Skillget

agent-skill-loader

mcp
Security Audit
Fail
Health Warn
  • License — License: MIT
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Low visibility — Only 7 GitHub stars
Code Fail
  • os.homedir — User home directory access in src/index.ts
  • process.env — Environment variable access in src/index.ts
Permissions Pass
  • Permissions — No dangerous permissions requested
Purpose
This is a Model Context Protocol (MCP) server that acts as a bridge to dynamically load, discover, and manage "Claude Code Skills" for AI agents. It monitors local directories and exposes these skills as prompts and tools to connected MCP clients.

Security Assessment
Overall risk: Medium. The application directly accesses the user's home directory to find and read local files, which triggered a warning for accessing `os.homedir` and environment variables. By design, the tool is built to read files from your local disk and features an `install_skill` function that copies and writes files directly to your project workspace. It does not appear to request highly dangerous permissions or execute arbitrary shell commands. However, there is an inherent risk in automatically reading and writing local files, especially if the tool is pointed at untrusted directories. No hardcoded secrets were detected.

Quality Assessment
The project is very new and currently has low visibility with only 7 GitHub stars, meaning it has not yet been extensively peer-reviewed by the community. Despite this, it is actively maintained, featuring a recent push date and a clean build state. The code is written in TypeScript, comes with a standard MIT license, and provides comprehensive documentation.

Verdict
Use with caution—the tool's necessity to read and write local files represents a tangible attack surface if misconfigured, so you should inspect the code before integrating it into sensitive environments.
SUMMARY

MCP server to expose Claude Code Skills to AI agents

README.md

Agent Skill Loader 🧠

npm version
MCP Registry
License: MIT
Node.js Version
TypeScript
MCP

Agent Skill Loader is a Model Context Protocol (MCP) server that acts as a bridge between your static Claude Code Skills library and dynamic AI agents (like Claude Desktop, Cursor, or any MCP client).

It exposes skills both as MCP Prompts (slash commands, zero tool calls needed) and as MCP Tools (for programmatic use). Skills are auto-discovered from configured directories and stay live — add a new SKILL.md and the client is notified automatically.

🚀 Features

  • MCP Prompts: Skills appear as slash commands in clients. No tool call needed to inject them.
  • Live updates: listChanged notification fires when skills are added or removed (via file watcher).
  • Discovery: list_skills — scans configured skill directories, with optional search filter.
  • Dynamic Learning: read_skill — fetches the SKILL.md content.
  • Persistence: install_skill — copies a skill permanently to your project.
  • Configuration: manage_search_paths — add/remove skill directories at runtime.
  • Troubleshooting: debug_info — diagnose configuration and path issues.

🛠️ Setup

Prerequisites

  • Node.js >= 18

Option A: Install from npm (Recommended)

npm install -g agent-skill-loader

Then register in .mcp.json:

"agent-skill-loader": {
  "command": "agent-skill-loader"
}

Option B: Build from Source

git clone https://github.com/back1ply/agent-skill-loader.git
cd agent-skill-loader
npm install
npm run build

Then register in .mcp.json:

"agent-skill-loader": {
  "command": "node",
  "args": ["<path-to-repo>/build/index.js"]
}

📂 Configuration

The server automatically detects its workspace and aggregates skill paths from:

  1. Default: %USERPROFILE%\.claude\plugins\cache (Standard location)
  2. Dynamic Config: skill-paths.json (Located in the project root)

Environment Variables

Variable Description
MCP_SKILL_PATHS JSON array or semicolon/comma-separated list of additional skill paths
MCP_WORKSPACE_ROOT Override auto-detected workspace root
MCP_NO_WATCH Set to 1 to disable the file watcher (useful in CI)

Dynamic Path Management

You do not need to manually edit config files. Use the tool to manage paths at runtime:

  • Add: manage_search_paths(operation="add", path="F:\\My\\Deep\\Skills")
  • Remove: manage_search_paths(operation="remove", path="...")
  • List: manage_search_paths(operation="list") creates/updates skill-paths.json.

🤖 Usage

MCP Prompts (Slash Commands)

If your client supports MCP Prompts (Claude Desktop, Cursor, etc.), skills appear automatically as slash commands. Select a skill from the slash command menu to inject its content directly — no tool calls needed.

Tools

The agent has access to five tools:

  • list_skills(query?): Returns a JSON list of available skills. Optional query filters by name/description substring (case-insensitive).
  • read_skill(skill_name): Returns the markdown instructions for a skill.
  • install_skill(skill_name, target_path?): Copies the skill folder to .agent/skills/<name>. For security, target_path must be within the current workspace.
  • manage_search_paths(operation, path?): Add, remove, or list skill search paths.
  • debug_info(): Returns diagnostic information (paths, status, warnings).

Example Agent Prompt

"I need to write a DAX measure but I'm not sure about the best practices."

The agent will automatically call list_skills, find writing-dax-measures, call read_skill, and answer with expert knowledge. Or the user can invoke the skill directly as a slash command.

🔧 Troubleshooting

If skills aren't being discovered, use debug_info() to see:

  • search_paths: Which directories are being scanned
  • path_status: Whether each path exists and is readable
  • warnings: Any errors encountered during scanning (permission denied, empty files, etc.)

Example output:

{
  "workspace_root": "C:/projects/agent-skill-loader",
  "search_paths": {
    "base": ["C:/Users/pc/.claude/plugins/cache"],
    "dynamic": ["F:/My/Skills"],
    "effective": ["C:/Users/pc/.claude/plugins/cache", "F:/My/Skills"]
  },
  "path_status": [
    { "path": "C:/Users/pc/.claude/plugins/cache", "exists": true, "readable": true },
    { "path": "F:/My/Skills", "exists": false, "readable": false }
  ],
  "skills_found": 12,
  "warnings": [
    { "path": "F:/My/Skills", "reason": "Directory does not exist" }
  ]
}

📦 Project Structure

  • src/index.ts: Main server logic (tools + prompts + watcher).
  • src/utils.ts: Skill scanning, description extraction, prompt helpers, debounce.
  • build/: Compiled JavaScript output.
  • package.json: Dependencies (@modelcontextprotocol/sdk, chokidar, zod).

🤝 Contributing

To add new skills, add a folder with a SKILL.md file to one of the watched directories. The server picks them up automatically and sends a listChanged notification — no restart required.

Reviews (0)

No results found