apm vs skillkit
Microsoft's dependency manager for agent context — declare skills, prompts, plugins and MCP servers in apm.yml; one install reproduces the setup across 8 clients with lockfile pinning and org policy. — versus — Package manager for AI agent skills — install from 400K+ skills across 31 sources, auto-translate between 46 agents' incompatible formats, security-scan on install, sync to every agent at once.
Overlapping job, different model: skillkit is an imperative installer + format translator chasing breadth (46 agents, 400K skills); apm is declarative — manifest, lockfile, transitive deps, org policy — chasing reproducibility. apm's README even ships a 'coming from npx skills add' migration.
| apm | skillkit | |
|---|---|---|
| Stars | 3.3k | 1.4k |
| Forks | 290 | 127 |
| Language | Python | TypeScript |
| License | MIT | Apache-2.0 |
| Last activity | today | 1 months ago |
| Topics | coding, skills | coding, skills |
| Curated connections | 3 | 11 |
apm — the curator's take
The team/enterprise answer: apm.yml ships with the repo, so `git clone && apm install` gives every developer identical agent context — lockfile, transitive dependencies, drift detection, and an apm-policy.yml a security team can enforce with tighten-only inheritance. It's the only skill manager with a real governance story (SBOM export, MCP trust gates). NOT for quick personal use — manifest ceremony is overkill for 'just install this skill', where skillkit or asm is faster — and it targets 8 major clients, not the 40+ long tail. Young project; treat the roadmap as direction, not promise.
skillkit — the curator's take
Use it the moment skills must live on more than one agent — you write Claude SKILL.md, a teammate runs Cursor: author once, `skillkit sync` translates and deploys everywhere; the install-time security scan is a real feature now that skill marketplaces are a prompt-injection vector. NOT needed if you're all-in on a single agent — Claude Code's first-party plugin/marketplace flow is simpler and better supported. Format translation is lossy at the edges (agent-specific frontmatter, hooks, tool references), so verify ported skills actually trigger; and treat the optional mesh/messaging/REST extras as experiments, not infrastructure.