Your AI agents' skills are a mess. ASM is the broom.

What it does

asm is a normalization layer for the fragmented world of AI agent “skills” — essentially markdown prompt packs that different coding agents store in their own hidden directories. It auto-discovers what you have installed across all supported tools, lets you install new skills directly from GitHub, and runs a security audit before anything lands on your disk. If you build your own skills, it also handles scaffolding, live-reload symlinking, and publishing to a central registry.

The interesting bit

The project treats SKILL.md files as untrusted code, which they are: its scanner flags shell execution, network access, credential exposure, and obfuscation patterns before installation. It is essentially high-grade glue — it knows 19 different agents’ directory conventions by heart — but the security-first stance turns a boring sync problem into a trust boundary.

Key highlights

• Supports 19 providers out of the box, including Claude Code, Codex, Cursor, Windsurf, Cline, and GitHub Copilot, with auto-discovery of their skill directories.
• Built-in security scanner audits skills for dangerous patterns like atob() calls, suspicious base64 blocks, hex escapes, and hardcoded credential assignments.
• Maintains a browsable catalog of 2,800+ skills and an ASM Registry where published skills can be installed by name rather than URL.
• Offers a full local development loop: scaffold a skill, symlink it for live testing, audit it, inspect metadata, and publish via an automated pull request.
• Dual interface: an interactive TUI for browsing and a CLI with --json output for scripting and CI pipelines.

Caveats

• Publishing to the ASM Registry requires the gh CLI to be installed and authenticated; it is not a standalone GitHub client.
• The tool is Node.js-based (requires version 18+), which may be a barrier if you are trying to avoid the npm ecosystem.

Verdict

Worth a look if you juggle multiple AI coding agents and are tired of manually copying markdown files into hidden folders. Skip it if you only use one agent with a single skill directory — you probably do not need a package manager yet.