Getting started

Skillhash keeps the skills your AI agents load reproducible and reviewed. You describe the skills you want in skills.toml, Skillhash pins each one to an exact commit and content hash in skills.lock, and skillhash verify fails when anything changes.

Install

The CLI needs Python 3.11 or newer. The fastest way is uv:

uv tool install skillhash
# or
pipx install skillhash
# or run without installing
uvx skillhash scan ./my-skill

You can also install the wheel straight from this site:

uv tool install https://skillhash.xzserverbot.duckdns.org/dl/skillhash-0.1.0-py3-none-any.whl

Lock your first skill

cd your-repo
skillhash init
skillhash add github:anthropics/skills/skills/pdf
skillhash verify

init creates skills.toml and skills.lock. It picks install targets from the folders that already exist in your repo, or defaults to .claude/skills and .agents/skills.

add resolves the ref to a commit, downloads only that folder, scans it, checks the grade against min_grade, writes the lock entry and copies the skill into every target.

Sources

Form	Example
GitHub folder	`github:owner/repo/path/to/skill@main`
GitHub URL	`https://github.com/owner/repo/tree/v1.2/skills/x`
Local folder	`path:./skills/internal-tool`
Team registry	`registry:acme/deploy@1.4.0`

Commands

Command	What it does
`init`	Create skills.toml and skills.lock
`add SOURCE`	Add, lock and install one skill
`remove NAME`	Remove from both files and every target
`lock`	Lock new or changed entries in skills.toml
`update [NAME]`	Move to the newest commit of each ref and show grade changes
`install`	Install exactly what skills.lock pins, checking every hash
`verify`	Exit 1 on drift, stale entries or a grade below policy
`scan [PATH\|SOURCE]`	Print findings; `--json` for tooling, `--fail-on high` for gates
`login`, `push`	Use the private team registry

Next: how the lockfile works, or add verify to CI.