Skills-hub Blog
Install Claude skills in 30 seconds
One npx command, no global install, no config file. The same command works for Claude Code, Cursor, Codex CLI, and any MCP client via --target.
The 30-second version
From your project root, run:
npx @skills-hub-ai/cli install code-review-and-qualityThat's it. The CLI fetches the skill manifest, verifies the SHA, writes the SKILL.md to .claude/skills/<slug>/, and pins the version in .skills.json so the next person who clones the repo gets the same skill at the same version. No daemon, no login required for public skills, no global state on your machine.
Why npx, not a global install
Skills are project-scoped. They live next to your code, get committed to your repo, and travel with the codebase. A globally-installed CLI would imply a single user-level config — which is exactly the wrong shape. With npx you always run the latest published CLI, against the project you're standing in, with no version drift between teammates. No brew install, no PATH conflicts, no "works on my machine" because someone forgot to upgrade.
If you do prefer a stable binary, pnpm add -D @skills-hub-ai/cli installs it as a project devDependency and you get pnpm skills install ... locked to the same version for everyone.
Multi-platform install with --target
The same skill manifest can be projected into the on-disk format each tool expects. Pass --target to choose where it lands:
# Claude Code (default) → .claude/skills/<slug>/SKILL.md
npx @skills-hub-ai/cli install security-and-hardening
# Cursor → .cursor/rules/<slug>.mdc
npx @skills-hub-ai/cli install security-and-hardening --target cursor
# Codex CLI → .codex/skills/<slug>/SKILL.md
npx @skills-hub-ai/cli install security-and-hardening --target codex
# Multiple at once
npx @skills-hub-ai/cli install security-and-hardening \
--target claude-code,cursor,codexThe CLI translates frontmatter to whatever each tool reads — Claude Code wants the skill name and description in YAML, Cursor's .mdc format expects description and globs, and Codex prefers a flat directory. You write the skill once; the CLI does the rest.
Five skills worth installing right now
Pick one of these to feel the install flow end-to-end. Each link goes to the detail page where you'll see the security scan, version history, and source.
- code-review-and-quality — opinionated review checklist that catches the things human reviewers miss on a Friday afternoon.
- test-driven-development — drives the agent into red-green-refactor instead of write-then-test-after.
- security-and-hardening — a security mindset for AI-generated code. Worth the 30 seconds alone.
- common-owasp — OWASP Top 10 awareness baked into the agent's edit loop.
- shipping-and-launch — pre-deploy checklist so nothing ships at 5pm on Friday by accident.
- documentation-and-adrs — writes ADRs and keeps READMEs honest as the code changes.
The .skills.json lockfile
After your first install you'll see a .skills.json file at the repo root. Commit it. It records the slug, the resolved version, the integrity hash, and the target. Teammates running npx @skills-hub-ai/cli install (no slug) get the exact set you have — same shape as pnpm install against pnpm-lock.yaml. Drift becomes a code review concern, not a Slack mystery.