Describe what you want to do, point skillmeld at your repo, and it finds existing community skills for the job, security-scans them, and merges the best two or three into one coherent skill set tailored to your project — instead of writing one from scratch.
It runs on your own Claude in Claude Code, grounds in your repo, and shows you what it pulled, what it found, and why before anything is installed. It builds on the existing skills ecosystem (the open standard, community marketplaces, and registries) rather than replacing it.
skillmeld composes; it does not generate. Every line in a merged skill traces byte-for-byte back to a source skill — a deterministic verifier enforces this, so the tool can never invent an instruction. The hard, mechanical work (parsing, security scanning, deduplicating, conflict detection, packaging) runs as deterministic Python that makes zero model calls. Your Claude supplies the judgment; the engine supplies the guarantees.
Composition tools are appearing on other layers too: AgentSkillOS retrieves skills from a large pool and chains them into runtime workflows, and SkillComposer has a model generate and evolve its own skills. skillmeld's job is different: it merges skills other people wrote — untrusted input — into one reviewed, deduplicated set before anything runs, with a security verdict on every source and a byte trace on every line.
A Claude Code skill drives a bundled Python engine through one pipeline:
intake -> ground -> discover -> select (<=3) -> fetch -> security gate -> merge -> eval -> emit
- ground scans your repo into a use-case profile, locally.
- discover syncs a signed catalog of community skills (Ed25519-verified, hash-pinned, cached locally) and your Claude ranks the shortlist.
- security gate scans every candidate (PASS / REVIEW / BLOCK) before you see it, and again after merge.
- merge parses each skill into byte-exact atoms, deduplicates, resolves conflicts, prunes to your use case, and partitions the result into at most three skills behind a thin routing orchestrator. A verifier proves every output atom traces to a source.
- emit packages the result for Claude Code, a claude.ai zip, the API, or a Claude Code plugin marketplace, with a
PROVENANCE.mdrecording where every part came from.
skillmeld runs in Claude Code and needs uv. Clone it and check it runs:
git clone https://github.com/ifylab/skillmeld && cd skillmeld
uv run skillmeld --helpA PyPI release for one-line install (uv tool install skillmeld / pipx install skillmeld) is planned.
As a skill — from the clone root, add the marketplace, install the plugin, and invoke it with your use case:
/plugin marketplace add .
/plugin install skillmeld@ifylab
/skillmeld I get IFC models from architects and need a quantity takeoff plus validation
Or exercise individual stages directly from the CLI (each command prints JSON):
uv run skillmeld catalog sync # fetch and verify the hosted catalog
uv run skillmeld ground . # scan a repo into a profile
uv run skillmeld scan path/to/skill --license # security- and license-scan a bundle
uv run skillmeld merge --bundles a/ b/ --profile profile.jsonThe full pipeline — discover, select, fetch, the eval loop, and every JSON contract these
commands exchange — is walked step by step in skills/skillmeld/SKILL.md.
Offline, dev-catalog builds the same signed catalog locally from repos you name.
- Not a generator. It assembles existing skills; it never authors new instructions. A convention no source skill covers is yours to add, not a gap skillmeld fills.
- Not a catalog. It composes from community marketplaces and registries rather than being one.
- Not a model. The engine makes zero LLM calls; the judgment comes from your own Claude, on your tokens.
skillmeld stands on the open Agent Skills ecosystem — the skill format, the community marketplaces, and the registries that publish and share skills. It composes that work; it does not replace it. Security scanning leans on bandit, with optional semgrep and gitleaks when present.
In active development, built in the open one piece at a time. The discovery, security, merge, evaluation, and packaging stages are implemented and tested, and discovery runs against a hosted signed catalog rebuilt weekly by CI — every published skill is crawled at a pinned commit and pre-scanned into an advisory verdict index. The curated AEC corpus is coming next. See the changelog.
Python 3.12, managed with uv. Ruff for lint and format, ty for type-checking, pytest for tests.
uv run ruff check . && uv run ruff format --check . && uv run ty check && uv run pytestIssues and pull requests are welcome — see CONTRIBUTING.md. Contributions are accepted under the project's Apache 2.0 license (inbound = outbound); no separate contributor agreement is required.