ASM — Agent Skill Manager
The universal skill manager for AI coding agents — install, search, audit, and organize skills across 21 tools.
- Source repo
- luongnv89/asm
- Stars
- ★ 959
- Last updated
- 2d ago
- License
- MIT
- Primary language
- TypeScript
- FA score
- 62/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude Code
- Cost
- Free, no paid service needed
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- Developers using multiple coding agents (e.g., Claude Code, Codex, Cursor) who need a unified view of installed skills. A single asm list gives a cross-provider inventory.
- Not a fit if
- Teams needing fully offline or air-gapped use, since skills come from external repos and a registry
- Users stuck on Node.js below 22 or in restricted runtime environments
- General-purpose chat assistant use rather than coding agents
- Source review
- 62/100 · Some gaps
What does this agent do, and when should you use it?
agent-skill-manager (asm) is a scriptable CLI built for AI agents and automation to install, search, audit, and organize skills across multiple coding agents. It supports 21 providers, including Claude Code, Codex, Cursor, and others, with --json and --yes flags for non-interactive use. The tool addresses pain points like scattered installs, lack of inventory, hidden context costs, and risky manual installs. It offers a rich set of commands like asm list, asm install, asm audit, asm stats, and asm get, along with an optional TUI. Installation is via npm or curl, requiring Node.js 22+.
asm is a CLI that discovers skill directories, installs skills from GitHub repos or the ASM registry, searches across providers, and scans skills for security before installation. It provides machine-readable inventory in JSON, audits for duplicates and semantic overlaps via asm audit, and computes resident token costs with asm stats --tokens. It supports skill scaffolding via asm init, live development via symlinks (asm link), publishing to the registry (asm publish), and bundle management. The typical flow is running asm list --json to get inventory, asm install github:owner/repo to install, and asm audit security for checks. All commands support structured JSON output and non-interactive flags.
- Developers using multiple coding agents (e.g., Claude Code, Codex, Cursor) who need a unified view of installed skills. A single asm list gives a cross-provider inventory.
- CI/CD pipelines that require automated installation, auditing, and updating of skills without human prompts, leveraging --json and --yes.
- Engineering teams wanting to measure the token cost of skill descriptions resident in agent prompts, using asm stats --tokens to identify optimization opportunities.
- Technical evaluators who want to preview a skill's content without permanently installing it; asm get outputs the SKILL.md body to stdout.
- Skill authors building, testing, and publishing new skills using asm init, asm link, and asm publish, with built-in evaluation and security scans.
How do you install or deploy this agent?
Install via npm globally: npm install -g agent-skill-manager. Alternatively, use curl: curl -sSL https://raw.githubusercontent.com/luongnv89/asm/main/install.sh | bash. Node.js 22 or later is required.
How do you use this agent?
First, run asm list --json to see installed skills across all providers. Install a skill with asm install github:anthropics/skills --yes, or specify a provider: asm install code-review -p claude --yes --json. Search with asm search "code review" --json. Audit duplicates: asm audit --yes. Check token costs: asm stats --tokens. To get a skill's body without installing, use asm get code-review. For full command reference, run asm --help or see the CLI Commands section in the README.
What are this agent's strengths and limitations?
- Unified inventory across 21 providers with configurable enable/disable per provider.
- Agent-first design with --json, --yes, --machine flags for automation.
- Built-in security scan (asm audit security) checks for shell exec, network access, and credential exposure before installation.
- Requires Node.js 22+, which may be a barrier in older environments or restricted systems.
- Primarily targets coding agents; not designed for general-purpose chat assistants, limiting broader applicability.
- Skill availability depends on external repositories and registry; offline or air-gapped environments have reduced functionality.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| ASM — Agent Skill Manager This agent | 62 · Some gaps | CLIFree | ★ 959 | 2d ago | TypeScript | Codex · Claude Code |
| Deepsec Security Scanner | 61 · Some gaps | CLIFree + model costs | ★ 8.2k | 24d ago | TypeScript | OpenAI API |
| AgentBro | 78 · Good | Desktop appFree | ★ 164 | 2mo ago | Rust | Codex · Claude Code |
| SkillSpec | 74 · Some gaps | CLIFree | ★ 700 | 2mo ago | Rust | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: pre-install security scan (README), audit commands require confirmation (--yes), output has JSON and stderr separation, rollback mechanisms (disable/enable), source attribution via tier reporting. Deductions: least privilege not explicitly stated, sensitive data handling details not clear, dependency security has CI audit but no specific results provided.
Evidence shows: README and test files consistent, CI and e2e tests present, error handling with clear exit codes and messages. Deductions: no dependency availability guarantee, failure messages may be incomplete in some scenarios.
Evidence shows: targeted at AI agents and automation, supports 21 providers, has --json and --yes, environment fit (Node version). Deductions: capability boundaries not explicit, trigger precision not detailed.
Evidence shows: README, install notes, naming stability (asm command), examples and FAQ, known limitations (e.g., stats --json bug), MIT license, version number but no changelog. Deductions: no changelog, maintenance responsibility not explicit.
Evidence shows: JSON output, marginal value (solves scattered installs), cost-benefit reasonable (free). Deductions: no performance data.
Evidence shows: README claims consistent with test files, tests verify functionality, but no external corroboration. Deductions: no external validation.
- Publisher identity unverified, treat with caution.
- Dependency security audit results not provided, check yourself.
- stats --json outputs non-JSON when no skills, known bug.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
v2.24.0 — 2026-10-20 Features - Add Illyism/seo-skills (10 skills) to the curated skill index — SEO and marketing skills for running SEO end to end on a daily schedule, ranking one high-value page fast, auditing and rewriting page titles, refreshing blog posts against competing search results, mapping customer journeys across Google, AI chatbots, and social platforms, researching customers before writing copy, writing blog intros and conversion copy, turning shipped changes into marketing content, and transcribing video and audio with Scribiz; the repo's 11th skill, linkdr, is exc …View on GitHub ↗ -
Release notes excerpt
v2.23.0 — 2026-10-13 Features - Add the predefined content-team bundle — 23 skills from nine indexed repos covering topic research, writing, visuals, video, sound, and publishing — installable with asm bundle install content-team; the baoyu-post-to-* skills are left out so publishing goes through postiz, and approval requirements must be configured in your agent before it schedules or posts ([#740](https://github.com/luongnv89/asm/issues/740)) ([#739](https://github.com/luongnv89/asm/pull/739)) — @luongnv89 …View on GitHub ↗ -
Release notes excerpt
v2.22.0 — 2026-10-11 Features - Find installed skills by partial or misspelled names and description keywords with asm search <query> --fuzzy, ranked best match first with each skill's tool, location, and path; add --root <dir> to search project-local installs up to five levels below the directory you choose ([#735](https://github.com/luongnv89/asm/issues/735)) ([#736](https://github.com/luongnv89/asm/pull/736)) — @luongnv89 ```bash asm search revew --fuzzy asm search "review pull requests" --root ~/projects ``` …View on GitHub ↗