# lpm skills (/docs/packages/skills) `lpm skills` handles two skill systems: skills published with `@lpm.dev/*` packages and standalone skills added from GitHub or a local directory. ## Quickstart [#quickstart] ```bash # Install guidance published with an LPM.dev package lpm skills add @lpm.dev/owner.package --dry-run lpm skills add @lpm.dev/owner.package --yes # Validate guidance before publishing your own package lpm skills validate # Add a standalone skill from GitHub lpm skills add owner/repository ``` ## Choose a workflow [#choose-a-workflow] | Goal | Source | Main commands | | ---------------------------------------------- | ----------------------------- | --------------------------------------------------------- | | Use guidance shipped by an LPM.dev package | `@lpm.dev/owner.package` | `lpm install`, `lpm skills add`, `lpm skills clean` | | Publish guidance with your own LPM.dev package | Flat `.lpm/skills/*.md` files | `lpm skills validate`, `lpm publish` | | Manage a standalone agent skill | GitHub or a local directory | `lpm skills add`, `update`, `enable`, `disable`, `remove` | For the ownership, storage, and security model behind these workflows, see [AI agent skills](/docs/reference/ai-agent-skills). ## Install skills from an LPM.dev package [#install-skills-from-an-lpmdev-package] Direct `@lpm.dev/*` dependencies install their published skills automatically: ```bash lpm install @lpm.dev/owner.package ``` The package-owned set is materialized in `.lpm/skills/owner.package/`. It stays separate from agent-specific skill directories and is reconciled when the package is installed, upgraded, or removed. Fetch or preview one package explicitly with `lpm skills add`: ```bash lpm skills add @lpm.dev/owner.package --list lpm skills add @lpm.dev/owner.package --dry-run lpm skills add @lpm.dev/owner.package --yes ``` Package sources are installed as one set. Standalone-only flags such as `--skill`, `--agent`, `--project`, `--global`, `--copy`, and `--full-depth` are rejected for `@lpm.dev/*` inputs. ### Configure automatic installation [#configure-automatic-installation] Package skill reconciliation is enabled by default. Open the package-skills setting directly, or set it non-interactively: ```bash lpm config lpm-skills lpm config lpm-skills --set false lpm config lpm-skills --set true ``` You can also open the full configuration wizard and choose **LPM.dev package skills**, then choose enabled or disabled: ```bash lpm config ``` Use `--no-skills` on [`lpm install`](/docs/packages/install), [`lpm add`](/docs/packages/add), or `lpm ci` to opt out once. Use `--skills` to override a disabled preference once. The setting does not delete existing package skills and does not affect explicit `lpm skills add` commands. ### Clean installed package skills [#clean-installed-package-skills] Preview cleanup before applying it: ```bash lpm skills clean --dry-run lpm skills clean lpm skills clean --yes ``` `clean` removes only package directories whose files and digests exactly match an LPM CLI ownership manifest. It preserves publisher-authored `.lpm/skills/*.md` files, untracked or modified content, invalid manifests, symlinks, standalone managed content, and agent links. In a terminal, `clean` shows the package sets, file count, and size, then asks for confirmation with **No** as the default. Non-interactive cleanup requires `--yes` after reviewing `--dry-run`. Run [`lpm install`](/docs/packages/install) to restore removed package sets. ## Publish skills with an LPM.dev package [#publish-skills-with-an-lpmdev-package] Package publishers author direct Markdown files under `.lpm/skills/`: ```text .lpm/ └── skills/ ├── usage.md └── migration.md ``` Nested publisher paths such as `.lpm/skills/guides/usage.md` are invalid. Each file needs YAML frontmatter and a Markdown body: ```md --- name: package-usage description: Use the package through its supported public API. version: "1.4.0" globs: - "src/**/*.ts" --- # Package usage Import the public client, initialize it once, and reuse that instance. Follow the package's documented error handling and configuration conventions when changing an existing integration. ``` Use the [LPM package-skill authoring guide](https://github.com/lpm-dev/lpm-guide) for help designing the files. You can install it as a standalone skill: ```bash lpm skills add lpm-dev/lpm-guide ``` Validate locally, then publish: ```bash lpm skills validate lpm publish ``` `validate` checks the same publisher contract enforced by the LPM.dev Registry: | Rule | Requirement | | ----------- | ---------------------------------------------------------------------------------------------- | | Location | Direct `.md` files under `.lpm/skills/` | | Count | At most 10 skills | | File size | At most 15 KB per skill | | Total size | At most 100 KB | | Frontmatter | Required `name` and `description`; optional `version` and `globs` | | Name | Lowercase letters, numbers, and hyphens | | Description | 10–500 characters | | Body | At least 100 characters | | Security | No blocked shell injection, exfiltration, prompt injection, or destructive filesystem patterns | Validation exits non-zero when any rule fails. If the project also consumes LPM.dev package skills, manifest-owned `.lpm/skills//` directories are ignored by publisher validation and excluded from the publish tarball. Other nested Markdown is rejected. When `package.json > files` is restrictive, `lpm publish` adds `.lpm/skills` before creating the tarball. Set optional `version` to the package release the guidance was authored for. The LPM.dev Registry stores it independently from the release currently carrying the skill, and the LPM CLI preserves it when materializing installed guidance. Leaving an older value in place makes intentionally