Documentation

macOS / Linux — Homebrew

# Ajouter le tap STH (une seule fois)
brew tap skills-transfer-hub/sth

# Approuver le tap — requis pour un tap tiers depuis Homebrew 6.0 (une seule fois)
brew trust skills-transfer-hub/sth

# Installer
brew install skills-transfer-hub/sth/sth

# Vérifier
sth version

The tap and trust steps are one-time only — trust is Homebrew 6.0's security gate for third-party taps. After that, update STH with brew upgrade sth, not sth update self.

Windows — winget or Chocolatey

# winget
winget install STH.STH

# Scoop
scoop bucket add sth https://github.com/Skills-transfer-hub/scoop-sth
scoop install sth

# Chocolatey
choco install sth

Binary from GitHub Releases

If you prefer manual installation or run an unsupported platform, download the matching archive from the Releases page (each archive ships with a SHA256SUMS file to verify integrity), then place the binary into your PATH.

# macOS / Linux
tar -xzf sth-darwin-arm64.tar.gz   # ou linux-amd64, darwin-amd64
chmod +x sth
sudo mv sth /usr/local/bin/

# Windows : extraire sth-windows-amd64.zip et déplacer sth.exe dans un dossier de %PATH%

Verify the installation

sth version

From your project root (typically a folder that already contains .claude/):

sth init
? Fournisseur          › github | gitlab | azure-devops | bitbucket
? Dépôt / org-projet   › acme-corp/skills
? Branche / ref        › main
? Catalogue            › SKILLS.md
? Dossier cible        › .claude/skills

The configuration is written to .sth/project.json (schema v2). No secrets are stored there — STH reads Git tokens from your environment.

Running sth with no arguments in an interactive terminal opens the guided menu and suggests the next useful action (init, list, install, update, buddy…).

Running sth with no arguments in an interactive terminal plays a short wake-up animation — 💤 then 👀 — then freezes Buddy on the project's actual state (up-to-date, update available, no config, etc.). All in a 78-char-wide frame, perfect for modern terminals.

╭────────────────────────────────────────────────────────────────────────────╮
│                                                                            │
│      💧                                                                    │
│    ╭─────╮   STH dev                                                       │
│    │ >/< │   Skills Transfer Hub.                                          │
│    ╰─────╯                                                                 │
│                                                                            │
│  Astuce : tapez `sth help` pour voir la liste des commandes.               │
│  STH gère .claude/skills depuis un dépôt distant.                          │
│                                                                            │
╰────────────────────────────────────────────────────────────────────────────╯

Off-TTY (redirected output, CI run), only the final frame is printed — no animation, no buffer rewrite.

STH relies on your shell environment variables for Git providers. The generic STH_TOKEN is tried first, followed by the provider-specific variable. No secret is persisted to .sth/.

For CI, export the appropriate PAT in the pipeline context. Self-hosted installs (GitHub Enterprise, self-managed GitLab) are not yet supported — open an issue if the need is critical.

STH can discover your skills three ways — pick the one that fits your repository.

1. SKILLS.md (explicit manifest)

| Type  | Name           | Folder | Source                    | Description           |
| ----- | -------------- | ------ | ------------------------- | --------------------- |
| skill | analyse-risque | skills | skills/analyse-risque.md  | Check-list QSE        |
| agent | reviewer       | agents | agents/reviewer.md        | Revue de PR auto      |

2. Auto-detection (bundles)

If your repository follows the category/folder/SKILL.md convention, STH auto-detects bundles:

react/form-wizard/SKILL.md         → bundle "react/form-wizard"
react/form-wizard/templates/...    → tous les fichiers synchronisés
commands/release-helper/SKILL.md   → bundle "commands/release-helper"

3. Enterprise / multi-stack layouts

For larger repositories that bundle several artifact kinds (skills, agents, commands, language-scoped instructions) in a single source of truth, STH ships a dedicated multi-stack scanner. A typical layout:

acme-skills/
├── manifest.json                       ← marqueur multi-stack
├── skills/
│   └── form-wizard/SKILL.md
├── agents/
│   └── reviewer.md                     ← frontmatter
├── commands/
│   ├── release-helper.md               ← fichier unique
│   └── fix-pr/SKILL.md                 ← variante skill-style
└── go/
    └── instructions/
        └── error-handling.instructions.md

• skills/[name]/SKILL.md — full skills with their own folder (templates, assets, etc.).
• agents/[name].md — single-file agents declared with frontmatter.
• commands/[name].md or commands/[name]/SKILL.md — single-file or skill-style commands.
• [lang]/instructions/[name].instructions.md — language-scoped instructions (Copilot-style).

STH switches to the multi-stack scanner when a manifest.json sits at the repo root, or when at least two of the four conventional containers above are present.

STH can write installed resources to one or more AI tooling targets. Auto-detection looks for the conventional marker file of each tool — never an ambiguous parent directory — so STH only proposes a target when it has solid evidence. The wizard surfaces detected targets and lets you confirm.

You can install resources to multiple targets in the same project — STH writes each file under the matching root. If no target is auto-detected, STH falls back to a Claude-only default.

Buddy gives you the project's state at a glance. With --watch, it reacts live to file changes.

• 💧  >/< — Everything is up to date
• ⚠️  o.O — Update available
• 😶  ._. — No configuration
• ❌  x x — Error
• ⏳  >_< — In progress
• ✅  ^.^ — Done

The configuration lives at the root of your project, in .sth/project.json. You can commit it safely — it never contains secrets. Schema v2 supports multiple providers declared in the providers array, with one target_dir per provider.

{
  "schema_version": 2,
  "providers": [
    {
      "id": "team-skills",
      "provider": "github",
      "repository_id": "acme-corp/skills",
      "catalog_ref": "main",
      "catalog_path": "SKILLS.md",
      "target_dir": ".claude/skills"
    },
    {
      "id": "shared-prompts",
      "provider": "gitlab",
      "repository_id": "acme/shared-prompts",
      "catalog_ref": "main",
      "catalog_path": "manifest.json",
      "target_dir": ".github/instructions"
    }
  ],
  "resources": [
    {
      "catalog_id": "skill::react::form-wizard",
      "provider_id": "team-skills",
      "pinned_ref": "v1.4.0"
    },
    {
      "catalog_id": "command::release-helper",
      "provider_id": "shared-prompts"
    }
  ]
}

Schema v2 supports multiple providers and multiple target directories in the same project. Each resource references its source provider via provider_id, and each provider declares its own target_dir — so you can pull React skills from a private GitHub repo into .claude/skills while pulling shared prompts from a GitLab project into .github/instructions.

The install state is stored in <target_dir>/sth-state.json (e.g. .claude/skills/sth-state.json). For each installed resource it lists the source provider, managed files, their SHA-256 hashes and the status. sth status compares disk against this manifest to detect local modifications.

STH is in public Alpha. The product boundary is intentionally explicit:

• Direct public or private Git, local packs, multi-target installs and offline mode are not subscription-gated.
• Cloud access decisions are enforced by STH Cloud. No environment-variable bypass is needed for local work, which continues when signed out or offline.
• Want to try the paid options during the Alpha? Run sth alpha request (an account is required — sth login). The STH team reviews each request and approves or declines it.
• Telemetry is an explicit user choice set at sth init with three modes — off, anonymous, connected. See the telemetry policy for what is sent in each mode and how to change your mind later via sth telemetry.

When an Alpha grant expires, local resources are preserved and existing Cloud data remains readable; only new operations requiring Pro or Team are blocked.