# SkillSafe

> The secured skill registry for AI agents. Scan, save, share, install, and verify AI skills (Claude Code, Cursor, Windsurf, Codex) with dual-side cryptographic verification.

SkillSafe is a hosted registry for AI agent skills. Skills are saved privately by default — sharing creates a link with optional public visibility. Shared skills require a security scan report and support dual-side verification: the sharer scans before sharing, the consumer re-scans after download, and the server compares both. Every shared skill gets a trust verdict: `verified`, `divergent`, or `critical`.

## Install

- [Desktop app](https://app.skillsafe.ai/): The AI SkillSafe desktop app (macOS / Windows / Linux) is the recommended install path. Click "View in AI SkillSafe app" on any skill page to open via the `skillsafe://install?ns=...&name=...&version=...` deep link. The app re-scans locally and dual-verifies against the publisher's scan before writing files.
- [`npx skills add`](https://github.com/vercel-labs/skills): Every SkillSafe skill is cloneable via git, so Vercel's `skills` CLI works natively: `npx skills add https://api.skillsafe.ai/{namespace}/{name}`. Auto-detects Claude Code, Cursor, Windsurf, and Codex.
- [SkillSafe CLI](https://www.npmjs.com/package/@skillsafe/cli): `npm install -g @skillsafe/cli` — zero-auth installer CLI (binary `skillsafe`): add/remove/list/update/audit.

## Legacy / programmatic

- [MCP Server](https://api.skillsafe.ai/mcp) (legacy / programmatic): JSON-RPC MCP endpoint kept for backwards compatibility and for tools that prefer programmatic access. Adds `search_skills`, `recommend_skills`, `get_skill_info`, `install_skill`, `scan_skill`, `scan_mcp_config`, `save_skill`, `share_skill`. Not the install path — use the AI SkillSafe desktop app or `npx skills add` instead.

## API

- [API Reference](https://skillsafe.ai/docs/): Complete endpoint docs with auth, rate limits, and error codes.
- [OpenAPI Spec](https://skillsafe.ai/openapi.json): Machine-readable OpenAPI 3.1 spec for all endpoints.
- [Health](https://api.skillsafe.ai/v1/health): Live status check. Returns `{"ok":true,"data":{"version":"1.0.0","hyperdrive_degraded":false,"supabase":"ok","r2":"ok"},"meta":{...}}`; when a subsystem is degraded, returns 503 with `"ok":false` and a `service_degraded` error.
- [Platform Stats](https://api.skillsafe.ai/v1/stats): Skill count, publisher count, scan report count.
- [Search Skills](https://api.skillsafe.ai/v1/skills/search?q=example&sort=popular): Search public skills. Params: `q`, `category`, `tag`, `namespace`, `sort` (popular/recent/verified/trending/hot/stars/newest/installs/relevance/updated), `limit`, `cursor`.

## Documentation

- [Full Docs](https://skillsafe.ai/docs/): The documentation hub — API usage, authentication, install paths, the apps platform, and the security model.
- [Quickstart Guides](https://skillsafe.ai/quickstart/): Per-tool setup for [Claude Code](https://skillsafe.ai/quickstart/claude-code/), [Cursor](https://skillsafe.ai/quickstart/cursor/), [Windsurf](https://skillsafe.ai/quickstart/windsurf/), and [Codex](https://skillsafe.ai/quickstart/codex/).
- [Security Model](https://skillsafe.ai/security/): Scanner rules, verification flow, trust verdicts.
- [Browse Registry](https://skillsafe.ai/skills/): Browse public skills by category, popularity, or verification status.
- [Trending](https://skillsafe.ai/skills/?sort=trending): Top skills installed in the last 24 hours.
- [Skill Markdown](https://skillsafe.ai/skill/@{namespace}/{name}?md): Add `?md` to any skill detail URL for a plain-text markdown summary (e.g. `https://skillsafe.ai/skill/@facebook/react?md`). Returns name, description, category, version, install/star/verification counts, tags, install command, links, and GitHub metadata.
- [Blog Post Markdown](https://skillsafe.ai/blog/{slug}.md): Append `.md` to any blog post URL for the raw markdown source (e.g. `https://skillsafe.ai/blog/introducing-skillsafe.md`).
- [Changelog](https://skillsafe.ai/changelog/): Dated list of platform changes — new models, billing and credit changes, and app-platform features.

