The Problem

AI agents need a single source of truth for skills across many coding tools, but skills are scattered across hidden directories, version‑mismatched, and lack a unified audit path. Manual installs risk broken front‑matter, duplicated effort, and security blind spots.

What This Does

asm (agent‑skill‑manager) is a CLI that unifies install, search, audit and evaluation of agent skills. The core lives in src/ (116 files, 102 code files) and is orchestrated by scripts/security_check.py (entry point main at line 407). Skills are defined in skills/ (51 files, 11 code files) and a public website UI lives in website-src/ (63 files, 55 code files, Tailwind‑styled). The tool supports --json and --yes for non‑interactive pipelines, and an optional TUI for local browsing.

Key flows, per the internal call graph, start at main → generate_html (called 4 times) → template rendering via template_path.read_text (filesystem I/O). aggregate_results calls calculate_stats (3 edges). run_check dispatches to materialize_command, command_exists, read_json_output, parse_findings, has_parser – each a single‑hop effect on the filesystem or an external command. The most connected module is src/utils/types (Ca 55, Ce 0, instability 0): 55 other modules import it, so changes ripple widely. By contrast src/cli (Ca 4, Ce 36, instability 0.9) is a high‑traffic entry point with many importers but also high outward degree, making it a blast‑radius hub for CLI flag handling.

How It Is Wired

  • Entry point: scripts/security_check.py:407 (main) reaches 45 functions, itself called from one place.
  • File‑system effects: 17 functions read or write files; 3 run external commands (run_check → materialize_command, etc.); 2 call a model for inference (run_loop → print_eval_stats).
  • Hub modules: src/utils/types, src/config, src/logger are imported by 55, 20, 19 modules respectively – keep them small and stable.
  • Oversized files: src/evaluator.ts, src/formatter.ts, src/cli.ts each exceed 1 600 lines (high cognitive load).
  • Deep nesting: max indentation depth 11 in src/cli.ts, website-src/src/components/SkillDetail.jsx, and skills/skill-creator/scripts/run_eval.py.
  • Duplicated logic: 328 repeated 6‑line blocks across ~60 files, notably in scripts/build-catalog.ts, src/stats.ts, src/utils/types.ts.
  • Resource‑safety: open(...) without with in skills/skill-creator/eval-viewer/generate_review.py and skills/skill-creator/scripts/run_loop.py (2 instances).
  • TODO/FIXME markers: 8 unresolved markers in skills/skill-creator/scripts/init_skill.py.

How To Use It

Setup

# Clone the repository
git clone https://github.com/moses-y/asm

# Install dependencies (npm)
cd asm && npm install

Configuration Create a config file (e.g., ~/.asm/config.yaml) or set environment variables referenced by src/config.ts. The CLI reads provider keys and registry URLs from this file; see the README for exact keys.

Running it

# List all installed skills (JSON output)
asm list --json

# Install a skill from the registry (non‑interactive)
asm install --yes <skill-id>

# Audit existing skills for security or version drift
asm audit --json

All commands accept --json for machine‑readable output and --yes to skip prompts.

Real‑World Use

A CI pipeline can run asm audit --json after each pull request to surface newly‑added or outdated skills across Claude, Codex, Cursor and 16 other providers. The JSON result can be posted to a dashboard or block merges that introduce un‑validated skills. Because main reaches only 45 functions and the call graph is shallow (≤ 62 edges), the audit step adds < 0.3 s overhead on a typical machine.

Code Health & Issues

  • Measured analysis (static, 49 findings): 11 high, 37 medium, 1 low across 7 kinds. Highlights: hub module src/utils/types (55 dependents), 25 oversized files (≥ 1 600 lines), 8 deep‑nesting instances, 8 duplicated code blocks, 2 files opened without context manager, 8 TODO/FIXME markers.
  • Code health audit (3 medium findings):
  • Large binaries in data/skill-index/sickn33_antigravity-awesome-skills.json (6.9 MB) – move to Git LFS or external storage.
  • .github/workflows/ci.yml keeps checkout token; set persist-credentials: false and pass explicit token only to push step.
  • package.json postinstall script – migrate work to an explicit build step or disable scripts in CI (ignore-scripts).

All findings stem from the pipeline’s deterministic static analysis; no opinion or guesswork is included.

The Bottom Line

asm delivers a much‑needed single‑point CLI for managing AI‑agent skills across dozens of tools, with JSON‑first output and security pre‑flight checks. The codebase is modular enough that the most‑connected hubs (src/utils/types, src/cli) can be refactored without breaking the whole system, but several files exceed safe size limits and carry duplicated logic that should be extracted. The three hygiene issues (large binaries, credential handling, postinstall risk) are straightforward to remediate and should be addressed before the tool is adopted in production pipelines. Teams that need a cross‑provider skill inventory and audit workflow will find immediate value; those requiring a tightly‑curated, low‑maintenance codebase may want to invest in the outlined refactors first.