Skill Management

This page covers the operational lifecycle for skills: inspect the catalog, install trusted skill directories, remove managed skills, reload a running gateway, and control visibility.

For the runtime model and SKILL.md format, see Skills System. For writing a skill, see Skill Authoring.

List Skills

Use the CLI to inspect the catalog for the selected home:

anyy skills list
anyy skills list --home ~/.anyy
anyy skills list --json

The list is resolved from the same roots the runtime uses:

1. <home>/skills
2. skills.external_roots[]
3. ~/.agents/skills, if it exists
4. <home>/system/skills

In an interactive Anyy session, use:

/skills

The model-visible equivalent is skills_list, which returns compact metadata and can optionally be filtered by category.

View Skills

View a skill's main instructions:

anyy skills view release-checklist

View a supporting file:

anyy skills view release-checklist references/workflow.md

The slash-command equivalent is:

/skill release-checklist

The model-visible equivalent is skill_view, using either name or id and an optional file_path.

Install Sources

anyy skills install writes to the managed root, <home>/skills, and records provenance in <home>/skills/.manifest.json.

Supported sources are:

Source	Example	Notes
Local skill directory	anyy skills install ./release-checklist	The directory must contain exactly one valid SKILL.md for the skill.
Public HTTPS SKILL.md	anyy skills install --name release-checklist https://example.com/SKILL.md	Requires --name; the downloaded SKILL.md must be self-contained.
GitHub skill directory	anyy skills install github:owner/repo/path@main	Fetches committed files through the GitHub API and records commit provenance.
GitHub URL	anyy skills install https://github.com/owner/repo/tree/main/path	Equivalent to the GitHub shorthand.
GitHub collection	anyy skills install --all github:owner/repo or anyy skills install github:owner/repo/*	Installs every candidate directory containing SKILL.md; blocked candidates are reported.

If a source already exists under the same skill name, add --force to replace it:

anyy skills install --force ./release-checklist

For imported skills that use source-specific tool names or paths, a rewrite profile can adapt common wording mechanically:

anyy skills install --rewrite-profile PROFILE github:owner/repo/path@main

Unknown profile names are rejected. The rewrite is mechanical; review imported skills before relying on them.

Install Safety

Managed installs are deliberately narrower than arbitrary repository checkout:

• Remote single-file installs must use HTTPS and point to SKILL.md.
• Remote URLs must not include credentials.
• Remote URLs that target localhost, private networks, link-local networks, or internal hostnames are blocked.
• Single remote SKILL.md downloads are capped at 2 MiB.
• GitHub installs reject symlinks, unsupported tree entries, path escapes, files larger than 2 MiB, bundles larger than 8 MiB, and bundles with more than 256 files.
• GitHub installs scan staged content. Dangerous findings block the install; caution findings require --force.

The scanner flags patterns such as network downloads piped into a shell, rm -rf /, authorized_keys, /etc/sudoers, local secret paths, binary content outside assets, executable regular files, and front matter that requests allowed-tools.

Uninstall Skills

Uninstall removes a managed skill directory and its manifest entry:

anyy skills uninstall release-checklist

Only managed skills under <home>/skills are uninstalled this way. System skills and external-root skills are not removed by the managed uninstall command. The manager refuses to uninstall a symlinked skill directory.

Reload A Running Gateway

The CLI commands that mutate disk state can optionally reload the running gateway:

anyy skills install --now ./release-checklist
anyy skills uninstall --now release-checklist

--now calls the gateway over the configured Unix socket after the disk mutation succeeds.

You can also reload explicitly:

anyy skills reload
anyy skills reload --socket ~/.anyy/anyy.sock

Reload refreshes skill configuration from disk, rebuilds the scoped catalog, and returns added, removed, changed, unchanged, and total counts.

note

Installing a skill without --now updates disk state immediately, but a running gateway keeps its current catalog until it reloads or restarts.

External Roots

Use skills.external_roots when you maintain skills outside Anyy's managed root:

skills:
  external_roots:
    - ~/.agents/skills
    - ${TEAM_SKILLS_ROOT}

Paths support ~, $VAR, and ${VAR} expansion. If an environment variable is missing, that root is skipped. External roots are scanned after <home>/skills, so managed skills shadow external skills with the same name.

The model-visible skill_manage tool has an add_external_root action for this case. It writes skills.external_roots through Anyy's setup helper and can materialize a rewritten generated view when a rewrite profile is requested.

Disable Or Re-enable A Skill

Visibility is controlled through config.yaml:

skills:
  disabled:
    - skill_user_abc123
  disabled_by_surface:
    tui:
      - noisy-helper
    api:
      - /internal-command

Entries can be a skill ID, skill name, or command name. The gateway's skills.toggle RPC writes exact skill IDs to skills.disabled, reloads the catalog, and audits the change. System skills cannot be toggled off through that RPC.

There is no anyy skills enable or anyy skills disable CLI command in this build. Edit config.yaml or use a local client that calls skills.toggle.

Agent-Managed Skills

When the skills toolset is enabled, the assistant can manage profile-local skills through skill_manage. Supported actions are:

Action	Purpose	Key arguments
install	Install from a supported source	source, optional name, force, all, rewrite_profile, reload
uninstall	Remove a managed skill	name, optional reload
reload	Reload the runtime catalog	none
add_external_root	Add a read-only external skill root	path, optional rewrite_profile, reload
create	Create a new managed skill	name, content, optional force, reload
edit	Replace SKILL.md for an installed managed skill	name, content, optional reload
patch	Replace text in SKILL.md or a supporting file	name, old_string, new_string, optional file_path, replace_all, reload
delete	Remove a managed skill	name, optional reload
write_file	Write a supporting file	name, file_path, file_content, optional reload
remove_file	Remove a supporting file	name, file_path, optional reload

Agent writes are limited to the managed root. Supporting file writes must stay under references/, templates/, scripts/, or assets/. The tool is audited as a high-risk skill change even though it does not grant the skill any new tool permissions.