{
  "markdown": "# llm-wiki skill\n\nLets an AI agent (Claude Code, Codex, etc.) query the user's locally-running **LLM Wiki** desktop app over its built-in HTTP API.\n\nThis skill is **documentation only**. The API is a standard HTTP+JSON contract — call it with `curl`, `fetch`, `requests`, or whatever HTTP tool your environment already has. There is no client library, no SDK, no compile step.\n\n## Installation\n\n### Recommended — one-liner via `skills` CLI\n\n```bash\nnpx skills add https://github.com/nashsu/llm_wiki_skill.git --skill llm-wiki\n```\n\nThis fetches the latest version of the skill from GitHub and registers it with your agent runtime. Re-run the same command to update to a newer revision later.\n\n### Alternative — clone + symlink (Claude Code)\n\nIf you prefer to manage the source locally and link it into Claude Code (skills live at `~/.claude/skills/`):\n\n```bash\ngit clone https://github.com/nashsu/llm_wiki_skill.git\nln -s \"$(pwd)/llm_wiki_skill\" ~/.claude/skills/llm-wiki\n```\n\n### Alternative — manual drop-in\n\nThe skill is three markdown files and nothing else. Drop the folder anywhere your agent runtime discovers skills (e.g. Codex `agents/`, custom MCP server skill dir). No dependencies, no build step.\n\n## What this skill enables\n\n- \"What does my wiki say about X?\" → hybrid search (keyword + vector) + read\n- \"Show me the neighborhood of node Y in my graph\" → wikilinks traversal\n- \"Read me the page about Z\" → file content fetch\n- \"I just added new docs, re-index\" → backend rescan\n- \"Give me a structural overview of my wiki\" → file tree + index.md\n\nAll read-only except `sources/rescan` (triggers an internal queue diff).\n\n## Files\n\n| File | Purpose |\n|---|---|\n| `SKILL.md` | Agent-facing instructions. Loaded automatically by the AI runtime. |\n| `api-reference.md` | Full endpoint contract (status codes, params, response shapes). |\n| `examples.md` | Conversation → API recipe patterns. |\n| `README.md` | This file — human setup / install / troubleshooting. |\n\nNo scripts, no wrappers. If you find yourself wanting one, just `curl`.\n\n## Prerequisites\n\n1. **LLM Wiki desktop app installed and running.** The API binds to `127.0.0.1:19828` only while the app is open. If the app isn't running, the agent will see `connection refused` and tell you.\n\n2. **API server enabled.** Default: on. Verify in `Settings → API Server → \"Enable local HTTP API\"` is checked.\n\n3. **Token configured.** Default: off (token field empty → every endpoint returns 401). Either:\n   - In the app: `Settings → API Server → Generate new token`. Copy and stash it.\n   - Via env: `export LLM_WIKI_API_TOKEN=...` (overrides UI; persists for the agent process).\n\n   You can also flip `Settings → API Server → \"Allow access without a token\"`, which removes auth entirely. **Local-only — but any process on this machine can then read your wiki.** Use only with trusted setups.\n\n## Quick smoke test\n\n> **Windows users**: replace `export LLM_WIKI_API_TOKEN=...` with `$env:LLM_WIKI_API_TOKEN = \"...\"` (PowerShell) or `set LLM_WIKI_API_TOKEN=...` (cmd.exe). Use `curl.exe` instead of `curl` in PowerShell to bypass the `Invoke-WebRequest` alias. Backslash line-continuations (`\\`) become backticks (`` ` ``) in PowerShell and `^` in cmd.\n\n```bash\nexport LLM_WIKI_API_TOKEN=...\n\n# 1. Probe — no auth needed\ncurl -s http://127.0.0.1:19828/api/v1/health\n\n# Expected:\n# {\n#   \"ok\": true,\n#   \"status\": \"running\",\n#   \"enabled\": true,\n#   \"authConfigured\": true,\n#   \"tokenSource\": \"env\",\n#   \"allowUnauthenticated\": false,\n#   ...