Documentation

Build with trust

Everything you need to install, verify, and understand agent skills. Security scanning, cryptographic signing, and full transparency.

The vett CLI is your interface to the registry. Install skills, inspect their permissions and security analysis, and keep everything up to date—all with cryptographic verification.

Installation

Install globally with your preferred package manager, or run directly with npx.

$ npm install -g vett
$ vett --version
vett/1.0.0
npmjs.com/vett · published with provenance

vett add

Install a skill from the registry or by URL. This is the primary command you'll use. Vett fetches the skill, displays its permissions and security analysis, asks for confirmation, then downloads and verifies the signed artifact before installing.

usage
vett add <skill-ref | url> [options]

Arguments

skill-ref*string
Skill reference (owner/repo/skill[@version]) or full GitHub URL

Options

-f, --forceboolean
Reinstall even if already installed
-y, --yesboolean
Skip confirmation prompt (auto-approve)
-g, --globalboolean
Install globally (default). Skills are available to all projects.
-p, --projectboolean
Install to current project only. Skills are stored in .claude/skills, .cursor/skills, etc.
-a, --agent <agent>string
Target specific agent(s). Can be repeated. If omitted, auto-detects all installed agents.

Examples

terminal
# Add by skill reference (assumes GitHub)
$ vett add anthropics/claude-code/memory
# Add a specific version
$ vett add cursor/skills/frontend-design@2.1.0
# Add by full URL
$ vett add https://github.com/org/repo/tree/main/skills/web-scraper
# Force reinstall without prompts
$ vett add -f -y anthropics/claude-code/memory
# Install to specific agents only
$ vett add -a claude-code -a cursor anthropics/skills/memory
# Install to current project only (not global)
$ vett add -p cursor/skills/frontend-design

What happens during add

terminal
$ vett add cursor/skills/web-scraper
◇  Checking registry
◇  Found in registry
  web-scraper
  ⚠ Review · cursor/skills
  Web scraping utilities for extracting data from websites.
  Permissions
    Filesystem: cwd/**
    Network:    *.example.com
    Env vars:   none
  Security Findings
    · [MEDIUM] net-fetch
    · [LOW] shell-exec
  Size: 4.2 KB  Version: 2.1.0
◆  Install this skill? Yes
◇  Downloaded and verified
◇  Signature verified
◇  Integrity verified (Sigstore · Rekor transparency log)
◇  Installed to vett
◇  Detected 3 agents
◇  Installed to 3 agents
◆  cursor/skills/web-scraper@2.1.0
◇  Canonical: ~/.vett/skills/cursor/skills/web-scraper
◇  Agents: Claude Code, Cursor, Windsurf (global)
└  Done
New skills
If a skill isn't in the registry yet, Vett will fetch it from the source, run security analysis, sign the manifest, and cache it—all in one command. This takes a few seconds longer the first time.
Multi-agent installation
Vett automatically detects installed AI agents (Claude Code, Cursor, Windsurf, etc.) and creates symlinks so the skill is available in all of them. Use -a to target specific agents, or -p to install to the current project only.
High-risk and blocked skills
Skills with critical risk are blocked entirely—the CLI will refuse to install them. Skills with high risk show strong warnings but can be installed with explicit consent.

vett search

Search the registry for skills by name, description, or owner.

usage
vett search <query>

Examples

terminal
$ vett search "code review"
◇  Searching
◆  Found 3 skills
  anthropics/claude-code/code-review  1.2k · safe
    Code review assistant for pull requests
  cursor/skills/pr-reviewer  892 · safe
    Pull request reviewer with inline comments
  acme/tools/review-bot  156 · review
    Automated code review with custom rules

vett info

Display detailed information about a skill including permissions, security findings, version history, and installation status.

usage
vett info <skill-ref>

Example output

terminal
$ vett info cursor/skills/web-scraper
◇  Fetching skill info
◇  Found
  Web scraping utilities for extracting data from websites.
  Installs: 1,847
  Installed: 2.1.0 (~/.vett/skills/cursor/skills/web-scraper)
  Latest Version: 2.1.0
  Risk: MEDIUM
  Fetches web pages and extracts structured data using CSS
  selectors and XPath. Supports pagination and rate limiting.
  Permissions
    Filesystem: cwd/**
    Network:    *.example.com
    Env:        none
  Security Flags
    [MEDIUM] net-fetch: Makes HTTP requests to user-specified URLs
    [LOW] shell-exec: Spawns child process for headless browser
  All Versions
    2.1.0 (1/15/2025) MEDIUM
    2.0.0 (12/3/2024) MEDIUM
    1.2.1 (11/12/2024) LOW
    1.2.0 (10/28/2024) LOW
    1.1.0 (10/1/2024) LOW
    ... and 3 more
└  Done

vett list

List all locally installed skills with their versions, agents, and installation paths.

