# chainctl skills pull

URL: https://chainguard-docs-preview-git-uv-frozen-installs.chainguard.app/platform/chainctl/chainctl-docs/chainctl_skills_pull.md
Last Modified: October 15, 2026
Tags: chainctl, Reference, Product

## chainctl skills pull

Download a published skill to a local directory.

### Synopsis

Download a published skill to a local directory.

The reference accepts org/name:tag or org/name@sha256:DIGEST.
The optional directory sets the download destination. The download includes
.hardened-artifact.json, which records the skill's registry reference and digest;
packing the directory again leaves that file out.

With --verify, the fetched digest must pass the same signature check as
`chainctl skills verify` before anything is written; otherwise the command
exits nonzero and writes nothing. A skill on a registry whose signatures
chainctl cannot verify, such as a staging or development registry, fails
too, unless --allow-unverifiable-host is also given.

With -o json, a successful pull prints {"location": <absolute path>} plus,
with --verify, "verification": the result `chainctl skills verify -o json`
prints. A failed --verify prints that result on its own and exits 1.

```
chainctl skills pull <ref> [<dir>] [flags]
```

### Examples

```
  # Pull into a specific directory:
  chainctl skills pull chainguard/github/lint ./my-skills/lint

  # Pull only if Chainguard signed the skill:
  chainctl skills pull --verify chainguard/github/lint
```

### Options

```
      --allow-unverifiable-host   With --verify, accept a skill from a registry whose signatures chainctl cannot verify, such as a staging or development registry, with a warning instead of failing.
      --force                     Overwrite destination directory if it already exists.
      --verify                    Check Chainguard's signature on the fetched skill, as 'chainctl skills verify' does, before writing anything. Fails unless verified, including for a skill on a registry whose signatures chainctl cannot verify.
```

### Options inherited from parent commands

```
      --api string         The url of the Chainguard platform API. (default "https://console-api.enforce.dev")
      --audience string    The Chainguard token audience to request. (default "https://console-api.enforce.dev")
      --config string      A specific chainctl config file. Uses CHAINCTL_CONFIG environment variable if a file is not passed explicitly.
      --console string     The url of the Chainguard platform Console. (default "https://console.chainguard.dev")
      --force-color        Force color output even when stdout is not a TTY.
  -h, --help               Help for chainctl
      --issuer string      The url of the Chainguard STS endpoint. (default "https://issuer.enforce.dev")
      --log-level string   Set the log level (debug, info) (default "ERROR")
  -o, --output string      Output format. One of: [csv, env, go-template, id, json, markdown, none, table, terse, tree, wide]
  -v, --v int              Set the log verbosity level.
```

### SEE ALSO

* [chainctl skills](/platform/chainctl/chainctl-docs/chainctl_skills/)	 - Skills registry related commands.