stops scaling the moment you have five skills across three machines and a teammate asking “which version are you on?”

Make it reproducible with a manifest

Declare what a project needs in a checked-in skillsafe.json:

{
  "skills": {
    "@your-ns/pdf-extract": "1.2.0",
    "@vercel-labs/find-skills": "latest"
  }
}

Then, on any machine:

skillsafe sync

sync installs exactly what the manifest declares — the pinned 1.2.0 everywhere, and whatever is newest for the latest entries — and writes a lockfile so the resolved versions are recorded. Commit the manifest, and a new laptop or a new hire is one command away from the same setup. This is the difference between update (move everything to latest, good for a solo machine) and sync (install exactly this, good for a team): update chases the newest version, sync reproduces a known one.

Publishing your own skill

If the skill is yours and not yet in the registry, publish it from the directory it lives in:

skillsafe publish ./my-skill

This hashes the files, scans them with the platform scanner, negotiates a delta upload so unchanged files aren’t re-sent, and saves a private version. If you have no account, it provisions a zero-signup temporary one on the spot — good for seven days, long enough to try the whole flow before you decide to attach an email and keep it. The command prints exactly how to do that.

The skill is private when you publish. To install it on your own other machines, sign in there with the same account — skillsafe login, then skillsafe add @you/my-skill (or skillsafe sync) sends your credential, so the registry serves you your own private skill. An anonymous install can only reach public or shared skills. Sharing it with other people is a separate, deliberate step — skillsafe publish --share (or --public to list it) — which is the subject of the next question, and a different post.

For agents: it’s all HTTP

The CLI is a convenience. Every command wraps a documented endpoint — POST /v1/scan/files, POST /v1/skills/{ns}/{name}/negotiate, the save endpoint, GET /v1/blobs/{hash} to fetch each file. An agent that can’t install an npm package has the same capabilities over plain HTTP; the full API reference documents the whole path. That matters because the agent that built the skill with you can also be the one that publishes and installs it — no context-switch to a human.

Run it on your machines with the registry. When you need it to reach people who don’t have an agent, that’s when a skill becomes something else — an app — and we’ll get to that.

More ways to run a skill: shared with no install · on a schedule · in a browser