Package manager for AI agent skills — install once and sync to 19 coding agents (Claude, Cursor, Copilot, etc.) with built-in security scanning and version locking.
ASK (Agent Skills Kit) is a package manager for AI agent skills, analogous to Homebrew for macOS software, with the core philosophy "One command. Every agent."
At its core, ASK installs a skill once and automatically syncs it to the skill directories of 19 major AI coding agents including Claude, Cursor, Codex, Copilot, Windsurf, and Gemini CLI. For version management, ask.lock pins exact commit hashes, and ask lock-install provides deterministic installation similar to npm ci, designed for CI/CD pipelines.
Security is a key differentiator: 15+ built-in rules detect secret leaks, dangerous commands, and malware, with SARIF output for GitHub Code Scanning integration. ask check performs security scanning plus SKILL.md format validation, ask audit generates audit reports, and ask skill score computes trust scores — public audit reports have already been generated for repositories from Anthropic, OpenAI, Composio, and Vercel.
For skill discovery, trusted sources (Anthropic, OpenAI, Composio, Vercel, etc.) are pre-configured. ask search scans all sources in parallel via goroutines, and ask repo add supports private repositories. Enterprise scenarios are covered with full offline mode (--offline), source whitelisting, and HTML audit reports.
Interaction modes span CLI (Cobra-driven), TUI (BubbleTea), Web UI (Echo server via ask serve), and desktop app (Wails framework, macOS-first). Skills are packaged as Git repositories containing a SKILL.md spec file with YAML frontmatter for standardized metadata. The core is implemented in Go, leveraging goroutines for parallel search, Git sparse checkout for efficient fetching, and compiled to a single static binary with zero runtime dependencies.
As of July 2025, the project has 43 releases (latest v1.9.8), 223 commits, MIT license, and is maintained by yeasy, a well-known open source contributor.