TODOS

TODOS

Strategic roadmap for **agent-skill-manager** — the npm for AI skills.

Mode: SCOPE EXPANSION (CEO Review, 2026-03-19). North star: become the package manager standard that every skill README links to.

---

Phase 1 — Universal Compatibility (v1.11)

Goal: asm works with every major AI agent. Users can install, track, and update skills.

1. Expand default providers to 15+ [S] — P1

Add Cursor, Windsurf, Cline, Roo Code, Continue, GitHub Copilot, Aider, OpenCode, Zed, and others to the default config in `src/config.ts`. Reference skillshare's `targets.yaml` for correct directory paths. Config-only change.

• Why: 4 agents vs. competitors' 55 is our biggest gap. Universal compatibility is table stakes.
• Effort: CC: ~1 hour / human: ~2 hours

2. `asm outdated` — detect stale skills [M] — P1

Store install commit hash and source URL in `.skill-lock.json` next to each installed SKILL.md. `asm outdated` runs `git ls-remote` (parallel, concurrency limit 5) against each source to compare hashes. Report: skill name, installed hash, latest hash, age.

• Where: New src/updater.ts + src/utils/lock.ts + cli.ts integration
• Why: npm has npm outdated. This is the equivalent. Users need to know when skills are stale.
• Effort: CC: ~2 hours / human: ~1 day

3. `asm update [name]` — pull latest version [M] — P1

Update one or all skills from their source repos. Re-clone, validate, replace. Preserve `.skill-lock.json`. Respect `--yes` for batch mode. Handle deleted source repos gracefully ("source unavailable").

• Where: src/updater.ts + cli.ts
• Why: npm update is the companion to npm outdated. Install without update is incomplete.
• Effort: CC: ~2 hours / human: ~1.5 days

4. `.skill-lock.json` format [S] — P1

Define the lock file schema: `{ version: 1, skills: { [name]: { source, commitHash, installedAt, provider } } }`. Write parser with validation in `src/utils/lock.ts`. Tests for schema, corruption, migration.

• Why: Version pinning is how package managers ensure reproducibility. This is the package-lock.json equivalent.
• Effort: CC: ~1 hour / human: ~0.5 day

---

Phase 2 — The Registry (v2.0)

Goal: a searchable skill directory that makes `asm` the discovery tool for AI skills.

5. Static registry website on GitHub Pages [L] — P1

Auto-generate a searchable static site from `asm index` data. Stack: Bun to generate HTML + JS, GitHub Actions to rebuild on push. Each skill gets a page with: name, description, install command, security score, provider compatibility. Search by keyword. URL structure: `asm.dev/skills/owner/skill-name` (future-proof for hosted migration).

• Where: New site/ directory, GitHub Actions workflow
• Why: npm without npmjs.com is just a local tool. The registry is the moat. Static = zero cost, zero ops.
• Effort: CC: ~4 hours / human: ~1 week

6. `asm publish` — push skill to registry [M] — P2

Submit a skill to the registry i