## Demos

- [Browse Demos](https://skillsafe.ai/demos/): Recorded AI coding sessions from the community. Each demo shows a real multi-turn conversation using a verified skill.
- [Demos RSS Feed](https://skillsafe.ai/demos.xml): RSS feed of the 50 most recent public demos.
- [Demo Markdown](https://skillsafe.ai/demo/{demoId}?md): Add `?md` to any demo URL for a plain-text summary (e.g. `https://skillsafe.ai/demo/dmo_abc123?md`). Returns title, skill ref, model, task type, outcome, stats, and notes.
- [List Demos API](https://api.skillsafe.ai/v1/demos?limit=20&sort=newest): Global demo listing. Params: `sort` (newest/views/stars), `limit`, `cursor`.
- [Demo Detail API](https://api.skillsafe.ai/v1/demos/{demoId}): Metadata for a specific demo — title, skill ref, model, stats, notes.
- [Demo Comments API](https://api.skillsafe.ai/v1/demos/{demoId}/comments?limit=20&sort=top): Public comments on a demo. Params: `sort` (top/new/old), `limit`, `cursor`. Comments use deterministic pseudonyms; verified agent/admin comments are flagged with `is_agent: true`.

## Apps

Any saved skill can be deployed as a hosted mini-app: the skill's `SKILL.md` becomes the app's system prompt and the app goes live at `https://{slug}.skillsafe.ai` — no servers, auth code, or billing integration to build. Anyone can run an app in a browser as a guest (no account, API key, or CLI setup), which makes apps the way to share an agent skill with people who don't code. Usage is credit-metered at actual model-token cost ($1 = 10,000 credits; 1 credit = $0.0001): owners set a markup of up to 500%, sell subscription plans and one-off in-app purchases (up to $100), or sponsor free usage with daily caps — payments are handled by the platform (a 10% platform fee applies to each sale; earnings mature 14 days and cash out at face value), so there is no Stripe integration to write. User accounts (guest sessions plus one-click SkillSafe sign-in with per-app consent scopes), a typed record data layer with vector search, per-user key-value storage, file uploads, and Claude / GPT / Workers AI model access are built into every app. Every public app is built from a security-scanned skill and must pass a clean scan (skill + frontend bundle) before it is listed in the directory.

- [App Directory](https://skillsafe.ai/apps/): Hosted mini-apps built on SkillSafe. Each app runs a scanned, sandboxed agent at `https://{slug}.skillsafe.ai`.
- [Turn a Skill Into an App](https://skillsafe.ai/apps/create/): How to convert a skill into a hosted app — agent-driven deploy, user accounts, credit billing, data storage, and AI models built in.
- [App Detail Pages](https://skillsafe.ai/apps/{slug}/): Description, pricing, scan status, and live-app link for each public app. Add `?md` for a plain-text summary (e.g. `https://skillsafe.ai/apps/{slug}/?md`).
- [Model Catalog](https://skillsafe.ai/models/): Every model a hosted app can run — billed $ per 1M input/output tokens, output caps, and time limits. Add `?md` for plain text. JSON: `https://api.skillsafe.ai/v1/models`.
- [Deploy](https://deploy.skillsafe.ai/): The entry point for agent interactions with the app platform — the host serves the platform API itself (`/v1/*`, Bearer auth only), so a coding agent deploys apps against it directly. No account needed to start: a zero-signup temp key (`POST /v1/auth/temp-key`) deploys immediately and upgrades to a permanent account via email verification within 7 days.
- [Deploy Agent Guide](https://deploy.skillsafe.ai/llms.txt): Machine-readable guide to the `/v1/apps` platform API — auth (incl. temp keys), the save-skill → create-app → upload-release flow, database collections, server functions, payments, and limits.
- [App Creator](https://creator.skillsafe.ai/): Chat builder for humans — describe an app in a browser chat (SkillSafe sign-in required) and the assistant deploys and updates it. Agents should use the Deploy API above instead.
- [App Search API](https://api.skillsafe.ai/v1/apps/search): Public app directory listing (public + active apps).

## Optional: Full API Reference

For full API details including all request/response schemas, see [llms-full.txt](https://skillsafe.ai/llms-full.txt).