skill-map
Use to find agent skill installs, repository skill portfolios, duplicate skills, cross-dependencies, invocations, and cross-references across the local machine.
How do I install this agent skill?
npx skills add https://github.com/paulrberg/agent-skills --skill skill-mapIs this agent skill safe to install?
- Gen Agent Trust Hubpass
The skill facilitates mapping and cross-referencing AI agent skills on a local machine using the 'ai-skillet' CLI tool. While it includes extensive ignore policies for sensitive directories, the ability to scan local files and include snippets in reports creates a surface for indirect prompt injection.
- Socketwarn
1 alert: gptSecurity
- Snykpass
Risk: LOW · No issues
What does this agent skill do?
Skill Map
This skill is coordination-exempt: skip the ai-coord gate for its declared work.
Find skill installs and references across local files without scanning macOS protected home paths or obvious transcript, cache, dependency, and backup noise.
Arguments
--root PATH: Scan this root. Repeatable. Default:~.--portfolio-root PATH: ResolvePATHto its Git root, then scan that repository plus existing~/.agents/skillsand~/.claude/skills. Mutually exclusive with--root.--skill NAME: Restrict the report to one skill name. Repeatable.--format text|json|dot: Select report format. Default:text.--include-catalog-sources: Include known local source checkouts such as~/projects/agent-skills,~/sablier/sablier-skills, and~/sablier/agent-skillsduring broad scans. Explicit--rootvalues inside those trees are always scanned.--include-self: Include self-references in dependency output.--include-snippets: Include matched reference text when exact lines materially improve the result. Default output omits snippets for concise, high-signal reports.--show-skipped: Include ignored path summaries in text or JSON output.
Workflow
-
Require
ai-skillet1.0.0 or newer onPATH, then run:ai-skillet mapAppend each parsed invocation option and its value as separate arguments, preserving quoted values. For example,
--root '/path with spaces' --format jsonadds two options; use the argument-free form for the defaults. -
Use
--format jsonwhen another command or agent will consume the result. -
Use
--portfolio-root <repo> --format jsonwhen comparing repository skills with user-installed Codex and Claude Code exposures. Do not add broader home roots. -
Use
--format dotwhen the user asks for a graph, Graphviz input, or dependency visualization. -
Use
--include-snippetswhen exact matching lines materially improve the result, including when the user asks to see them. -
Read references/ignore-policy.md only when explaining, auditing, or changing the ignore policy.
User-Facing Output
Keep JSON and DOT byte-valid and undecorated. For human output, lead with
### 🗺 Skill Map — <skills> skills · <duplicates> duplicates · <unresolved> unresolved and a compact
skills/dependencies/duplicates/unresolved summary table. Always state the effective roots and material exclusions; for
the default broad scan, explicitly say that standard agent homes and catalog source checkouts were excluded. Make a
missing explicit --skill filter a visible ⚠️ Not found result rather than a clean-looking empty map. Use section
labels sparingly and keep snippets, local paths, exact edges, commands, and diagnostics undecorated.
Output Semantics
ai-skillet map emits schema version 1. Text is human-readable; JSON is structured for consumers; DOT is Graphviz
input.
- Every edge includes
type,provenance,identifier,source,target,path, andline. Dependency evidence usesprovenance: declaredorinferred; declared and inferred evidence remain independent records even when they describe the same source and target. Declared identifiers preserve their bare orORG/REPO#SKILLform. external-referencerecords references outside a discovered skill, andunresolved-like-referencerecords explicit$kebab-nameor/kebab-nametokens that did not match a discovered skill.countsseparates declared dependencies, inferred dependencies, external references, duplicates, and unresolved references. A missing--skillfilter writes a warning to stderr and returns an empty filtered report.- Skill filters match declaration sources and target skill names, including the name after
#for external identifiers. Invalid declaration fields stop the mapper with a path-specific error. - Every skill record includes
skill_sha256andtree_sha256. The tree hash covers sorted relative paths, entry types, regular-file executable bits, streamed file bytes, and un-followed symlink targets.
Portfolio JSON additionally includes:
portfolio.repository_rootand present/missing user roots, including the client exposed by each root.- Per-skill lexical
exposure_pathbeside resolvedrealpath;directory_name; repository/userlocation; install/catalogkind; and applicableclients. is_symlinkand the lexicalsymlink_targetfor recognized skill-directory symlinks. Exposures that resolve to one real directory remain separate skill entries, while duplicate installs still require distinct real directories. The automatically selected user roots behave like explicit roots: the broad-home ignore policy does not suppress an explicit~/.agents/skillsor~/.claude/skillsroot. Portfolio traversal follows symlinks only when the symlink is a direct child of a recognized repository or user skill root; other repository symlinks remain untraversed.
Use --show-skipped to include configured ignored directories, files, protected home paths, caches, and catalog-source
exclusions in text or JSON output.
Related Skills
skill-maponly locates and cross-references skills; it does not validate them. To audit a catalog or installed root for metadata and doc-link issues, use theskill-doctorskill when it is installed.- To evaluate the mapped repository-centered portfolio for conflicts, drift, consolidation, or missing workflows, use
the manually invoked
skill-harmonizationskill.
Guard Rails
- Do not search transcript or backup directories manually after
ai-skillet mapexcludes them unless the user explicitly requests transcript/history analysis. - Do not broaden home-directory scans into macOS protected paths such as
~/Libraryor~/.Trash; pass narrower explicit roots instead when a broad scan needs more coverage. - Treat local skill catalog source checkouts as false positives during broad machine scans; pass them explicitly as
--rootwhen auditing catalog contents. - Keep reports high-signal: include snippets only when exact evidence materially helps or the user explicitly requests it. Before copying output into a public or third-party artifact, perform an external-disclosure review.
- Prefer maintaining ignore rules in ai-skillet and documenting the rationale in
references/ignore-policy.mdinstead of ad hoc shell filters.
How can the creator link this skill?
Add the canonical catalog link to the repository README so users can inspect current installs and available audits. The publishing guide covers the complete discovery path.
<a href="https://skillzs.dev/skills/paulrberg/agent-skills/skill-map">View skill-map on skillZs</a>