> ## Documentation Index > Fetch the complete documentation index at: https://docs.decimal.ai/llms.txt > Use this file to discover all available pages before exploring further. # Use Skills Without the SDK > Every route from the public registry to your agent that doesn't require the Python SDK — web copy, CLI pull, npx, raw URLs, the MCP server, and the Claude Code plugin. Skills are open `SKILL.md` files, and the registry's read surface is public. You never need the Python SDK — or an account — to find a skill, judge its evidence, and get it onto disk where your runtime (Claude Code, Cursor, Copilot, Cline, …) auto-discovers it. Six routes, one destination: | Route | Best for | Writes to disk | Telemetry | | ---------------------------------------------------------- | ------------------------------------ | ----------------------------------- | ----------------------------------- | | [Web copy-paste](#web-copy-paste) | One-off, zero tooling | You do it | None | | [`decimalai skills pull`](#cli-pull-decimalai-skills-pull) | Python users; want `eval.yaml` too | `.//SKILL.md` | None | | [`npx decimalai add`](#npx-npx-decimalai-add) | JS/TS projects; hash-pinned installs | `.claude/skills//` + lockfile | 1 anonymous install event (opt-out) | | [Raw URLs](#raw-urls-scripts-ci-and-llm-agents) | Scripts, CI, LLM agents | You do it | None | | [MCP server](#mcp-server) | Search/inspect from any MCP client | No (read-only tools) | None | | [Claude Code plugin](#claude-code-plugin) | Search + install inside Claude Code | `.claude/skills//` | None | Whatever the route, do the two trust checks first: the **verified lift** (with-vs-without benchmark, with model + case count + date) and the **safety band** (Passed / Caution / Blocked / Not yet reviewed). Both are on every skill's public page — see [How skills are vetted](/guides/trust-safety/how-skills-are-vetted). The install tools enforce the band for you: **Blocked never installs**, Caution/Unreviewed prompt for confirmation. Channels marked **launch wave** below are rolling out with the current launch: the commands are final, but if a marketplace or package listing isn't live yet for you, check back shortly. ## Web copy-paste Open any skill at `app.decimal.ai/skills/` — for example [`support-ticket-kit`](https://app.decimal.ai/skills/support-ticket-kit) — view the full `SKILL.md` body, and copy it into your project: ```text theme={null} .claude/skills//SKILL.md # Claude Code .agents/skills//SKILL.md # Cursor, Copilot, Cline, Warp, … ``` The **Copy SKILL.md** button on the skill page copies the body with frontmatter already stamped — `name` plus the [source stamp](#provenance-the-source-stamp) below — so just add a `description:` line (runtimes route on `name` + `description`). If you copy the raw body by hand instead, add a minimal block yourself: ```yaml theme={null} --- name: support-ticket-kit description: support ticket triage decisions per internal policy --- ``` ### Provenance: the source stamp The tooling routes (npx, the Claude Code plugin) stamp two extra frontmatter keys on every install, and when copying by hand it's worth adding them yourself: ```yaml theme={null} source: https://decimal.ai/s/@ source_sha256: ``` That's the whole scheme — where the file came from, and a fingerprint of the exact body you took. Six months from now it answers "which version is this, and have we edited it?": re-fetch the source URL, hash it, compare. No stamp, no answer. ## CLI pull (`decimalai skills pull`) The DecimalAI CLI ships with the Python package, but `skills pull` is anonymous — no API key, no signup: ```bash theme={null} pip install decimalai decimalai skills pull support-ticket-kit --out .claude/skills/ ``` Writes `//SKILL.md` with reconstructed frontmatter, plus the skill's **`eval.yaml` test suite** when the author published one — so you can re-run the with-vs-without benchmark yourself with the [open runner](/guides/skillevaluation). Other forms: ```bash theme={null} decimalai skills pull # .