Skip to main content
A Skill is a named, versioned instruction directory an Agent can carry into a Run. The CLI gets one into your Workspace two ways: a one-shot install from the skills.sh community registry, and a tracked Git repository that re-syncs on demand. Both forms use the same public operations you could call over HTTP. Neither runs the skill, and neither executes anything it downloads.
The Checkfu CLI has no self-service public installation channel during private alpha. The commands below assume access through an explicitly authorized alpha arrangement. See CLI access in private alpha for the source-checkout and HTTP alternatives.
This flow runs from a Checkfu source checkout. Part of this flow is behind a rollout fence; a deployment that has not enabled it refuses the request rather than running it. Confirm capability status before making availability part of your application’s contract.

​
Install one skill from the registry

Name the skill the way the registry prints it:
The command resolves the entry, then stops and shows you what it found:
Registry content is written by other people. Read the list, then confirm:
Nothing is imported without --yes. The CLI writes no local files, runs no scripts, and interprets nothing beyond checking that each path is a safe relative path and that the directory carries a SKILL.md. It packs the exact bytes it fetched into an Agent Skills directory archive and posts it to POST /v1/skills/import. On success it prints the created Skill and the line to paste into an agent’s skills array:
--json writes JSON and only JSON: without --yes it emits the manifest as one document with "imported": false, and with --yes it emits the created Skill. Either way stdout carries exactly one document a script can parse. This form is a pinned copy. The Skill does not change when the registry entry changes; run the command again to import the newer content as a new version.

​
Track a repository instead

When you author skills in a Git repository, track the repository once and sync it whenever it changes:
The first run needs an active github Connection: the command creates the repository’s filesystem tree through it, creates a SkillSource over that tree, and syncs:
Running it again after a push reuses the same tree and source, so a repeated call is one more sync rather than a second copy. A re-sync does not need to choose a Connection: the tree already reads through the one it was created with, and that binding cannot be changed later. Passing a different --connection on a re-sync is refused rather than quietly ignored. A sync reports one row per directory it saw. created, updated, and unchanged publish a Skill; invalid names the reason a directory was not readable; missing marks a directory this source published before and that the current commit no longer contains. A missing directory is never deleted. The two forms take separate options. An option belonging to the other form is refused rather than accepted and ignored, so --yes never reads as a confirmation that did not happen:

​
Which form to use

​
Search the registry

checkfu skill search queries skills.sh and prints the name, source, install count, and URL of each hit, so you can pick a name for checkfu skill add:
Quote a multi-word query, or pass the words bare; both read the same way. --limit accepts 1 to 200, --json writes one document a script can parse, and --registry <https-origin> points at a different registry. skills.sh requires an authenticated identity for its search API. Supply one you own through the environment:
The CLI reads the token at call time, sends it only in that request’s Authorization header, and never stores or prints it. Without a token, or when the registry refuses one, the command says search is unavailable and prints the browser URL for the same query instead of inventing results. Browsing skills.sh and installing by name always works.