How Installskills works

Installskills is a private vault for AI skills. You bring existing skills into one controlled place, organize them, review them, approve trusted versions, and let your AI agents install exactly what you approved — nothing else.

The model in one minute

• A skill is a folder with a SKILL.md manifest, imported from an upload or a GitHub repository.
• Every change to a skill produces a version that moves through explicit states: Draft → Review → Ready → Superseded. Ready versions are the only governed distribution target; an author can also privately test their own Unreviewed Draft before submitting it.
• Skills live in a vault (a workspace). Everyone starts with a private Personal Vault; teams share a Team Vault with roles, reviews and access control; larger organizations upgrade to an Enterprise Vault with SSO and externally managed groups.
• Agents connect through MCP: direct clients such as Claude Code, Codex, Cursor or VS Code authenticate with an access key, while ChatGPT and Claude connectors authorize with OAuth.

One release path

1. Add an existing ZIP, public GitHub source or complete package from a connected client. The result is always a Draft.
2. Validate SKILL.md, frontmatter, names, paths, sizes and the complete file inventory without executing package code.
3. Test privately when useful. Only the author can prepare the short-lived Unreviewed Draft package.
4. Scan the exact package hash. Changing the package invalidates the prior result.
5. Release or review. Personal owners release after the trusted gate; Team and Enterprise versions require an authorized human decision.
6. Grant and install the immutable Ready version through a signed, checksummed package session.

Where to go next

• Quickstart — from zero to a connected agent in five steps.
• Connect agents — access keys, MCP configuration and hosted connectors.
• Skills & versions — imports, the version lifecycle and reviews.
• Skill security — package validation, trusted scans, risk gates and release attestation.
• Collections & sources — curation and provenance.
• Team vaults — members, roles, groups and access control.
• Personal Vaults — how Enterprise visibility controls hide and restore personal access without deleting data.
• Billing & seats — Team capacity, Stripe invoices and Enterprise upgrades.
• Security policies — organization scan criteria and enforcement.
• Notifications — in-app and email updates for governance and billing events.
• Feedback & support — report a problem or send an idea without leaving the app.
• Access keys — scopes, expiry and rotation.
• Enterprise SSO — sign in with your company identity provider.

For the security model — private by default, hashed workspace-bound keys, database-resolved authorization and an audit trail — see the security page.