//SKILL.md in the current dir decimalai skills pull --stdout # print the body, pipe it anywhere decimalai skills pull --no-evals # skip eval.yaml ``` Read-only by design: no fork is created and nothing is tracked. If you later want a fork in your org (upstream-update detection, effectiveness measurement on your own traffic), that's `decimalai skills install` — the one skills command that needs an API key. ## npx (`npx decimalai add`) **Launch wave.** For JS/TS projects — or anyone who doesn't want Python — the npx installer vendors a skill with zero runtime dependencies (Node 18+): ```bash theme={null} npx decimalai add # → .claude/skills// npx decimalai add --dir .agents/skills # any base directory npx decimalai add @ # pin: exact match or the install fails npx decimalai list # what's pinned, from the lockfile ``` Beyond writing `SKILL.md` (stamped with the [source stamp](#provenance-the-source-stamp)) and any attachments, it maintains `.decimal/skills.lock.json` — a hash-pinned lockfile (`{slug: {version, sha256, files[]}}`), so skill drift shows up in review like dependency drift does. A successful install sends **one anonymous event** (`{event: "install", channel: "npx", slug, version}`) so the registry can count installs honestly — no user content, no machine identifiers, never blocks the install. Opt out with `--no-telemetry` or `DECIMALAI_NO_TELEMETRY=1`. ## Raw URLs (scripts, CI, and LLM agents) **Launch wave** — these apex URLs go live with the launch. Every published skill is fetchable as plain text — no HTML scraping, no auth: ```bash theme={null} # Raw body — text/markdown; the ETag is the sha256 of the body curl https://decimal.ai/s//SKILL.md # Version-pinned: serves only when is the current version, 404 otherwise curl https://decimal.ai/s/@/SKILL.md # Machine-readable summary — slug, version, lift summary, benchmark models, # trust/safety bands, manifest hash, raw + scorecard URLs curl https://decimal.ai/s/.json # Index over every measured, safety-clean skill — built for LLM agents curl https://decimal.ai/llms.txt ``` The ETag doubles as an integrity check: it's the same sha256 the [source stamp](#provenance-the-source-stamp) truncates, so a stamped file can be verified against the live registry in one request. Note the registry serves the **current** version only — the `@` form is a pin-check, not a version archive. ## MCP server **Launch wave.** `decimalai-mcp` gives any MCP client — Claude Code, Claude Desktop, Cursor — three read-only registry tools: `search_skills`, `get_skill` (full record: trust bands, verified lift, body), and `get_leaderboard`. No API key required: ```bash theme={null} claude mcp add decimalai -- uvx decimalai-mcp ``` Then ask your agent things like *"find me a measured skill for invoice field extraction and show its safety scan."* The MCP server searches and inspects; pair it with npx or the plugin to actually write files. ## Claude Code plugin **Launch wave.** The plugin wraps search + install + trust checks into slash commands inside Claude Code: ```text theme={null} /plugin marketplace add decimal-labs/decimalai-claude-plugins /plugin install decimalai@decimalai ``` | Command | What it does | | --------------------------- | --------------------------------------------------------------------------------------------- | | `/decimalai:search ` | Registry search; results show verified lift and safety band | | `/decimalai:install ` | Trust-gate check, then `SKILL.md` + attachments into `.claude/skills//`, source-stamped | | `/decimalai:check` | Set up the regression-check GitHub Action for your repo | ## When you *do* want the SDK Everything above is consume-only: the file lands on disk and your runtime takes it from there. The SDK adds the feedback loop — forking skills into your org, [routing them per-turn](/api-reference/skills/router), and measuring which ones actually help *your* agent on *your* traffic. When you're ready for that: [Quickstart](/quickstart) and the [registry guide](/guides/registry). ## Related * [Install a Skill in 5 Minutes](/tutorials/install-a-skill) — the tutorial version of this page: one skill, end to end * [Trust & exit](/guides/trust-and-exit) — open formats, graceful degradation, and what leaving looks like * [How skills are vetted](/guides/trust-safety/how-skills-are-vetted) — what the safety bands mean * [skillevaluation](/guides/skillevaluation) — the open spec + runner behind every verified lift number