INSTALLATION

Install and manage packages with HowAI CLI

Use the current CLI commands, choose the target directory, authorize restricted downloads and understand daily account limits.

Check the runtime and command

Runtime
node --version
npx --version

Use Node.js 22 or newer on macOS, Windows or Linux. The package you install can have additional requirements; the CLI runtime is not a promise that every rendering or export tool is available.

Install a public package
npx --yes https://howai.build/cli/howai-cli-0.1.5.tgz install cobalt-system-deck --api https://howai.build

The .tgz URL contains the current CLI version. Copy commands from HowAI when setting up a new environment. The site-hosted package avoids relying on an unpublished npm name.

Commands

CommandPurpose
install <slug>Install the available package; --version selects a specific accessible release.
listShow managed installations in the chosen directory.
update [slug]Update one package, or managed packages in that target.
uninstall <slug>Remove a managed installation.
login / status / logoutAuthorize, inspect the session or revoke the local origin's credential.
Examples
npx --yes https://howai.build/cli/howai-cli-0.1.5.tgz list --api https://howai.build

npx --yes https://howai.build/cli/howai-cli-0.1.5.tgz update cobalt-system-deck --api https://howai.build

npx --yes https://howai.build/cli/howai-cli-0.1.5.tgz uninstall cobalt-system-deck --api https://howai.build

Agent and directory options

OptionBehavior
Default / --agent codex / --agent cursorUse ~/.agents/skills.
--agent claude-codeUse ~/.claude/skills.
--agent antigravityUse ~/.gemini/config/skills.
--target <absolute-path>Use that Skills parent directory; do not append the slug yourself.
--api https://howai.buildSelect the origin; credentials and managed installations are bound to it.
--no-browserPrint the authorization address instead of opening it automatically.

Other supported shared-directory agent options include gemini-cli, opencode, kilo-code, openclaw and hermes. Use a documented absolute target for another setup. Relative paths, symbolic-link paths and combining --agent with --target are rejected.

Account authorization

When a restricted manifest requires sign-in, the CLI starts a browser device-code flow. Check the code against your terminal, sign into HowAI and approve the matching request. If it expires, start a new login instead of reusing an old code.

Manage authorization
npx --yes https://howai.build/cli/howai-cli-0.1.5.tgz login --api https://howai.build

npx --yes https://howai.build/cli/howai-cli-0.1.5.tgz status --api https://howai.build

npx --yes https://howai.build/cli/howai-cli-0.1.5.tgz logout --api https://howai.build

CLI tokens expire after 30 days. They are stored in a local, origin-specific configuration and are not a payment authorization. Logout revokes the token and removes the local credential. Do not share the config file or tokens.

Daily download allowance

A signed-in account can download 50 distinct Skills each day. The website, CLI tokens, devices and versions share the same allowance. It resets at 00:00 UTC. Downloading the same Skill again that day is allowed, including when the allowance is full.

Manifest reads do not consume quota; issuing an authorized download link does. An HTTP 429 response includes a reset time, which the CLI displays before stopping. Changing devices or logging in again does not increase the limit. Anonymous access to public packages remains available.

File integrity and local modifications

The CLI verifies the archive and each extracted file, stages the package and installs it into the selected directory. It does not run scripts from the package. Unmanaged directories are not overwritten; changed managed files block replacement or removal.

FAQ

Reviewed October 18, 2026 · HowAI editorial

Found something unclear? Send feedback