skills

The skills command installs squirrelscan capabilities into coding agents that support the Agent Skills standard.

What are agent skills?

Agent Skills are folders of instructions, scripts, and resources that coding agents can discover and use to perform tasks more accurately. Skills give agents access to procedural knowledge they can load on demand.

The Agent Skills format is an open standard supported by many coding agents including:

• Claude Code - Anthropic’s CLI coding agent
• Cursor - AI-first code editor
• VS Code - With GitHub Copilot
• Gemini CLI - Google’s coding agent
• OpenAI Codex - OpenAI’s coding agent
• Goose - Block’s open source agent
• Amp - Sourcegraph’s coding agent
• Roo Code - coding agent

For the full list of supported agents, see agentskills.io.

The squirrelscan skills

squirrelscan ships these skills from the squirrelscan/skills repository, the one source for every install path below:

Usage

squirrel skills                         # same as squirrel skills status
squirrel skills status [--json]
squirrel skills install [skill...] [--agent <name>...] [--project] [--dry-run]
squirrel skills update  [skill...] [--check] [--force] [--dry-run] [--json]
squirrel skills uninstall [skill...] [--agent <name>...] [--project]

skill... defaults to both skills (squirrelscan and audit-website).

--agent picks where the skills go, and can be repeated:

The default is both. --project uses the current repo’s .claude/skills and .agents/skills instead of the ones in your home directory. The repo is the nearest folder up from where you run it that holds a .git, or the current folder when there is none.

squirrel downloads the skills itself: no Node, no npx, no other tool. It reads the published manifest.json in squirrelscan/skills, downloads the files it needs, checks each one against its sha256, and only then writes. The skills are real copies, so this works the same on macOS, Linux and Windows. A download that fails or doesn’t match its hash writes nothing, so the previous install stays exactly as it was.

status

Show which skills are installed, where, and whether a newer version is published.

$ squirrel skills
squirrelscan skills  (github.com/squirrelscan/skills @ e23765f)

  skill           installed   latest   where
  squirrelscan    1.4.1       1.4.1    ~/.claude/skills, ~/.agents/skills
  audit-website   2.1         2.2 ↑    ~/.claude/skills, ~/.agents/skills

1 update available: run `squirrel skills update`.
Auto-update is on: skills update with the CLI.

It also lists files you have edited, skills that npx skills still manages, folders that belong to something else, and any install an update can’t write to (a link or a folder where a file should be). Offline, it shows what is installed and says the latest version is unknown. --json gives the same as JSON.

install

$ squirrel skills install
✓ squirrelscan 1.4.1   → ~/.claude/skills, ~/.agents/skills
✓ audit-website 2.2    → ~/.claude/skills, ~/.agents/skills
Adopted 2 skills installed by `npx skills` (removed them from its lock file, backup at ~/.agents/.skill-lock.json.bak).
Restart your agent to load them.

Skills you installed earlier with npx skills add are taken over: squirrel updates them in place, replaces the symlinks npx skills made with copies, and removes them from its lock file (after copying the lock to .skill-lock.json.bak), so the two tools stop updating the same folders. A file that differs from the published version with no record of who wrote it is backed up first.

squirrel leaves alone a skill folder that links somewhere else (such as your own checkout) and a folder holding another author’s skill of the same name.

--dry-run shows what would change without writing anything. squirrel setup runs the same install as part of the first run.

Once installed, invoke them in your coding agent:

/audit-website

/squirrelscan

update

$ squirrel skills update
✓ audit-website 2.1 → 2.2  (~/.claude/skills, ~/.agents/skills)
! audit-website/SKILL.md in ~/.claude/skills was edited locally, kept it.
  Use --force to replace it (your copy is backed up first).
✓ squirrelscan 1.4.1 is current

update changes only what is already installed, and downloads only the files that changed. It never installs a skill or a location you don’t have. It updates the skills in your home directory and, run inside a repo, that repo’s --project copies; other repos’ copies are updated from inside those repos.

squirrel records the hash of every file it writes (in ~/.squirrel/skills.json; ~/.squirrel is %LOCALAPPDATA%\squirrel on Windows), so it knows when you have edited one, and it never overwrites an edit silently. An edited file is kept and reported; --force replaces it too, after backing your copy up to ~/.squirrel/skills/backups/<timestamp>/, one folder per location (global-claude, project-agents and so on). Files of your own in a skill folder always stay.

Automatic updates

You rarely need to run it. From v0.0.99, when squirrel auto-updates itself, the first run on the new version updates the installed skills in the background: no prompts, a 60 second limit, once per new version, edits kept, and no network at all when no skills are installed. It leaves project installs (--project) to you. It follows auto_update; turn off just the skills with:

squirrel self settings set skills_auto_update false

It never holds up the command you ran, and is off in CI and with SQUIRREL_NO_UPDATE set.

uninstall

squirrel skills uninstall
squirrel skills uninstall audit-website --agent claude

Removes only the files squirrel wrote and you haven’t changed. Files you edited, and files of your own, stay where they are, and the command lists what it kept. A folder left behind that way is yours: updates leave it alone, and squirrel skills install takes it back.

Claude Code plugin

Claude Code users can install everything (all skills plus the hosted MCP server) as a plugin instead:

/plugin marketplace add squirrelscan/skills
/plugin install squirrelscan@squirrelscan

Every commit to the skills repository is a new plugin version. Claude Code doesn’t auto-update third-party marketplaces unless you turn it on in /plugin, so pick up new versions with /plugin marketplace update squirrelscan and /plugin update squirrelscan@squirrelscan.

Added the older squirrelscan/squirrelscan marketplace before? It now points the plugin at squirrelscan/skills, so it keeps working: run those same two update commands to move over. To switch marketplaces instead, remove the old one first. Claude Code won’t add a second marketplace named squirrelscan, and removing it uninstalls the plugin, so reinstall:

/plugin marketplace remove squirrelscan
/plugin marketplace add squirrelscan/skills
/plugin install squirrelscan@squirrelscan

The audit-website skill

The audit-website skill gives your coding agent the ability to run comprehensive website audits using squirrelscan and drive the findings to fixed code. When invoked, the agent will:

1. Run squirrel audit on the target URL
2. Analyze the results and map issues to your code
3. Propose and apply fixes, then re-audit

Invoking the skill

In Claude Code or other compatible agents:

/audit-website https://example.com

The agent will handle running the audit and interpreting results for you.

The squirrelscan skill

The squirrelscan skill teaches your agent the CLI itself: installation, authentication, publishing reports, cloud credits, API keys, MCP setup, and configuration. Agents load it whenever a task touches squirrelscan beyond a basic audit, for example “publish this report” or “connect squirrelscan over MCP”.

Related

• Agent Skills Standard - Learn more about Agent Skills
• squirrelscan/skills - The skills source; open skill issues and pull requests there
• Using with Agents - Full guide to using squirrelscan with coding agents