What it does

autoskills scans your project files—package.json, Gradle configs, and other markers—to figure out what technologies you’re using. Then it pulls matching “AI skills” (context files, prompts, or rules that help coding agents work with your stack) from a maintained registry and installs them locally. Think of it as npm install, but for making your AI assistant less clueless about your codebase.

The interesting bit

The security model is the rare part that got thought through. Skills aren’t fetched live from random GitHub repos at runtime. Maintainers audit them for prompt-injection and supply-chain risks, pin SHA-256 hashes in a manifest, and the CLI verifies against that manifest before writing anything. It also generates a skills-lock.json so you can track what got installed and from where.

Key highlights

• One command: npx autoskills with zero configuration
• Supports a sprawling list of stacks: React to Flutter, Vercel to Terraform, ElevenLabs to Drizzle
• --dry-run to preview without installing; -y to skip confirmation
• Requires Node.js 22 or newer
• Licensed CC BY-NC 4.0 (non-commercial)

Caveats

• The “audited registry” is centralized through this project; you’re trusting midudev’s curation and review cadence
• Non-commercial license means think twice before using at your day job
• Ruby is listed as the repo language, but this appears to be a Node.js CLI tool—the Ruby classification may be a GitHub detection quirk

Verdict

Worth a look if you’re tired of hand-writing .cursorrules or Copilot instructions for every new project. Skip it if you need commercial use, prefer to curate your own AI context, or don’t trust centralized registries.