SKILL.md files, and the registry’s read surface is public. You never need the Python SDK — or an account — to find a skill, judge its evidence, and get it onto disk where your runtime (Claude Code, Cursor, Copilot, Cline, …) auto-discovers it.
Five routes, one destination:
Whatever the route, do the two trust checks first: the verified lift (with-vs-without benchmark, with model + case count + date) and the safety band (Passed / Caution / Blocked / Not yet reviewed). Both are on every skill’s public page — see How skills are vetted. Four of the five routes below don’t decide for you.
decimalai skills pull writes whatever the registry serves — including a Caution or even a Blocked skill, with no prompt and no warning — and copy-paste obviously can’t stop you. The raw rail is the one route with a server-side gate: /s/<slug>/SKILL.md 404s for a Blocked skill. The Claude Code plugin reads the band before it writes — it refuses a Blocked skill and asks you first on Caution or Not yet reviewed — but that is a prompt in your own session, not a boundary the model can’t cross, so treat it as a convenience rather than a control (why that distinction matters). Blocked skills are still listed on every route, deliberately, so you can see that a skill exists and why it’s unsafe — the band on the page is the check, not the tooling.
Web copy-paste
Open any skill atapp.decimal.ai/skills/<slug> — for example playwright-cli — view the full SKILL.md body, and copy it into your project:
name plus the source stamp below — so just add a description: line (runtimes route on name + description). If you copy the raw body by hand instead, add a minimal block yourself:
Provenance: the source stamp
The raw-serve routes stamp two extra frontmatter keys into the body they hand you — bothcurl https://app.decimal.ai/s/<slug>/SKILL.md and the Copy SKILL.md button. decimalai skills pull does not: it reconstructs name + description only, so add these by hand if you pulled with the CLI:
source value is a permalink to that exact version: it keeps serving version <version> for as long as that version exists, so it never tells you a newer one has shipped. To answer “am I behind?”, fetch the always-current https://app.decimal.ai/s/<slug>/SKILL.md and compare your stamped source_sha256 against the first 12 hex of the response ETag — and its -v<n> suffix against your stamped <version>. No stamp, no answer.
CLI pull (decimalai skills pull)
The DecimalAI CLI ships with the Python package, but skills pull is anonymous — no API key, no signup:
<out>/<slug>/SKILL.md with reconstructed frontmatter, plus the skill’s eval.yaml test suite when the author published one — so you can re-run the with-vs-without benchmark yourself with the open runner. Other forms:
decimalai skills install — the one skills command that needs an API key.
Raw URLs (scripts, CI, and LLM agents)
Every published skill is fetchable as plain text — no HTML scraping, no auth:source_sha256 to the first 12 hex of the ETag, no local hashing required. The hash is taken over the body before the stamp is injected, so hashing the served bytes will not match. Note the @<version> form is a version archive, not a currency check — it serves whichever historical version you ask for. The ETag’s -v<n> suffix on the unpinned URL is what carries the current version number.
MCP server
decimalai-mcp gives any MCP client — Claude Code, Claude Desktop, Cursor — three read-only registry tools: search_skills, get_skill (full record: trust bands, verified lift, SKILL.md body), and get_leaderboard. No API key required:
uvx fetches and runs it without installing anything permanently (uv required). Then ask your agent things like:
“find me a measured skill for enterprise customer onboarding, and show its verified lift, case count, and safety band”Today that returns
gtm-enterprise-onboarding first — +78.3 points over 23 cases, safety Passed — with the evidence inline, so you can judge it without opening a browser.
This is the discovery route — it answers “which skill should I use, and what’s the evidence?” without leaving your editor. It is deliberately read-only: it searches and inspects, it never writes files. Pair it with decimalai skills pull (above) to actually install what it finds — or, in Claude Code, the plugin below does both halves in one place.
Optional: set
DECIMAL_API_KEY to also see which skills your org has already installed.Claude Code plugin
Full guide: Claude Code plugin. In short — two commands and the registry moves inside the session — nothing tocurl, no directory to pick, no pip install:
claude plugin details decimalai@decimalai shows what you took on (excerpt — the full output also breaks the cost down per command):
/decimalai:search <query> ranks the public registry by measured effectiveness rather than downloads: each row carries a SkillScore, the verified lift with its model and case count, the safety band, and how many agents currently have the skill installed. Searching for sql injection surfaces detecting-sql-injection-via-waf-logs — +54.6 points over 22 cases on gemini-3.6-flash, safety Passed.
/decimalai:install <url_slug> writes .claude/skills/<slug>/SKILL.md plus the skill’s attachments, carrying the same source and source_sha256 keys the raw rail injects — see Provenance: the source stamp. It is the same construction over the same bytes, so the ETag comparison under Raw URLs answers “am I behind?” for a plugin-installed file with no extra work. Pass the url_slug that search printed, not the name — a registry name may be namespaced (owner/skill), and a / is neither a URL path segment nor a directory name. Attachments land only one level under scripts/, references/, templates/ or assets/, and each one’s SHA-256 is checked against the registry’s content_hash before it is written — anything failing either test is skipped with a warning.
/decimalai:check writes the two files behind the regression-check Action: the manifest-extraction entry point scripts/init_for_decimal.py and the workflow .github/workflows/decimal-regression-check.yml, with your repo’s real agent_name filled in. The workflow it writes needs a DECIMAL_API_KEY repo secret — the check runs against your own production traces — and adding that secret is still yours to do.
The route that refuses
Every other route on this page hands you whatever the registry serves. This one doesn’t, and that is the reason to reach for it. The registry returns blocked skills in ordinary search responses, so filtering is the plugin’s job rather than the API’s. Searchsql injection and one of the matches is performing-second-order-sql-injection. Its safety scan is clean — the pattern checks for live secrets, reverse shells and data exfiltration all came back empty — and the intent review rejects it anyway, for walking a reader through extracting credentials out of a database. Pattern scanning was never going to catch that one; reading the file for purpose did.
The plugin still shows it, but not as a result: it comes last under a Blocked — will not install heading, with the reason and no install line, and /decimalai:install performing-second-order-sql-injection stops before writing a file. Dropping the row silently would be the worse failure — you searched for something, a match exists, and you are entitled to know why it is withheld.
Same policy as the rest of this page, moved one step earlier. Blocked skills stay listed either way; what changes here is that the tooling also declines to be the thing that puts one on disk.
When you do want the SDK
Everything above is consume-only: the file lands on disk and your runtime takes it from there. The SDK adds the feedback loop — forking skills into your org, routing them per-turn, and measuring which ones actually help your agent on your traffic. When you’re ready for that: Quickstart and the registry guide.Related
- Install a Skill in 5 Minutes — the tutorial version of this page: one skill, end to end
- Trust & exit — open formats, graceful degradation, and what leaving looks like
- How skills are vetted — what the safety bands mean
- skillevaluation — the open spec + runner behind every verified lift number