Get started · 5 minutes

Run one skill across two agents.

By the end of this page you'll have a local vault, bundled skills, a validated install path, and the same skill available from Claude Code and Codex with zero forks.

Time

5 min

Disk

12 MB

Required

node ≥ 20

~ — autovault — bash

Step 1 — Install the local vault

The installer builds the Node app under ~/.autovault/app, drops the shim at ~/.autovault/bin/autovault, preserves ~/.autovault as storage, and bootstraps bundled skills unless AUTOVAULT_NO_BOOTSTRAP=1 is set. Nothing runs as a daemon; local MCP hosts spawn stdio on demand.

bash

$ curl -fsSL autovault.sh | sh
# macOS: also available via brew
$ brew install autoworks-ai/tap/autovault
$ autovault skill list

Bundled skills. The installer seeds every bundled skill (skills/*/SKILL.md) through the same validation path used by remote installs and proposals, then refreshes discovered host profiles.

Step 2 — Add your first skill

Skills enter the vault through a source adapter. Each adapter knows how to fetch from one origin (GitHub repo, agentskills slug, HTTPS bundle, or local directory) and hand the raw skill to the validation gate. Whatever the source, the gate runs the same checks before admission.

bash

$ autovault add github:autoworks-ai/skills/extract-pdf

You'll see the gate run live in your terminal — yaml-repair, denylist, capability/behavior, dedup, sign. If any step fails, the skill is rejected and never touches your vault.

Local bundles. Third-party installers should use autovault add-local ./skill-dir --source vendor/name --sync-profiles instead of copying the same SKILL.md into every native host directory. AUTOVAULT_SKILL_INSTALL controls AutoVault-first, native-first, both, native-only, and off modes.

Step 3 — Scope it to your context

By default a freshly-added skill is unscoped: admitted to the vault, but not visible to any caller. Scope it explicitly to the agents and projects that should see it. The four-axis permission system means dev-machine skills don't leak into prod, and client work doesn't bleed across project boundaries.

bash

$ autovault scope extract-pdf \
--agent claude-code,codex \
--project autovault-website \
--device $(hostname)

Each scope rule is additive. A caller sees a skill only if it matches at least one rule on every axis it requests. Unspecified axes default to "any."

bash

$ autovault sync-profiles --discover

Profile discovery checks native roots such as ~/.claude/skills, ~/.codex/skills, and ~/.cursor/skills. Set AUTOVAULT_PROFILE_LINKS when you want installs, proposals, updates, deletes, or transform changes to refresh managed links automatically.

Step 4 — Run it from your agent

The skill is now installed, validated, scoped, and rendered for each target agent. Open whichever agent you use most — the same skill name works in all of them, but the underlying tool calls have been transformed to match each agent's vocabulary.

claude code# in Claude Code

> use extract-pdf to summarize report.pdf
✓ tool resolved: chrome-devtools, read
# extracting...
 "This 24-page report covers Q1 platform metrics, with three..."

Where to next

You've completed the install + add + scope + run loop. From here, most people branch into one of three places:

→ Author your own

Write a SKILL.md, attach a transformation manifest, propose it through the gate.

→ Browse skills

First-party and community skills, all signed and gated.

→ Security model

Provenance chain, denylist sources, remote OAuth, what we sign and why.

→ Concepts

The five-step gate, four-axis scoping, transformation manifest in depth.