Overview
The command-line interface — install, global flags, the --json envelope, exit codes, and an index of every command.
The SkillHub CLI is a single binary, skillhub, with a short alias you
can type as skh. Install it from npm and it manages skills across every
coding agent on your machine:
npm install -g skillhub-cli
skillhub --helpEvery command on this page is documented on its own reference page: the
synopsis, the real flags, a couple of examples, and the --json output shape.
Global flags
These flags are accepted by every command:
| Flag | Description |
|---|---|
--json | Emit a machine-readable JSON envelope on stdout instead of human output |
--quiet | Suppress non-essential output |
--yes | Assume "yes" for confirmation prompts (non-interactive) |
--[no-]color | Force or disable colored output |
--registry-url <url> | Point the command at a specific registry (the self-host seam) |
Scope-aware commands additionally accept --global / -g to act on the
machine-global scope (a per-machine store under your home directory) instead of
the enclosing project.
The registry URL can also be set with the registryUrl config key or the
registry-url environment override — see config.
The --json envelope
--json turns any command into a scriptable building block: it prints one
stable JSON envelope to stdout and nothing else, so you can pipe it straight
into jq or a CI step. The data shape is documented on each command's page.
Pass --json to any command and it prints a stable envelope to stdout. On
success:
{ "ok": true, "data": { } }On failure:
{ "ok": false, "error": { "code": "…", "message": "…", "details": {} } }The data object's shape is documented per command. Within a major version the
--json output is additive-only: new fields may appear, but existing fields
are never removed or renamed, so consumers should ignore unknown fields.
Exit codes
Exit codes are a contract you can script against:
| Code | Meaning |
|---|---|
0 | Success |
1 | Validation or user error (bad input, ambiguous name) |
2 | Authentication or authorization failure |
3 | Network / transport error (retry later) |
4 | Security-scan block or integrity (hash) mismatch |
Commands
Every command below has its own reference page with the synopsis, real flags,
examples, and --json output shape. They group into four families:
Setup & scopes
Bootstrap a project or the global scope, install and remove skills, and keep them in sync.
Authentication
Log in, inspect your identity, and mint scoped API tokens.
Authoring & publishing
Scaffold, validate, scan, publish, tag, deprecate, and unpublish skills.
Discovery & management
Search across sources, import external skills, and manage registries.
Setup & scopes
init— bootstrap a project or the machine-global scopeinstall— install skills, registries, or skillsets (aliasesadd,i)remove— remove installed skills (aliasrm)list— list installed skills (aliasls)sync— reconcile against the subscription setupdate— bump within declared rangesoutdated— report available updatesconfig— get or set configurationdoctor— diagnose your setup
Authentication
login— authenticate with the registrylogout— delete the stored credentialwhoami— show the authenticated identitytoken— create scoped API tokens
Authoring & publishing
new— scaffold a new skillvalidate— validate against the skill specscan— run the local security scannerpublish— validate, scan, pack, and publishtag— move a dist-tag to a versiondeprecate— deprecate a skill or yank a versionunpublish— permanently remove a version
Discovery & management