// the skillox workbench

Build skills people can trust.

Secure-by-default authoring for SKILL.md. Scaffold with sane capability declarations, lint with the same A–F engine that grades skillox.io, catch leaks before they ship — all in your terminal, local-first, no telemetry.

$npm install -g skilloxcoming soon

Apache-2.0 · zero runtime deps · ~417KB single-file bundle · Node ≥20

// the cli — coming soon

Three commands. One engine. Your dev loop.

skillox initscaffold

Three templates — tool, knowledge, workflow. Every scaffold lands with capabilities declared, no network egress, scoped reads. The way to start clean.

$ skillox init my-skill --template tool

skillox lintshift-left

Author-time scan over local SKILL.md files. CI-friendly exit codes, multi-file globs, --fail-at threshold, JSON output. Catch a D before it gets published.

$ skillox lint "./**/SKILL.md" --ci --fail-at high

skillox auditconsumer

Scan any URL or local SKILL.md without opening a browser. Same A–F engine, same findings, in your terminal. For when you found one in the wild.

$ skillox audit https://github.com/.../SKILL.md

// the loop

Scaffold → edit → lint → publish.

The workbench is built around one disciplined loop. Start with secure defaults so you never have to retrofit safety. Lint locally so the server-side scan at skillox.io is a formality, not a surprise. The same engine runs both places — no surprises between what your terminal says and what the marketplace publishes.

→Local-first. Lint runs entirely offline. No content leaves your machine until you choose to publish.
→CI-ready. Drop skillox lint --ci into your workflow — exit 0 / 1 / 2 are distinct so your pipeline branches cleanly.
→No surprises. The hosted scanner at skillox.io uses the same engine as the CLI. Pass the CLI → pass the hosted scan.

~/projects/my-skill

$ skillox init my-skill --template tool
✓ created my-skill/SKILL.md
✓ created my-skill/tests/prompt-suite.md

Next:
  1. Edit SKILL.md — describe what the skill does + when to invoke it.
  2. Run `skillox lint` to audit your work.

$ cd my-skill && skillox lint --ci
▸ ./SKILL.md
  ✓ clean · grade A · 95/100

1 file linted · 1 clean · 0 breaches · 0 errors

$ echo $?
0

// roadmap

The workbench ships in slices — the CLI first.

Each slice is small, valuable on its own, and reuses the engine that came before. No big rewrites, no shipped-when-it's-perfect.

v1a

coming soon

skillox init + skillox lint

Scaffold with secure defaults; lint locally with the same A–F engine.

v1b

skillox test

Prompt-suite eval loop — run the skill against a model + your test prompts, get a pass/fail + behavior report.

v1c

skillox sign + skillox publish

Sigstore/Cosign keyless signing, then publish into the skillox.io creator pipeline. One identity across both surfaces.

later

SkillOx Studio (hosted IDE)

A browser-based authoring surface for non-developers — Monaco editor + a frontmatter form + a live grade as you type.

later

MCP server authoring

Extend the workbench to MCP servers (manifests + tool descriptions). Shares the same behavioral sandbox as skillox.io.

Sequenced behind the skillox.io launch — each slice is gated on the one before it shipping, not on a calendar.

Start shipping skills with an A.

Local-first. Apache-2.0. No telemetry. No account required — the CLI is the way to author skills people can actually trust. Coming soon.

$npm install -g skilloxcoming soon

or browse scanned skills at skillox.io →