usage
vett list

Example output

terminal
$ vett list
  memory anthropics/claude-code@1.0.0
    Agents: Claude Code, Cursor, Windsurf (global)
    Installed: 1/20/2025
    Path: ~/.vett/skills/anthropics/claude-code/memory
  frontend-design cursor/skills@2.1.0
    Agents: Claude Code, Cursor (global)
    Installed: 1/18/2025
    Path: ~/.vett/skills/cursor/skills/frontend-design
  web-scraper cursor/skills@2.1.0
    Agents: Cursor (project)
    Installed: 1/15/2025
    Path: ~/.vett/skills/cursor/skills/web-scraper
└  3 skill(s) installed

vett update

Check for and install updates to your installed skills.

usage
vett update [skill-ref]

Options

skill-refstring
Specific skill to update (optional, updates all if omitted)

Examples

terminal
# Check and update all installed skills
$ vett update
◇  Checking 3 skill(s) for updates
◇  Checked 3 skill(s)
→  cursor/skills/frontend-design: 2.0.0 → 2.1.0
◆  Updated 1 skill(s)
└  Done
# Update a specific skill
$ vett update cursor/skills/frontend-design

vett remove

Remove an installed skill. This deletes the skill from vett's canonical storage and removes all symlinks from agent directories.

usage
vett remove <skill-ref>
vett rm <skill-ref>

Options

-y, --yesboolean
Skip confirmation prompt
--dry-runboolean
Show what would be removed without actually deleting

Examples

terminal
# Remove by skill name
$ vett remove memory
◆  Skill: anthropics/claude-code/memory
◆  Agents: Claude Code, Cursor, Windsurf
◆  Remove this skill? Yes
◇  Removing from agents
◇  Removed from Claude Code, Cursor, Windsurf
◇  Removing from vett
◇  Removed from vett
◆  Removed anthropics/claude-code/memory
└  Done
# Remove without confirmation
$ vett rm -y frontend-design

vett sync

Check and repair agent symlinks. Useful after installing a new AI agent or if symlinks become broken.

usage
vett sync [options]

Options

--fixboolean
Repair broken or missing symlinks
--add-newboolean
Also install skills to newly detected agents (requires --fix)

Examples

terminal
# Check symlink status
$ vett sync
◇  Scanning installations
◇  Scan complete
⚠  Found 2 issue(s):
  · memory → Claude Code: not installed
  · frontend-design → Windsurf: link broken (source removed)
◇  Run vett sync --fix to repair issues
└  Sync check complete
# Repair broken symlinks
$ vett sync --fix
◇  Scanning installations
◇  Scan complete
◇  Fixing issues
◇  Fixed 2 issue(s)
└  Sync complete
# Also add skills to newly installed agents
$ vett sync --fix --add-new
◇  Scanning installations
◇  Scan complete
◇  3 skill(s) can be added to newly detected agents
  · memory → Zed
  · frontend-design → Zed
  · web-scraper → Zed
◇  Fixing issues
◇  Fixed 5 issue(s)
└  Sync complete

vett agents

List all detected AI coding agents on your system. Shows which agents vett can install skills to.

usage
vett agents

Example output

terminal
$ vett agents
◇  Detecting installed agents
◇  Detection complete
✓  Detected 3 agent(s):
  ✓ Claude Code
    ~/.claude/skills
  ✓ Cursor
    ~/.cursor/skills
  ✓ Windsurf
    ~/.windsurf/skills
◇  43 other supported agents not detected
  · GitHub Copilot
  · Codex
  · Zed
  ... and 40 more
└  Done
Agent detection
Vett detects agents by checking for their configuration directories (e.g., ~/.claude, ~/.cursor). When you install a skill, it's automatically symlinked to all detected agents.

Exit Codes

0Success
1General error (network failure, invalid input, etc.)
2Skill blocked due to critical risk

Environment Variables

VETT_REGISTRY_URLstring
Override the default registry URL (default: https://vett.sh)
GITHUB_TOKENstring
GitHub token for higher rate limits when fetching new skills
NO_COLORboolean
Disable colored output

Troubleshooting

"Signature verification failed"

The manifest signature doesn't match. This could mean the artifact was tampered with, or there's a key rotation issue.

Fix: Try vett add --force to re-fetch from the registry. If it persists, the skill may have been compromised—do not install.

"Hash mismatch"

The downloaded artifact doesn't match the expected SHA-256 hash.

Fix: This usually indicates a network issue or CDN cache problem. Wait a moment and try again. If it persists, report it.

"Skill not found"

The skill reference doesn't exist in the registry.

Fix: Check the skill reference format. If using a URL, make sure it points to a valid skill directory containing a SKILL.md file.