Skulto

Scan AI agent skills for prompt injection before you install them

   ╔════════════════════════════════════════════════════════╗
   ║    ███████╗██╗  ██╗██╗   ██╗██╗  ████████╗ ██████╗     ║
   ║    ██╔════╝██║ ██╔╝██║   ██║██║  ╚══██╔══╝██╔═══██╗    ║
   ║    ███████╗█████╔╝ ██║   ██║██║     ██║   ██║   ██║    ║
   ║    ╚════██║██╔═██╗ ██║   ██║██║     ██║   ██║   ██║    ║
   ║    ███████║██║  ██╗╚██████╔╝███████╗██║   ╚██████╔╝    ║
   ║    ╚══════╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝    ╚═════╝     ║
   ╠════════════════════════════════════════════════════════╣
   ║            CROSS-PLATFORM AI SKILLS MANAGEMENT         ║
   ╚════════════════════════════════════════════════════════╝

What is Skulto?

Skulto is a cross-platform CLI tool for managing AI coding assistant skills across 33 platforms. It provides:

1. Multi-platform installation - Install skills to Claude Code, Cursor, Windsurf, Copilot, Codex, Cline, Roo Code, Gemini CLI, Kiro CLI, and 25+ more
2. Repository management - Add, sync, and remove skill repositories
3. Full-text search - SQLite FTS5-powered search across all indexed skills
4. Security scanning - Detect prompt injection and dangerous code patterns
5. Platform detection - Automatically detects which AI tools are installed on your system
6. Interactive TUI - Bubble Tea-powered terminal interface with collapsible groups, multi-select, and keyboard navigation
7. URL-based install - Install directly from GitHub repositories via skulto install owner/repo

Features

• 33 platform support - Claude Code, Cursor, Windsurf, GitHub Copilot, OpenAI Codex, OpenCode, Cline, Roo Code, Gemini CLI, Kiro CLI, Amp, Continue, Goose, Junie, Qwen Code, Trae, and more
• Platform detection - Detects installed AI tools and surfaces them in platform choosers
• Offline-first - Works without internet after initial sync
• Fast search - FTS5-powered full-text search with BM25 ranking (~50ms latency)
• Git-based sync - Clone and pull repositories for reliable updates
• Security scanner - Detects prompt injection in frontmatter, references, scripts and dangerous patterns with threat levels
• Smart multi-skill install - Install multiple skills from a repository URL with per-skill conflict resolution (skip already-installed, add new locations, or skip all)
• Scope selection - Install skills globally (~/) or per-project (./) with separate control per platform
• Collapsible platform groups - Detected/preferred platforms at top, all others in a collapsed group across all choosers
• Install location memory - Optionally remember your platform/scope choices for future installs
• Favorites - Save favorite skills that persist across database resets
• Recently viewed - Tracks and displays skills you've recently viewed
• MCP Server - Model Context Protocol server for AI tool integration (search, install, manage skills programmatically)
• Telemetry - Anonymous usage stats (opt-out with env var in Settings)

Supported Platforms

Skulto detects and installs skills to 33 AI coding tools:

Claude Code	Cursor	Windsurf	GitHub Copilot
OpenAI Codex	OpenCode	Cline	Roo Code
Gemini CLI	Kiro CLI	Amp	Continue
Goose	Junie	Kilo Code	Trae
Qwen Code	Kimi Code CLI	CodeBuddy	Command Code
Crush	Droid	Kode	MCPJam
Mux	OpenHands	Pi	Qoder
Zencoder	Neovate	Pochi	Antigravity
Moltbot

Installation

Homebrew

brew install asteroid-belt/tap/skulto

To upgrade:

brew upgrade asteroid-belt/tap/skulto

Linux Packages

GitHub Releases provide .deb and .rpm downloads for both amd64 and arm64. Choose the package format for your distribution and replace the version below with a release tag:

VERSION=vX.Y.Z
ARCH=amd64 # or arm64

# Debian/Ubuntu
curl -LO "https://github.com/asteroid-belt/skulto/releases/download/${VERSION}/skulto_${VERSION#v}_linux_${ARCH}.deb"

# Fedora/RHEL/openSUSE
curl -LO "https://github.com/asteroid-belt/skulto/releases/download/${VERSION}/skulto-${VERSION#v}-1.$([ "$ARCH" = amd64 ] && echo x86_64 || echo aarch64).rpm"

# Download the release checksums, then verify the downloaded asset.
curl -LO "https://github.com/asteroid-belt/skulto/releases/download/${VERSION}/checksums.txt"
sha256sum -c checksums.txt --ignore-missing

Install the local file with your distribution's package manager:

sudo apt install ./skulto_*.deb
sudo dnf install ./skulto-*.rpm
sudo zypper install ./skulto-*.rpm

Each package installs skulto and skulto-mcp at /usr/bin/skulto and /usr/bin/skulto-mcp. Skulto does not require system Git at runtime. These are GitHub Release downloads, not a configured package repository.

From Source

# Clone the repository
git clone https://github.com/asteroid-belt/skulto.git
cd skulto

# Install dependencies
make deps

# Build (outputs to ./build/)
make build-all

# Run
./build/skulto

Requirements

• Go 1.25+
• (Optional) GITHUB_TOKEN for higher API rate limits

Quick Start

# Launch the TUI (guided onboarding on first run)
skulto

# Or install skills directly from a repository URL
skulto install asteroid-belt/skills

On first launch, Skulto walks you through onboarding:

1. Platform selection - Detected AI tools appear at top; select which ones to sync skills to
2. Skill selection - Curated starter skills from Asteroid Belt (superplan, superbuild, teach, agentsmd-generator, and more)
3. Location chooser - Pick global or project scope per platform, with your previous selections pre-filled

Skill Management for Teams

Skulto works like a package manager for AI agent skills. Use skulto.json to define the skills your project needs, then skulto sync to install them — so every developer and CI environment has the same skill setup.

The Workflow

# 1. Install skills into your project
skulto install superplan
skulto install teach

# 2. Save project skills to a manifest
skulto save

# 3. Commit skulto.json to your repo
git add skulto.json
git commit -m "add skulto skill manifest"

# 4. Teammates (or CI) sync from the manifest
skulto sync

skulto.json

The manifest tracks which skills your project depends on and where they come from:

{
  "version": 1,
  "skills": {
    "superplan": "asteroid-belt/skills",
    "teach": "asteroid-belt/skills",
    "resume-ats-optimizer": "paramchoudhary/resumeskills"
  }
}

Each entry maps a skill slug to its source repository (owner/repo). When a teammate runs skulto sync, Skulto clones any missing repositories, resolves the skills, and installs them to the selected platforms.

skulto save

Captures your current project-scope installations into skulto.json:

$ skulto save

SAVED to skulto.json

  teach               asteroid-belt/skills
  superplan           asteroid-belt/skills

2 skill(s) saved

Only project-scope installations are saved — global installs are personal and not shared via the manifest.

skulto sync

Reads skulto.json and installs any missing skills:

$ skulto sync