stale guidance visible instead of silently relabeling it as current. ## Add standalone skills from GitHub or local sources [#add-standalone-skills-from-github-or-local-sources] Standalone inputs support GitHub URLs, GitHub `owner/repository` shorthand, and local directories: ```bash lpm skills add vercel-labs/skills --skill find-skills lpm skills add https://github.com/vercel-labs/agent-skills --skill web-design-guidelines lpm skills add ./team-skills --skill release-notes --agent codex --project ``` Remote standalone inputs must resolve to GitHub. When a catalog helps you discover a skill, pass the underlying GitHub repository or tree URL to the LPM CLI. In a terminal, `add` opens a wizard for source, skill selection, project or global scope, compatible agent targets, security review, and confirmation. For scripts, provide the selection flags and `--yes` after reviewing `--dry-run`: ```bash lpm skills add owner/repository \ --skill release-notes \ --agent codex \ --project \ --dry-run lpm skills add owner/repository \ --skill release-notes \ --agent codex \ --project \ --yes ``` `lpm skills install` remains a compatibility alias for `lpm skills add`. Use `add` in new scripts. | Flag | Effect | | ------------------------ | ------------------------------------------------------------------------------------- | | `--skill ` | Select a standalone skill. Repeat it, or use `--skill '*'` for all discovered skills. | | `--agent ` | Select `codex`, `claude-code`, or `cursor`. Repeat for multiple targets. | | `--project` / `--global` | Choose standalone canonical storage scope. | | `--copy` | Copy standalone files to targets instead of linking them. | | `--list` | Discover and preview a source without installing it. | | `--full-depth` | Search beyond standard skill directory layouts. | | `--dry-run` | Show planned filesystem changes without writing them. | | `--yes` | Confirm a non-interactive mutation. | Warning-level security findings remain installable after explicit confirmation. Block-level findings stop `add` or `update` before any managed content or agent targets are written. ## Inspect all skills [#inspect-all-skills] ```bash lpm skills list lpm skills list --kind package lpm skills list --kind managed --agent codex lpm skills view owner.package/usage lpm skills view release-notes ``` The unified inventory distinguishes ownership: | Category | Meaning | | ---------- | --------------------------------------------------------------------------- | | `package` | Skills installed from LPM.dev packages into `.lpm/skills//`. | | `managed` | Standalone skills added through `lpm skills add`. | | `external` | Existing agent-directory skills not managed by the LPM CLI. | `view` reports source, integrity, estimated context size, security findings, and agent-target health. Add `--global` to include global managed and external locations. ## Manage standalone skills [#manage-standalone-skills] ```bash lpm skills doctor lpm skills update release-notes --dry-run lpm skills update release-notes --yes lpm skills disable release-notes --agent cursor --yes lpm skills enable release-notes --yes lpm skills remove release-notes --yes lpm skills prune --dry-run ``` `update` re-resolves the source, shows a bounded content diff and new security findings, then refreshes canonical content and recorded targets. `disable` removes selected target links while retaining canonical content. `remove` removes targets and deletes canonical content when no targets remain. `prune` previews and removes orphaned managed links and stale state records. `update`, `remove`, `enable`, and `disable` accept skill selectors or `--all`, plus `--global`, `--dry-run`, and `--yes`. `remove`, `enable`, and `disable` also accept repeated `--agent` filters. `prune` accepts `--global`, `--dry-run`, and `--yes`. These commands do not mutate package-installed skills. ## Local dashboard [#local-dashboard] ```bash lpm skills dashboard lpm skills dashboard --read-only lpm skills dashboard --no-open lpm skills dashboard --port 4401 ``` `dashboard` opens an authenticated browser view of every discovered project and global skill. `lpm skills ui` is an alias. Use the source tabs to filter the combined inventory without restarting the command with a scope flag. Select a skill to inspect its rendered Markdown, exact raw source, bounded file tree, metadata, context estimate, integrity, and security status. Package and external skills are inspection-only. Managed standalone skills expose enable, disable, update, and remove through a reviewable preview-and-apply plan. `--read-only` disables all mutations. The server binds only to `127.0.0.1`. Omit `--port` to select a free port, or request an exact port. `--no-open` prints the authenticated URL. The URL fragment carries the local session token; the dashboard captures and removes it from the address bar after startup. Keep the command running while using the dashboard and press `Ctrl+C` to stop it. ## JSON and CI [#json-and-ci] Global `--json` emits one structured result per command. Inventory includes total counts and `package`, `managed`, and `external` counts. Use `--dry-run --json` to capture a mutation plan, then repeat the command with `--yes`. No-op validation, cleanup, and prune operations still emit successful zero-count results. ## See also [#see-also] * [AI agent skills](/docs/reference/ai-agent-skills) — ownership, storage, lifecycle, and security * [`lpm install --no-skills`](/docs/packages/install) — opt out of package skill extraction * [`lpm add --no-skills`](/docs/packages/add) — same for dependency installation * [`lpm config lpm-skills`](/docs/infra/config#setup-wizards) — configure automatic package skill installation * [MCP servers](/docs/reference/mcp-servers) — separate tool integration