Asm

asm, published as agent-skill-manager, is a command-line tool for installing, searching, auditing and organising agent skills across coding agents. It reads and writes the skill directories of 19 providers — Claude Code, Codex, OpenClaw, Cursor, Windsurf, Cline, Roo Code, Continue, GitHub Copilot, Aider, OpenCode, Zed, Augment, Amp, Gemini CLI, Google Antigravity, Pi, Hermes and a generic fallback — so one inventory covers every tool and scope. Every command accepts --json and --yes, which makes it callable from a script, a CI job or an agent's own tool calls; an optional terminal interface opens when you run asm with no arguments.

A skill is a directory containing a SKILL.md file with YAML frontmatter and a Markdown body. asm install accepts a registry name, a github:owner/repo shorthand or a local path, validates the frontmatter, runs a pre-install scan for shell execution, network access and credential exposure, and pins registry commits. asm init, asm link, asm eval and asm publish cover authoring: scaffold a skill, symlink it into a provider for live development, evaluate it, and publish it to the community registry.

The tool treats context as the scarce resource. A frontmatter description sits in the agent's system prompt on every message whether the skill fires or not, while the body costs tokens only when it fires, so asm stats --tokens reports the two separately per tool and per scope, and asm audit residency ranks skills that are not earning their resident context. The reports only advise; nothing is removed unless you run the suggested command.

Demotion follows a ladder from installed, through a saved library copy, to disabled on disk, to a reference tier where nothing is installed at all. At the reference tier, asm get resolves a skill and writes its body to standard output — checking installed skills, then the library, then the indexed catalogue, then the registry, and reporting which rung answered. Remote fetches use a temporary shallow clone that is deleted before the command returns and run the same security scan as an install. Standard output carries only the body or a single JSON object, with provenance and warnings on standard error.

Other audits cover duplicates and semantic overlap, where two differently named skills do the same job. The catalogue behind asm search and asm install indexes thousands of skills from community repositories. Installation is through npm or a shell script, and Node.js 22 or later is required.

Features

• Cross-provider inventory: asm list --json reports every skill across all 19 providers and both global and project scopes
• Agent-parseable output: --json, --yes and --machine on list, search, inspect, install, audit and eval
• One-command install: asm install github:user/repo, a registry name, or a local path, with frontmatter validation and pinned registry commits
• Security scan: pre-install checks for shell execution, network access and credential exposure, also run on remote asm get fetches
• Attention budget: asm stats --tokens separates resident frontmatter cost from body cost, per tool and per scope
• Residency audit: asm audit residency ranks skills to demote and pairs each with the command that matches how it was installed
• Reference tier: asm get prints a body to standard output and installs nothing, resolving through installed, library, index and registry tiers
• Duplicate and overlap audits: asm audit removes redundant skills, asm audit overlap finds differently named skills doing the same job
• Local library: asm install --library installs once, then asm activate and asm deactivate link it per provider
• Authoring pipeline: asm init, asm link, asm eval and asm publish, with pluggable eval providers
• Bundles and tags: curated sets through asm bundle install, and local tags filtered with --tag
• Configurable providers: all 19 are enabled by default and any can be disabled, or a custom one added, in one config file