Five-minute start

Install skillmod

Let your agent install it (recommended)

With Node.js/npm available, install the companion Agent Skill globally so your coding agent can set up and operate skillmod from any project:

Then say one sentence to your agent. Copy it as written; no need to translate it:

Install skillmod and make it available on PATH.

The skill checks the Git prerequisite and any existing skillmod installation, selects the release binary for the current operating system and architecture, verifies it against the published SHA-256 checksums, installs it in a user-writable directory on PATH, and verifies the result. Omit --global when the guidance should be available only in the current project.

Manual installation

Without Go, download the archive for your platform and checksums.txt from GitHub Releases, verify the archive, extract it, and put skillmod on your PATH:

• Archives are named like skillmod_<version>_linux_amd64.tar.gz, and .zip on Windows; <version> omits the leading v.
• Architecture names map from machine values: x86_64, AMD64 to amd64; aarch64, arm64, ARM64 to arm64.
• Use only the executable inside the archive (skillmod.exe on Windows) and place it in a user-writable directory: ${XDG_BIN_HOME:-$HOME/.local/bin} on Linux/macOS, or %LOCALAPPDATA%\Programs\skillmod\bin on Windows.

With Go 1.26.6 or later, the install is shorter:

Either way ends at the same executable. Upgrade it in place later with skillmod upgrade: it reads the release published for the current operating system and architecture, verifies the archive against that release's checksums.txt, and replaces the running executable. --check stops before downloading, and --dry-run downloads and verifies without replacing the executable.

Prerequisites

skillmod invokes the system git executable to fetch sources, so Git must be installed and on PATH. On Windows it is not preinstalled; install Git for Windows. SSH remotes additionally require ssh on PATH.

Run a few read-only checks before you start:

When the current process cannot see a newly updated PATH, invoke the executable by its full path for verification and open a new terminal.

Add your first skill

From the project directory:

The repository is named once and the skill once: after // the skill name is enough, so the directory layout inside the repository does not have to be typed or remembered. An exact subdirectory still wins over a name, and a name that several skills answer is reported with the candidate paths instead of guessed. The declaration records where the skill actually lives, which is the source line in SKILL.mod below.

--yes answers the confirmations that follow a selection and never decides what the selection is; the install mode is set by --install-mode, and this page uses copy.

Meet SKILL.mod and SKILL.lock

SKILL.mod is the declaration you review and commit. SKILL.lock is written by skillmod and records what the declaration resolved to: the requested version, the resolved commit, and the content hash.

schemaversion = 1

[[skill]]
name = 'gh-fix-ci'
source = 'github.com/openai/skills//skills/.curated/gh-fix-ci'
version = 'v0.0.0-20260624023612-49f948faa925'

schemaversion = 1

[[skill]]
name = 'gh-fix-ci'
source = 'github.com/openai/skills//skills/.curated/gh-fix-ci'
version = 'v0.0.0-20260624023612-49f948faa925'
commit = '49f948faa9258a0c61caceaf225e179651397431'
dirhash = 'h1:kiGlVBeTCF8Q9f0rPATnDn1jBn/obT3TTTL8D8gdCbM='

Note that SKILL.mod carries no commit and no dirhash: those belong to the lock. sync reconciles every machine against the lock, and verify checks installed content against the lock.

Create a drift on purpose

Edit an installed skill the way an unreviewed change would, then ask whether the project still matches its lock:

The non-zero exit code is what makes it usable as a CI gate: an edited or tampered skill fails the build instead of sitting unnoticed on the machine.

Ask why where it came from

To learn where one entry came from and what state it is in, ask why:

Source, resolved version, commit, dirhash, and the per-target status all fit in one screen. The last line is the drift you just created.

Local edits are never overwritten

sync will not throw that edit away to make itself look clean:

Exit code 3 is the point: work that could proceed did proceed, and the decision about your edit stays with you. Keep it as the project's local version, or run skillmod sync interactively and choose overwrite to restore the locked content.

What to read next

For what the two files each do, how scopes are split, and which version forms exist, read Core concepts. For task-by-task operations — adopting skills that already exist on disk, distributing one skill set to a team, updating and pinning, sharing with agents, removal and cleanup — read Scenario guide.

To wire skillmod into a pipeline, see the exit-code table, the --json report shape, and the action vocabulary in Automation & CI; for an error or an odd state, work through the self-check in Troubleshooting.