Commands / kosa8 skill add
kosa8 skill add
Import a third-party Agent Skill: read it, scan it, pin it, install it
Usage
kosa8 add SOURCE
SOURCE is a folder holding a SKILL.md, or a folder in a GitHub repository: ./my-skill github.com/OWNER/REPO/PATH[@REF] (or OWNER/REPO/PATH[@REF]) https://github.com/OWNER/REPO/tree/REF/PATH
Before anything is installed the skill is read in full: every file is listed, scripts are marked, the tools it asks for (allowed-tools) and the hosts it names are shown, and every shell script and shell block in its Markdown is run through the kosa8 rule pack an agent's own commands are checked against. Hidden text, binaries and credential paths are reported too.
A DENY or ASK finding stops the import unless --accept-findings. A GitHub ref is
resolved to a commit, and the skill is pinned by a SHA-256 of its content; --digest
refuses anything else. The pinned copy is kept in ~/.kosa8/skills and copied to
each agent (default: claude-code and ~/.agents/skills). Give it to an agent in a
sandbox with kosa8 agent run KIT --skill NAME, so its scripts run in there.
Agents: claude-code, codex, gemini, qwen, opencode, copilot, windsurf, cline, amp, goose, crush, kilo, droid, agents.
Options
| Flag | Type | What it does | Default |
|---|---|---|---|
--accept-findings | bool | import even with DENY or ASK findings | — |
-a, --agent | stringSlice | agents to install for (repeatable; default claude-code and agents) | [] |
--digest | string | refuse the skill unless its content digest is this (sha256:...) | — |
--dry-run | bool | show what the skill holds and what the scan finds; install nothing | — |
--force | bool | replace a skill folder kosa8 did not write | — |
--replace | bool | replace an imported skill of the same name with different content | — |