Dependency scanning¶

skilly scan discovers skills shipped by your project's dependencies across three ecosystems.

Usage¶

skilly scan [OPTIONS]

All three ecosystems are scanned by default when the corresponding manifest and package directories exist. Results show source (e.g. python:project, node:dependencies) and status (installable, installed, updatable).

Options¶

Option	Description
`--no-project-dependencies`	Ignore `[project].dependencies` while scanning.
`--group <NAME>`	Include only the named `[dependency-groups]` entry (repeatable).
`--exclude-group <NAME>`	Exclude the named `[dependency-groups]` entry.
`--extra <NAME>`	Include only the named `[project.optional-dependencies]` extra.
`--exclude-extra <NAME>`	Exclude the named `[project.optional-dependencies]` extra.
(destination flags)	See destinations reference.

Python¶

Reads pyproject.toml and scans the project's .venv for packages that bundle skills in a skills/ directory. Supports multiple dependency groups and optional dependency extras.

# Scan all Python dependencies (default)
skilly scan

# Include specific groups and extras
skilly scan --group dev --group test --exclude-extra docs

# Skip project-level dependencies
skilly scan --no-project-dependencies

Node¶

Reads package.json (dependencies, devDependencies, optionalDependencies) and scans node_modules/ for packages that bundle skills in a skills/ directory.

skilly scan

Node scanning is automatic when package.json and node_modules/ exist.

Maven¶

Reads direct <dependencies> from pom.xml and scans JAR artifacts in the local Maven repository (~/.m2/repository by default) for bundled skills.

How it works¶

Reads only direct dependencies — profiles, plugins, and <dependencyManagement> are ignored.
Resolves ${property} references defined in the same file's <properties> block.
Loads skills from recognized archive layouts: .agents/skills/<name>/SKILL.md and skills/<name>/SKILL.md.
Preserves binary resources inside JARs.
Rejects coordinates with path traversal components.

Scopes¶

Maven scanning includes compile, runtime, and test scopes by default. Provided and system scopes are excluded. The Python MavenSource options configure these choices programmatically.

Limitations¶

Only the local Maven repository is used; no remote artifact resolution.
No POM inheritance or effective-model merging.
No Gradle build file support.
Build execution and dependency graph traversal are not performed.

Output¶

Each discovered skill shows:

Source — e.g. python:dev, node:dependencies, maven:compile.
Status — installable, installed, or updatable.
Name and description — from the skill's SKILL.md.