Launching today
Skillbox
One library for your AI skills, synced to every agent
206 followers
One library for your AI skills, synced to every agent
206 followers
Skillbox keeps your AI skills in one library and syncs them to Claude Code, Cursor and Codex. Follow GitHub sources, review diffs, and scan each version for prompt injection. Trim shortens noisy command output so sessions last longer.
Free Options
Launch Team / Built With
Render Sandboxes: a computer for every agentIsolated compute, persistent state and a real filesystem
Promoted
Hi Product Hunt, I'm Adenekan Wonderful, the maker of Skillbox.
I built this because my AI skills were everywhere. A few lived in GitHub repos, some sat inside project folders, and some were installed for Claude Code but missing from Cursor. A better version of one would turn up and I'd have no idea. Copying files was easy. Knowing what I had, where it came from, whether it had changed, and whether it was safe was the hard part.
So Skillbox does four things:
One library, and a smaller active set. Keep everything you've collected, and deliver only what each tool or project needs. Every skill your agent loads costs context, so we don't treat "saved" as "installed".
Sources stay attached. Skills added from GitHub or GitLab keep following their source. When one changes, you see the diff and decide whether to take it.
Trust, per version. Each version is scanned for prompt injection, data exfiltration, command injection, hardcoded secrets and obfuscated code, including by Cisco's Skill Scanner. Approval is tied to the exact content that was reviewed, so it doesn't carry over silently when a skill changes. A passing check is evidence, not a guarantee.
Trim. It shortens noisy test, git and build output before your agent reads it. The full output stays one command away, and your sessions last longer.
It syncs across Claude Code, Cursor and Codex. Trim currently covers more than that, but session insights are deepest on Claude Code.
There's a permanent free plan for the library, sync, updates and Trust. Trim and AI features are on Individual, with a 7-day trial.
I'd love to hear how your skills are scattered today, and what would make you trust a skill you didn't write. I'm here all day and will reply to everything.
We have one skill that only makes sense in one repo, it's about our deploy scripts. Can I keep it active there and nowhere else?
@artemkorchunov Good question. Skillbox doesn't automatically toggle skills on/off based on which repo you have open, but you can assign that deploy skill to a specific project folder instead of syncing it globally across your tools, so it only lives in that repo's folder.
Does Trim ever cut the one line of a failing test you needed?
@leoheo Trim can drop lines, since that’s how it saves tokens but a failing command is the case we protect.
When a command fails, the full original output is saved locally. A hint in the trimmed output points to it, and the agent can pull the complete output back with one command.
Anything you don’t want trimmed can be switched off per command, and if a filter errors it falls back to the raw output instead of guessing.
The scattered-skills problem is real for me — mine live across repos, project folders, and random local copies, and I never quite know which version Claude Code is actually using. What I like most is that Trust is checked per version, not just per skill, and updates follow the source on GitHub. That's the part that would get me to centralize. One thing I'm wondering about: most of my useful skills are ones I wrote myself locally, not ones I pulled from GitHub — do those go through the same library and sync to Cursor and Codex, or is the flow mainly built around following external sources?
@jcbuilds Yes, local skills are first-class. Import them from disk (you accept or skip each one) or save them from a chat session. They sync to Cursor, Codex and Claude Code like anything else, and you can scope them per project. They show as “Yours”. Since they have no upstream, there’s nothing to follow on GitHub. Updates from the source only apply to skills you pulled in.
I keep a few dozen skills across my coding agents, many pulled from GitHub repos, and keeping them in sync is exactly the mess you describe. The prompt-injection scan on each version is the part I care about most: a skill update is instructions that run with my permissions.
Does the scan run locally, and can I pin a source to a version I've reviewed, so new versions wait for my approval?
@georgeturbo Great question. The scan runs in our cloud, not on your machine, on the exact version of each skill before it can reach your agents. It checks for prompt injection, exfiltration, secrets and obfuscated code, and it's one layer of evidence, not a guarantee.
You do get approval control: every new version is scanned separately, and anything flagged is held back from syncing. Turn off auto-update on a skill and updates wait for your OK before they apply. What we don't have yet is pinning a whole source to a reviewed tag or commit, because pinning is per skill today.
We publish skills for coding agents, and besides the skill files, each agent wants the MCP server the skills use declared in its own way: Claude Code with "type": "http", Cursor with just the address, Codex with "streamable-http" in an mcp.json.
Does Skillbox carry a skill's server entry across tools, or only the skill files?
Thanks for the comment, @philippstaudt not today. Skillbox syncs a skill’s files to each tool, but it doesn’t carry the skill’s MCP server entry across tools.
The only MCP config Skillbox writes is its own control-plane server, “skillbox”. It writes that one in each tool’s own format: "type": "http" for Cursor and Claude Code, a [mcp_servers.skillbox] TOML table for Codex, and so on. It doesn’t read a server declaration from a skill and write it out for each tool. The docs also treat MCP install as separate from file delivery.
So for now, keep documenting the per-tool server setup in the skill’s README or SKILL.md. A skill-level server declaration that Skillbox translates per tool would be a new feature, not something it already does.