The install is very opaque. It's not clear where these skills are installed, how to upgrade them or remove them.

Here's the `skills` package on NPM: https://www.npmjs.com/package/skills - it's MIT licensed but I can't find it on Github.

`skills` looks to be a wrapper around `add-skill`: https://github.com/vercel-labs/add-skill

From the docs, `add-skill` auto detects from 16 different potential paths to copy skills to in a repository (.claude/, .codex/, .Gemini/, etc).

`add-skill` also let's you install skills globally (~/). From the code, `skills` looks like it doesn't support global installs but under the hood it passes all args to add-skill, so you should be able to install skills globally or install multiple skills (even if the wrapper doesn't expect it).

Aside: although lots of agents have adopted SKILLS.md conventions, they're currently all using their own paths. There doesn't seem to be a consensus yet, like there is with AGENTS.md. There are even 3 generic paths: .agent/skills/, .agents/skills/ and just skills/

Skills certainly got a wildwest pre VCS copy-paste feeling going on.