Skip to main content
Skills are open SKILL.md files, and the registry’s read surface is public. You never need the Python SDK — or an account — to find a skill, judge its evidence, and get it onto disk where your runtime (Claude Code, Cursor, Copilot, Cline, …) auto-discovers it. Six routes, one destination: Whatever the route, do the two trust checks first: the verified lift (with-vs-without benchmark, with model + case count + date) and the safety band (Passed / Caution / Blocked / Not yet reviewed). Both are on every skill’s public page — see How skills are vetted. The install tools enforce the band for you: Blocked never installs, Caution/Unreviewed prompt for confirmation.
Channels marked launch wave below are rolling out with the current launch: the commands are final, but if a marketplace or package listing isn’t live yet for you, check back shortly.

​
Web copy-paste

Open any skill at app.decimal.ai/skills/<slug> — for example support-ticket-kit — view the full SKILL.md body, and copy it into your project:
The Copy SKILL.md button on the skill page copies the body with frontmatter already stamped — name plus the source stamp below — so just add a description: line (runtimes route on name + description). If you copy the raw body by hand instead, add a minimal block yourself:

​
Provenance: the source stamp

The tooling routes (npx, the Claude Code plugin) stamp two extra frontmatter keys on every install, and when copying by hand it’s worth adding them yourself:
That’s the whole scheme — where the file came from, and a fingerprint of the exact body you took. Six months from now it answers “which version is this, and have we edited it?”: re-fetch the source URL, hash it, compare. No stamp, no answer.

​
CLI pull (decimalai skills pull)

The DecimalAI CLI ships with the Python package, but skills pull is anonymous — no API key, no signup:
Writes <out>/<slug>/SKILL.md with reconstructed frontmatter, plus the skill’s eval.yaml test suite when the author published one — so you can re-run the with-vs-without benchmark yourself with the open runner. Other forms:
Read-only by design: no fork is created and nothing is tracked. If you later want a fork in your org (upstream-update detection, effectiveness measurement on your own traffic), that’s decimalai skills install — the one skills command that needs an API key.

​
npx (npx decimalai add)

Launch wave. For JS/TS projects — or anyone who doesn’t want Python — the npx installer vendors a skill with zero runtime dependencies (Node 18+):
Beyond writing SKILL.md (stamped with the source stamp) and any attachments, it maintains .decimal/skills.lock.json — a hash-pinned lockfile ({slug: {version, sha256, files[]}}), so skill drift shows up in review like dependency drift does. A successful install sends one anonymous event ({event: "install", channel: "npx", slug, version}) so the registry can count installs honestly — no user content, no machine identifiers, never blocks the install. Opt out with --no-telemetry or DECIMALAI_NO_TELEMETRY=1.

​
Raw URLs (scripts, CI, and LLM agents)

Launch wave — these apex URLs go live with the launch. Every published skill is fetchable as plain text — no HTML scraping, no auth:
The ETag doubles as an integrity check: it’s the same sha256 the source stamp truncates, so a stamped file can be verified against the live registry in one request. Note the registry serves the current version only — the @<version> form is a pin-check, not a version archive.

​
MCP server

Launch wave. decimalai-mcp gives any MCP client — Claude Code, Claude Desktop, Cursor — three read-only registry tools: search_skills, get_skill (full record: trust bands, verified lift, body), and get_leaderboard. No API key required:
Then ask your agent things like “find me a measured skill for invoice field extraction and show its safety scan.” The MCP server searches and inspects; pair it with npx or the plugin to actually write files.

​
Claude Code plugin

Launch wave. The plugin wraps search + install + trust checks into slash commands inside Claude Code:

​
When you do want the SDK

Everything above is consume-only: the file lands on disk and your runtime takes it from there. The SDK adds the feedback loop — forking skills into your org, routing them per-turn, and measuring which ones actually help your agent on your traffic. When you’re ready for that: Quickstart and the registry guide.