skillview
A local-only web GUI for inspecting agent skills (SKILL.md format) across personal, project, plugin, cache, and marketplace sources.
bunx @pc_style/skillview
Run it from the workspace you want to inspect. Skillview opens a browser and builds a provenance-aware inventory of the agent skills on your machine — the shared SKILL.md format used by Amp, Codex, Claude Code, and other coding agents. It reads native Amp/Codex directories, Claude directories and plugin registries, and explicitly exposed symlink targets.
Also works with npx @pc_style/skillview if you don't use Bun.
highlights
- provenance-aware — the same skill can appear as an installed plugin copy, a cached version, and a marketplace source; each record keeps its source, plugin, marketplace, and version context
- fast filtering — search by name, description, or path; filter by source and lifecycle
- deep inspection — rendered Markdown, raw
SKILL.md, file trees, and metadata for every skill - safe by design — read-mostly, localhost-only, no cloud sync
 |  |
| instant search across 100+ skills | full provenance: plugin, marketplace, version |
sources
Skillview discovers:
| source | where |
|---|---|
| Amp user | ~/.config/agents/skills, ~/.agents/skills, and ~/.config/amp/skills |
| Codex user | shared skills in ~/.agents/skills |
| Claude user | direct skills in ~/.claude/skills |
| linked | valid skill-directory symlinks explicitly exposed in a discovered user or project root |
| Amp / Codex project | .agents/skills directories beneath the selected workspace |
| Claude project | .claude/skills directories beneath the selected workspace |
| installed plugin | active installations recorded in ~/.claude/plugins/installed_plugins.json |
| plugin cache | current, historical, and orphaned skill copies under ~/.claude/plugins/cache |
| marketplace | available plugin skills under registered local marketplace checkouts |
Skillview scans only these documented roots and bounded project directories. It does not inspect Amp built-ins, remote personal/workspace repositories, Codex system skills, or arbitrary directories configured through amp.skills.path. Ephemeral runtime bundles under /private/tmp are also excluded from the standalone package.
options
--workspace <path> workspace to scan instead of the current directory
--port <number> localhost port, or 0 for an available port (default: 4173)
--no-open start the server without opening a browser
-h, --help show help
Examples:
bunx @pc_style/skillview --workspace ~/projects/my-app
bunx @pc_style/skillview --port 4317 --no-open
SKILL_VIEW_WORKSPACE_ROOT remains available as an environment override.
lifecycle labels
| label | meaning |
|---|---|
enabled / disabled | direct user/project skill state, or installed plugin state from Claude settings |
installed | plugin is registered but has no explicit enabled boolean |
cached | managed plugin cache artifact |
available | marketplace source that may not be installed |
what it does
- previews skill descriptions, rendered Markdown, raw
SKILL.md, metadata, and file trees - searches and filters by source and lifecycle
- shows plugin, marketplace, version, linked-target, and canonical-path provenance
- copies paths and skill content
- reveals freshly validated skill folders in Finder on macOS
- enables or disables direct user/project skills by renaming
SKILL.mdtoSKILL.md.disabledand back, after confirmation
every skill's file tree, one click away
safety
Skillview binds only to 127.0.0.1. Skill content stays on your machine and is never sent to a cloud service.
The packaged server rejects non-loopback hosts and cross-origin browser requests, requires JSON for state-changing requests, and sends a restrictive Content Security Policy. All actions use server-issued skill IDs. Before reveal or toggle, the server freshly rediscovers the record, validates its source and canonical path, and checks its capabilities. Raw client-provided filesystem paths are not accepted.
Plugin cache, marketplace, installed-plugin, and linked records are inspection-only. Their files are managed by agent/plugin tooling and are never renamed by Skillview. Project and marketplace traversal is bounded; only explicit top-level skill symlinks in documented roots are followed, and those targets remain inspection-only.
Deletion and arbitrary file editing are deliberately unavailable.
Skill files are untrusted instructions and may include scripts. Skillview displays their text and file names but never executes their contents. Markdown previews cannot load remote images in the packaged app. See SECURITY.md to report a vulnerability privately.
status and compatibility
Stable. The local inspection and guarded enable/disable workflow is covered by automated tests. Discovery compatibility is intentionally explicit:
| host | supported local sources | not currently represented |
|---|---|---|
| Amp | ~/.config/agents/skills, ~/.agents/skills, ~/.config/amp/skills, project .agents/skills, Claude-compatible locations | built-ins, remote personal/workspace skill repositories, directory-plugin registrations, amp.skills.path |
| Codex | ~/.agents/skills, project .agents/skills | /etc/codex/skills, built-ins and plugin-distributed skills |
| Claude Code | user/project skills, installed-plugin registry, cache and registered marketplace checkouts | remote marketplace state not present on disk |
Node 20.19 or newer is required by the build/runtime dependency line. Compatibility describes filesystem layouts documented on 2026-08-16; agent hosts can change them independently.
roadmap
- expose configured Amp skill paths without invoking or uploading skill content
- represent Amp directory-plugin and remote-repository provenance when a stable local API exists
- add content hashes and duplicate/version-drift comparisons without executing skill code
- keep mutation support narrow: explicit user/project enable and disable only
Changes are recorded in CHANGELOG.md. The source-specific fixtures in src/server/skills.test.ts are the compatibility evidence; unsupported sources remain listed above rather than inferred.
local development
Requires Node.js 20.19 or newer.
bun install
bun run dev
Build and run the same standalone server shipped in the package:
bun run build
bun start -- --no-open
checks
bun run test
bun run build
npm pack --dry-run
The suite covers frontmatter parsing, Amp/Codex/Claude filesystem layouts, all six source kinds, linked-skill handling, plugin registry validation, provenance-preserving IDs, action authorization, cross-origin rejection, static asset isolation, and the production HTTP boundary.
publishing
Publishing remains a deliberate maintainer action:
npm pack --dry-run
npm publish --dry-run
npm publish
license
MIT