Run it from the workspace you want to inspect. Skillview opens a browser and builds a provenance-aware inventory of the agent skills on your machine — the shared SKILL.md format used by Amp, Codex, Claude Code, and other coding agents. It reads native Amp/Codex directories, Claude directories and plugin registries, and explicitly exposed symlink targets.

Also works with npx @pc_style/skillview if you don't use Bun.

highlights

• provenance-aware — the same skill can appear as an installed plugin copy, a cached version, and a marketplace source; each record keeps its source, plugin, marketplace, and version context
• fast filtering — search by name, description, or path; filter by source and lifecycle
• deep inspection — rendered Markdown, raw SKILL.md, file trees, and metadata for every skill
• safe by design — read-mostly, localhost-only, no cloud sync

sources

Skillview discovers:

source	where
Amp user	~/.config/agents/skills, ~/.agents/skills, and ~/.config/amp/skills
Codex user	shared skills in ~/.agents/skills
Claude user	direct skills in ~/.claude/skills
linked	valid skill-directory symlinks explicitly exposed in a discovered user or project root
Amp / Codex project	.agents/skills directories beneath the selected workspace
Claude project	.claude/skills directories beneath the selected workspace
installed plugin	active installations recorded in ~/.claude/plugins/installed_plugins.json
plugin cache	current, historical, and orphaned skill copies under ~/.claude/plugins/cache
marketplace	available plugin skills under registered local marketplace checkouts

Skillview scans only these documented roots and bounded project directories. It does not inspect Amp built-ins, remote personal/workspace repositories, Codex system skills, or arbitrary directories configured through amp.skills.path. Ephemeral runtime bundles under /private/tmp are also excluded from the standalone package.

options

--workspace <path>  workspace to scan instead of the current directory
--port <number>     localhost port, or 0 for an available port (default: 4173)
--no-open           start the server without opening a browser
-h, --help          show help

Examples:

bunx @pc_style/skillview --workspace ~/projects/my-app
bunx @pc_style/skillview --port 4317 --no-open

SKILL_VIEW_WORKSPACE_ROOT remains available as an environment override.

lifecycle labels

label	meaning
enabled / disabled	direct user/project skill state, or installed plugin state from Claude settings
installed	plugin is registered but has no explicit enabled boolean
cached	managed plugin cache artifact
available	marketplace source that may not be installed

what it does

• previews skill descriptions, rendered Markdown, raw SKILL.md, metadata, and file trees
• searches and filters by source and lifecycle
• shows plugin, marketplace, version, linked-target, and canonical-path provenance
• copies paths and skill content
• reveals freshly validated skill folders in Finder on macOS
• enables or disables direct user/project skills by renaming SKILL.md to SKILL.md.disabled and back, after confirmation

safety

Skillview binds only to 127.0.0.1. Skill content stays on your machine and is never sent to a cloud service.

The packaged server rejects non-loopback hosts and cross-origin browser requests, requires JSON for state-changing requests, and sends a restrictive Content Security Policy. All actions use server-issued skill IDs. Before reveal or toggle, the server freshly rediscovers the record, validates its source and canonical path, and checks its capabilities. Raw client-provided filesystem paths are not accepted.

Plugin cache, marketplace, installed-plugin, and linked records are inspection-only. Their files are managed by agent/plugin tooling and are never renamed by Skillview. Project and marketplace traversal is bounded; only explicit top-level skill symlinks in documented roots are followed, and those targets remain inspection-only.

Deletion and arbitrary file editing are deliberately unavailable.

Skill files are untrusted instructions and may include scripts. Skillview displays their text and file names but never executes their contents. Markdown previews cannot load remote images in the packaged app. See SECURITY.md to report a vulnerability privately.

status and compatibility

Stable. The local inspection and guarded enable/disable workflow is covered by automated tests. Discovery compatibility is intentionally explicit:

host	supported local sources	not currently represented
Amp	~/.config/agents/skills, ~/.agents/skills, ~/.config/amp/skills, project .agents/skills, Claude-compatible locations	built-ins, remote personal/workspace skill repositories, directory-plugin registrations, amp.skills.path
Codex	~/.agents/skills, project .agents/skills	/etc/codex/skills, built-ins and plugin-distributed skills
Claude Code	user/project skills, installed-plugin registry, cache and registered marketplace checkouts	remote marketplace state not present on disk

Node 20.19 or newer is required by the build/runtime dependency line. Compatibility describes filesystem layouts documented on 2026-08-16; agent hosts can change them independently.

roadmap

• expose configured Amp skill paths without invoking or uploading skill content
• represent Amp directory-plugin and remote-repository provenance when a stable local API exists
• add content hashes and duplicate/version-drift comparisons without executing skill code
• keep mutation support narrow: explicit user/project enable and disable only

Changes are recorded in CHANGELOG.md. The source-specific fixtures in src/server/skills.test.ts are the compatibility evidence; unsupported sources remain listed above rather than inferred.

local development

Requires Node.js 20.19 or newer.

bun install
bun run dev

Build and run the same standalone server shipped in the package:

bun run build
bun start -- --no-open

checks

bun run test
bun run build
npm pack --dry-run

The suite covers frontmatter parsing, Amp/Codex/Claude filesystem layouts, all six source kinds, linked-skill handling, plugin registry validation, provenance-preserving IDs, action authorization, cross-origin rejection, static asset isolation, and the production HTTP boundary.

publishing

Publishing remains a deliberate maintainer action:

npm pack --dry-run
npm publish --dry-run
npm publish

license

MIT