ASM — Agent Skill Manager
The universal skill manager for AI coding agents — install, search, audit, and organize skills across 21 tools.
Evidence shows: pre-install security scan (README), audit commands require confirmation (--yes), output has JSON and stderr separation, rollback mechanisms (disable/enable), source attribution via tier reporting. Deductions: least privilege not explicitly stated, sensitive data handling details not clear, dependency security has CI audit but no specific results provided.
Evidence shows: README and test files consistent, CI and e2e tests present, error handling with clear exit codes and messages. Deductions: no dependency availability guarantee, failure messages may be incomplete in some scenarios.
Evidence shows: targeted at AI agents and automation, supports 21 providers, has --json and --yes, environment fit (Node version). Deductions: capability boundaries not explicit, trigger precision not detailed.
Evidence shows: README, install notes, naming stability (asm command), examples and FAQ, known limitations (e.g., stats --json bug), MIT license, version number but no changelog. Deductions: no changelog, maintenance responsibility not explicit.
Evidence shows: JSON output, marginal value (solves scattered installs), cost-benefit reasonable (free). Deductions: no performance data.
Evidence shows: README claims consistent with test files, tests verify functionality, but no external corroboration. Deductions: no external validation.
- Publisher identity unverified, treat with caution.
- Dependency security audit results not provided, check yourself.
- stats --json outputs non-JSON when no skills, known bug.
What does this agent do, and when should you use it?
agent-skill-manager (asm) is a scriptable CLI built for AI agents and automation to install, search, audit, and organize skills across multiple coding agents. It supports 21 providers, including Claude Code, Codex, Cursor, and others, with --json and --yes flags for non-interactive use. The tool addresses pain points like scattered installs, lack of inventory, hidden context costs, and risky manual installs. It offers a rich set of commands like asm list, asm install, asm audit, asm stats, and asm get, along with an optional TUI. Installation is via npm or curl, requiring Node.js 22+.
asm is a CLI that discovers skill directories, installs skills from GitHub repos or the ASM registry, searches across providers, and scans skills for security before installation. It provides machine-readable inventory in JSON, audits for duplicates and semantic overlaps via asm audit, and computes resident token costs with asm stats --tokens. It supports skill scaffolding via asm init, live development via symlinks (asm link), publishing to the registry (asm publish), and bundle management. The typical flow is running asm list --json to get inventory, asm install github:owner/repo to install, and asm audit security for checks. All commands support structured JSON output and non-interactive flags.
- Developers using multiple coding agents (e.g., Claude Code, Codex, Cursor) who need a unified view of installed skills. A single asm list gives a cross-provider inventory.
- CI/CD pipelines that require automated installation, auditing, and updating of skills without human prompts, leveraging --json and --yes.
- Engineering teams wanting to measure the token cost of skill descriptions resident in agent prompts, using asm stats --tokens to identify optimization opportunities.
- Technical evaluators who want to preview a skill's content without permanently installing it; asm get outputs the SKILL.md body to stdout.
- Skill authors building, testing, and publishing new skills using asm init, asm link, and asm publish, with built-in evaluation and security scans.
What are this agent's strengths and limitations?
- Unified inventory across 21 providers with configurable enable/disable per provider.
- Agent-first design with --json, --yes, --machine flags for automation.
- Built-in security scan (asm audit security) checks for shell exec, network access, and credential exposure before installation.
- Requires Node.js 22+, which may be a barrier in older environments or restricted systems.
- Primarily targets coding agents; not designed for general-purpose chat assistants, limiting broader applicability.
- Skill availability depends on external repositories and registry; offline or air-gapped environments have reduced functionality.
How do you install or deploy this agent?
Install via npm globally: npm install -g agent-skill-manager. Alternatively, use curl: curl -sSL https://raw.githubusercontent.com/luongnv89/asm/main/install.sh | bash. Node.js 22 or later is required.
How do you use this agent?
First, run asm list --json to see installed skills across all providers. Install a skill with asm install github:anthropics/skills --yes, or specify a provider: asm install code-review -p claude --yes --json. Search with asm search "code review" --json. Audit duplicates: asm audit --yes. Check token costs: asm stats --tokens. To get a skill's body without installing, use asm get code-review. For full command reference, run asm --help or see the CLI Commands section in the README.