What it does
RoleCraft is a command-line tool for installing and managing skills for AI coding agents. A skill can come from a local folder, a GitHub, GitLab or SSH URL, or an npm package, and no marketplace or signup is needed. It can also install a skill together with its MCP servers, for the nine agents the page says support them. The page counts 90 supported agents, 65 of them verified. Before a skill is written into an agent's skill directory, RoleCraft runs a static scan for prompt injection, command injection, obfuscated code and credential harvesting, and gives a score from 0 to 100. A score of 90 or more is rated safe and the install proceeds, 70 to 89 asks for confirmation, and below 70 is rated dangerous and blocked unless you pass --yes. Any critical finding is also rated dangerous regardless of score. The page is open that this is a pattern-matching linter: it does not read natural-language instructions and does not scan every kind of MCP server source. Other commands cover listing and removing skills, searching GitHub, a doctor health check, testing a skill against built-in assertions, lockfile-based reinstalls for CI, saved profiles for multi-agent setups and shell completions. A Node.js API is available for scripts. It needs Node.js 22 or later, uses only Node.js built-ins at runtime, and is MIT licensed.
Capabilities
- Installs skills from local folders, GitHub, GitLab, SSH or npm
- Static security score from 0 to 100 before every install
- Installs MCP servers alongside skills for supporting agents
- Lockfile-based CI reinstalls and dry runs
- Saved profiles for multi-agent setups and a built-in skill tester
- Node.js API for scripting
When to use it
- You use several AI coding agents and want to install the same skills into all of them
- You want skills from third-party sources checked for risky patterns before they are installed
- You need lockfile-based skill reinstalls in CI
