AI skill router for coding agents
review this app for accessibility [skillranger](skillranger)
npx -y skillranger@latest setupWorks with Codex, Claude Code, Cursor, OpenCode, Gemini CLI.
Zero runtime deps: installed skills are static instructions — nothing executes at install time. Requires Node.js 20+.
Prompt chaos · skill chaos
Ask an agent to review a Next.js app for accessibility and it improvises: the run has no repository context, no audited skill selection, and no reviewable install plan.
Generic prompts
Every run starts from a generic prompt. Your repository's context — stack, conventions, constraints — never enters it.
No audited selection
Nothing checks the instructions an agent follows for compatibility with your repo, or for safety, before use.
No reviewable plan
The agent picks its own approach and writes files. Nothing shows what will be installed, or why, before it happens.
SkillRanger is the other path: scan the repository, recommend compatible skills, audit them, and present a reviewable install plan before anything is written.
Scan · Recommend · Audit · Install
One run against your repository: scan, recommend, audit, install. The panel types the real output of a skillranger run — every line verbatim from a captured transcript.
Repo + task
The run starts from your repository and the task in your prompt.
Detect stack
skillranger scan reads the repository: package manager, languages, styling.
Select compatible skill set
skillranger recommend nominates compatible skills from the bundled catalog, grounded in the task.
Audit and preview
skillranger audit checks the nominated skill for risk and integrity before anything is written.
Install reviewed instructions + lockfile
A dry-run plan lists every file that would be written; skillranger.lock.json tracks what lands.
Agent performs the task
With the audited skills installed and tracked, your agent does the work — model calls and code changes stay in your hands.
Real output from the skillranger CLI
$ skillranger scan .Project: <repo root>Package manager: pnpm (pnpm-lock.yaml)Types: unknownLanguages: typescriptFrameworks: none detectedStyling: none detectedTesting: none detected$ skillranger recommend . --target codex --intent "Review this app before release" --explainDetected:- Languages: typescript- Project types: unknownBundled domains:- frontend$ skillranger audit frontend.visual-design-polishfrontend.visual-design-polish: risk low, security 0.95, sha256:59e33c32f304f9ec43b364ff81380f3cdf2743b85a98e726703b743476dab447No findings.$ skillranger install frontend.visual-design-polish --project . --target codex --scope repo --dry-runInstall plan for frontend.visual-design-polishTarget: codex, scope repoWould write:- .agents/skills/visual-design-polish/SKILL.md- .agents/skills/visual-design-polish/evals.json- …Would update:- skillranger.lock.jsonNext: re-run with --yes to apply.
43CLI commands
34MCP tools
18bundled skill packages
0runtime deps
Features
Context-aware recommendations. Reviewable install plans. Hybrid prompt routing. Lockfile integrity. Local-first operation. Multiple agent targets.
skillranger scan + recommend
The scan reads your repository — package manager, languages, styling — and the task in your prompt. Recommendation is a routing proposal: a catalog-bound, prompt-grounded set of skill nominations, each with its evidence.
repo + task → scan → routing proposal
skillranger install --dry-run
Nothing is written blindly. A dry-run plan lists every file that would be written and updated; you review it, then re-run with --yes to apply — explicit writes only.
dry-run plan · review · apply
MCP catalog · deterministic fallback
Skill selection is hybrid: MCP catalog-assisted nominations ground the agent's proposal in the audited registry, and a deterministic fallback applies the same eligibility rules.
catalog-assisted nominations · hard veto
skillranger.lock.json
Every install is tracked in the lockfile — versions, checksums, targets, and audit data — so the installed state of your repository is always inspectable.
versions · checksums · targets · audit data
runs locally
The CLI and MCP server run against your own repository, on your machine, with the audited catalog bundled locally. No API keys required.
bundled registry · no API keys
--target
The same audited skill installs for Codex, Claude Code, Cursor, OpenCode, Gemini CLI — and any MCP host — recorded per target and scope in the lockfile.
codex · claude-code · cursor · opencode · gemini-cli
+ MCP hosts
Security model
SkillRanger installs files into your repository, so the model is stated plainly: five guarantees you can verify before anything is written.
Bundled local registry
Skill nominations come from a catalog bundled with the package — an audited local registry on your machine.
Static instructions
Installed skills are static instruction files — nothing executes at install time, and the package adds no runtime dependencies.
Explicit writes
Every write is explicit: a dry-run plan lists each file that would be written, and install applies only what you approved.
Lockfile integrity
skillranger.lock.json records installed versions, checksums, targets, and audit data — so the installed state of your repository is always inspectable.
Host-managed execution
Your agent stays in charge: it owns model calls and code changes, while SkillRanger validates nominations and enforces routing and runtime guarantees.
One project · any agent
Repo-local setup targets Codex, Claude Code, Cursor, OpenCode, Gemini CLI, and any Model Context Protocol host routes through the stdio MCP server. One project can be prepared for every target, tracked in a single lockfile.
One command · one project
npx -y skillranger@latest setupScans your repo, recommends compatible skills, audits them, and shows a reviewable plan before anything is written. Requires Node.js 20+.