skills-search

An agent skill by daymade, from daymade/claude-code-skills. Tags: automation, catalog, marketplace, search, setup.

What it does

This skill should be used when users want to search, discover, install, or manage Claude Code skills from the CCPM registry. Triggers include requests like "find skills for PDF", "search for code review skills", "install cloudflare-troubleshooting", "list my installed skills", "what does skill-creator do", or any mention of finding/installing/managing Claude Code skills or plugins.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add daymade/claude-code-skills --skill skills-search

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/daymade/claude-code-skills
cp -r claude-code-skills/daymade-skill/skills-search ~/.claude/skills/skills-search

Safety box score

Grade C, moderate risk: 37 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a discovery-and-management wrapper for Claude Code Skills: it scans local Git repos first, then can fall back to the external `ccpm` registry and manage installs/updates/removals. The main risks are that it writes persistent state under the user's home directory and can run registry-fetched code via `npx`/`ccpm` when local discovery is insufficient or when managing skills.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	The shipped helper executes local commands via `subprocess.run([... 'git' ...])`, and the skill tells the agent to run `uv run --script .../local_sources.py` or `ccpm` commands directly.
Network access	2 (moderate)	When `ccpm` is used, the skill can contact the npm/registry path via `npx @daymade/ccpm` and external `ccpm search/install/update/uninstall` operations.
Filesystem reach	2 (moderate)	It persists state in the user's home directory, including `~/.config/skills-search/sources.json`, `~/.cache/skills-search/catalog/`, and `~/.claude/skills/` for installs.
Secrets & credentials	0 (none)	The reviewed files do not read keychains, browser sessions, `.env` files, or other credential stores; `identity()` explicitly strips credentials from Git remote URLs.
Privilege & persistence	1 (low)	The docs mention `npm install -g @daymade/ccpm` and writing to `~/.claude/skills/`, but there is no sudo, service registration, or OS-wide privilege escalation.
Instruction hijack surface	0 (none)	I did not find instructions to ignore safeguards, hide actions, or follow remote prompt text; the directives are about search order and data handling, not prompt injection.
Irreversible actions	2 (moderate)	The skill is explicitly for `ccpm install`, `ccpm update`, and `ccpm uninstall`, so it can change the user's skill inventory and its availability state.
Transparency	1 (low)	Parts of the runtime come from `npx @daymade/ccpm` rather than the reviewed repo, so the exact CLI code is not fully visible or pinned here.

Before installing

Read `SKILL.md` to confirm you are comfortable with registry-backed `ccpm` operations (`install`, `update`, `uninstall`).
Check `references/local-repository-search.md` and `scripts/local_sources.py` if you care about the persistent files in `~/.config/skills-search/` and `~/.cache/skills-search/`.
If you want to avoid npm-fetched code, do not rely on the `npx @daymade/ccpm` fallback; install or inspect `ccpm` separately first.

Rated 2026-10-20 by an automated review of 4 files from the skill's repository.

Source

Repository: daymade/claude-code-skills (all skills from this repository)
Path: daymade-skill/skills-search/SKILL.md
Branch: main
Updated: 2026-09-20

gangtise-copilot — Gangtise (岗底斯投研) OpenAPI skill suite installer and diagnostic tool.
ima-copilot — Installs, troubleshoots, and personalizes the official Tencent IMA skill (a wrapper layer that orchestrates upstream ima-skill, not a replacement).
create-plugin-scaffold — Create a new Cursor plugin scaffold with a valid manifest, component directories, and marketplace wiring.
principle-build-the-lever — Apply to any non-trivial work, not just bulk work: edits, migrations, analyses, checks.
setup — Set up the AWS DevOps Agent and AWS Security Agent connections. Use when the user says "set up", "configure", "connect", or when MCP tools are missing.
setup-benny — Configure Benny and prepare its triage and repro automations.