CLI reference (@amitte-ai/cli)

Install with npm install -g @amitte-ai/cli (or run any command via npx @amitte-ai/cli ...). The binary is named skills.

init / login / publish

Command	Purpose
skills init <id>	Scaffold a new entity.
skills login	GitHub device-flow auth.
skills eval	Run local prompt-injection + content-quality checks.
skills publish	Sign with Sigstore + submit.
skills status <submission-id>	Poll a submission.

install / pull (consumer side)

# Skill (markdown playbook)
skills install <publisher>/<name>
# → ./skills/<publisher>/<name>/{skill.md, manifest.json}

# Agent or MCP server (manifest + body + schemas)
skills pull <publisher>/<name>
# → ./bundle/<publisher>/<name>/{manifest.json, agent.md, input.schema.json, …}

connect (MCP servers)

skills connect <publisher>/<name> --client claude-desktop
# → prints the JSON snippet to stdout

skills connect <publisher>/<name> --client cursor --out ~/.cursor/mcp.json
# → writes the snippet to a file

Supported clients: claude-desktop, cursor, vscode.

byo (BYOK intent compose)

echo "$ANTHROPIC_API_KEY" > ~/.amitte-anthropic.key
chmod 600 ~/.amitte-anthropic.key
skills byo \
  --provider anthropic \
  --key-file ~/.amitte-anthropic.key \
  --goal "ship an iOS app to TestFlight"

We require --key-file rather than --key <value> because keys passed inline land in shell history, ps output, and can leak through CI logs.

The synchronous BYOK request hits /v1/intent/byo — the key is forwarded exactly once and never persisted. Pino redact paths cover *.api_key and *.byo_credentials so a request log can't leak the key either.