Install policy

Org owners can set an install policy that the CLI evaluates on skillist install and skillist update when SKILLIST_API_KEY is present.

Rules

Warn / block severity — mapped from registry security status (pass → low, advisory → medium, fail → high) and issue severities.
Allowed sources — registry_org_only, registry_any, or registry_plus_git with an optional git host allowlist.
Minimum release age — reject installs of releases younger than N days.

CLI

# Enforce against your org policy (requires API key)
export SKILLIST_API_KEY=sk_...
skillist install other/skill --org my-org

# Skip warn prompts in CI (blocks still fail)
skillist install other/skill --org my-org --accept-warnings

Configure the policy in the app under Governance → Install policies, or via:

PATCH /v1/orgs/{orgId}/install-policy
POST  /v1/orgs/{orgId}/install-check

CI review gate

skillist review ./my-skill --threshold 80 --fail-on high --json

Or use the composite action at .github/actions/skillist-review:

name: Skill review
on:
  pull_request:
    paths: ["skills/**"]
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm install -g @skillist/cli
      - run: skillist review skills/my-skill --threshold 80 --fail-on high
        env:
          # Optional: loads your org's review rubric instead of the defaults.
          SKILLIST_API_KEY: ${{ secrets.SKILLIST_API_KEY }}

Pass --org <slug> to load the org review rubric from the API rather than using the built-in defaults.