Skills Hub is a cross-platform desktop application for installing, organizing, updating, and syncing Agent Skills across AI coding tools. Developers use it to maintain one central skill library and distribute selected skills to tools such as Claude Code, Codex, Cursor, OpenCode, and Antigravity. Its catalogue instructions describe how to work with the managed skills.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add qufei1993/skills-hub --skill manage-skills-hubgit clone --depth 1 https://github.com/qufei1993/skills-hubWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/qufei1993/skills-hub/manage-skills-hub)<a href="https://agentmods.dev/skills/qufei1993/skills-hub/manage-skills-hub"><img src="https://agentmods.dev/badge/skills/qufei1993/skills-hub/manage-skills-hub/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/qufei1993/skills-hub/manage-skills-hub"><img src="https://agentmods.dev/badge/skills/qufei1993/skills-hub/manage-skills-hub.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.03484 |
| Opus 5.5 | $0.00029 | $0.01394 |
| Sonnet 5.5 | $0.00015 | $0.00697 |
| Haiku 4.5 | $0.00007 | $0.00348 |
Grade A, and why
manage-skills-hub scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 162 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Manage Skills Hub
Translate the user's requested Skill operation into the trusted skillshub-cli commands below. By default, an AI installation includes syncing to detected, enabled tools in Skills Hub; explicit user scope takes precedence. Keep device sync, automation, credentials, and application settings in the desktop app.
Resolve a trusted CLI before every workflow
- Inspect
~/.skills-hub/binwithout executing a binary. Only when that directory is completely absent, inspect~/.skills-hub-dev/binas the desktop development bridge. These desktop profiles share the Skill library, but keep credentials separate. On Windows expand the user's home directory and useskillshub-cli.exe; otherwise useskillshub-cli. Never switch to another bridge when the selected directory exists but fails validation. - If that bridge directory exists (including a broken link or inaccessible path), require a regular executable binary and both regular stamp files
skillshub-cli.versionandskillshub-cli.sha256in that directory. Read only these public stamps. Validate a nonempty version and a 64-digit hexadecimal SHA-256 value, then compute the binary's SHA-256 with the platform's hashing utility and require an exact match. Reject symlinked stamps/binaries and unresolvable paths. Do not execute an unverified binary. - After hash validation, bind
$CLIto that absolute binary path and run$CLI --json version. Require exit 0,ok: true, anddata.versionequal to the version stamp. Missing files, invalid stamps, mismatched hash/version, execution failure, and malformed output mean bridge damaged: fail closed, stop, and ask the user to open Settings → AI management in the desktop app and click Enable in one click to install or repair the CLI bridge. First-time installation or repair requires this explicit click; update the CLI and official Skill explicitly in Settings → AI management. Startup only checks status and does not update them. Never fall back to PATH when the bridge location exists but fails validation. Do not repair or edit stamps yourself. - Only when the desktop bridge directory is completely absent, resolve
skillshub-clifrom PATH for a CLI-only environment. Bind$CLIto the resolved absolute path and run$CLI --json version. If unavailable, explain installing Skills Hub and enabling AI management in Settings. Do not silently install software.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +23 lines d1ed90fe6760
- 14d ago Changed 0eeae56e23d2
- 15d ago Changed 933e49a58c3a
- 18d ago First seen · 139 lines · 73 tokens per session scan A 3f53366b4433
manage-skills-hub is a skill published in the GitHub repository qufei1993/skills-hub (1,810 stars, last pushed 4d ago), licensed MIT. It adds 73 tokens to every session and 3,484 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-28.
Other skills, from other repositories
agentbro-pr-merge
Use when reviewing, fixing CI for, approving workflows for, or merging AgentBro pull requests into dev/main, especially external contributor PRs where contributor attribution matters.
oculpm-journal
A work-journal format for recording coding-agent tasks, including bugs, features, errors, refactors, and chores. It defines where files go and what information each record must contain.
self-audit
A self-check procedure for reviewing work before calling it complete, including requirements, tests, and the final change list.
project-inception
Use when kicking off a new project or feature area in an ocul-pm tracked project (.oculpm/ present) — research the stack landscape via web search, then converse with the user (research-backed choices) to settle the optimal spec, and seed a discussion doc, a detailed 3-depth plan (plancreate), EVALS.md done-criteria…
run-evals
A project check that reads the completion rules in EVALS.md and runs the listed evaluations. EVALS.md is a file that defines what must work before a task is considered finished.
tdd-workflow
A test-first workflow for building features and fixing bugs. TDD, or test-driven development, means writing a failing test for the expected behaviour before implementing the code.