# chainctl skills pull

URL: https://chainguard-docs-preview-git-exp-577-mcp-refuse-sse-get.chainguard.app/platform/chainctl/chainctl-docs/chainctl_skills_pull.md
Last Modified: October 8, 2026
Tags: chainctl, Reference, Product

 chainctl skills pull Download a published skill to a local directory.
Synopsis Download a published skill to a local directory.
The reference accepts org/name:tag or org/name@sha256:DIGEST. The optional directory sets the download destination. The download includes .hardened-artifact.json, which records the skill’s registry reference and digest; packing the directory again leaves that file out.
With –verify, the fetched digest must pass the same signature check as chainctl skills verify before anything is written; otherwise the command exits nonzero and writes nothing. A skill on a registry whose signatures chainctl cannot verify, such as a staging or development registry, fails too, unless –allow-unverifiable-host is also given.
With -o json, a successful pull prints {“location”: } plus, with –verify, “verification”: the result chainctl skills verify -o json prints. A failed –verify prints that result on its own and exits 1.
chainctl skills pull <ref> [<dir>] [flags] Examples # Pull into a specific directory: chainctl skills pull chainguard/github/lint ./my-skills/lint # Pull only if Chainguard signed the skill: chainctl skills pull --verify chainguard/github/lint Options --allow-unverifiable-host With --verify, accept a skill from a registry whose signatures chainctl cannot verify, such as a staging or development registry, with a warning instead of failing. --force Overwrite destination directory if it already exists. --verify Check Chainguard's signature on the fetched skill, as 'chainctl skills verify' does, before writing anything. Fails unless verified, including for a skill on a registry whose signatures chainctl cannot verify. Options inherited from parent commands --api string The url of the Chainguard platform API. (default "https://console-api.enforce.dev") --audience string The Chainguard token audience to request. (default "https://console-api.enforce.dev") --config string A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly. --console string The url of the Chainguard platform Console. (default "https://console.chainguard.dev") --force-color Force color output even when stdout is not a TTY. -h, --help Help for chainctl --issuer string The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev") --log-level string Set the log level (debug, info) (default "ERROR") -o, --output string Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide] -v, --v int Set the log verbosity level. SEE ALSO chainctl skills	- Skills registry related commands.