\n# }\n\n# 2. List projects\ncurl -s -H \"Authorization: Bearer $LLM_WIKI_API_TOKEN\" \\\n  http://127.0.0.1:19828/api/v1/projects\n\n# 3. Search the active project\ncurl -s -H \"Authorization: Bearer $LLM_WIKI_API_TOKEN\" \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"query\":\"rope\",\"topK\":3}' \\\n  http://127.0.0.1:19828/api/v1/projects/current/search\n\n# 4. Read a page\ncurl -s -H \"Authorization: Bearer $LLM_WIKI_API_TOKEN\" \\\n  \"http://127.0.0.1:19828/api/v1/projects/current/files/content?path=wiki/concepts/rope.md\"\n```\n\nAdd `| jq` at the end of any of these if you have `jq` installed and want pretty output. Not required.\n\n## Troubleshooting\n\n| Symptom | Cause | Fix |\n|---|---|---|\n| `curl: (7) Failed to connect to 127.0.0.1 port 19828` | App not running | Launch LLM Wiki desktop, wait ~2s for the API server to bind. |\n| `Status: port_conflict` in `/health` | Another process on 19828 | `lsof -i :19828` to find the squatter; quit and restart the app. |\n| Every endpoint returns 401 | No token configured | Settings → API Server → Generate; OR `export LLM_WIKI_API_TOKEN=...` |\n| Every endpoint returns 503 with \"disabled\" | Kill switch is on | Settings → API Server → check \"Enable local HTTP API\". |\n| Every endpoint returns 503 with \"busy\" | In-flight cap reached (64 concurrent) | Back off, send fewer parallel requests. |\n| 429 on rapid requests | Rate limit: 120 req/sec global | Back off ≥1s. |\n| `files/content` returns 415 on `.pdf` | API is text-only | Read source PDFs via the desktop UI; only text-ish extensions are exposed. |\n| `tokenSource: \"env\"` even though I cleared it from UI | `LLM_WIKI_API_TOKEN` env var is set somewhere | `unset LLM_WIKI_API_TOKEN`; or set its value to match what's in your UI. |\n\n## Security model\n\n- The API listens on `127.0.0.1` only. It is **not reachable from other hosts** on your network.\n- Token-based auth is constant-time compared (no timing leak in the auth check).\n- Path traversal blocked at the route handler (`safe_join` with canonical-path prefix check).\n- File reads restricted to a whitelist (`purpose.md`, `schema.md`, `wiki/**`, `raw/sources/**`); text extensions only; 2 MB cap.\n- Body limit 1 MB; in-flight cap 64; rate limit 120/sec.\n- No write endpoints in v1. `/sources/rescan` is the only mutation, and it only reads disk + queues internal work.\n\nWhat's **not** in the threat model:\n\n- A malicious **local** process with the token can read everything in your active project's wiki + sources. Treat the token as a local secret.\n- A malicious local process can probe `/health` (no auth) to discover the API exists. Information disclosure, no content leak.\n- Cross-origin browser pages can hit the API only if they have the token. Default CORS is `*` — relies on token secrecy. Don't paste your token into untrusted web tools.\n\n## Version\n\nThis skill matches **LLM Wiki API v1** as shipped in app version `0.4.10+`. Hybrid retrieval (keyword + vector) is live; the response carries `mode: \"keyword\" | \"vector\" | \"hybrid\"`, `tokenHits`, `vectorHits`, and per-result `vectorScore`. If the desktop app's `/health` reports a major version bump, check `api-reference.md` for drift before relying on the contract verbatim.\n\n## Updating\n\nIf you installed via `npx skills add`, re-run the same command to pull the latest revision:\n\n```bash\nnpx skills add https://github.com/nashsu/llm_wiki_skill.git --skill llm_wiki_skill\n```\n\nIf you cloned the repo, `git pull` inside the cloned folder is enough — the symlink picks up changes automatically.\n\n## Contributing\n\nSource repo: <https://github.com/nashsu/llm_wiki_skill>\n\nIssues and PRs welcome. The skill should stay **client-less** — no scripts, no SDK shim, no wrapper binaries. The whole point of the underlying API is that any HTTP tool can call it; this skill is the contract documentation, not a runtime.\n\n## License\n\nSee the repository for license details.\n",
  "bytes": 7372,
  "sha": "01732c306e067a00af67098ff8ce60c524c23ed06802a080d34df32c39dd38cc",
  "repo_slug": "nashsu/llm_wiki_skill",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/skl_nashsu_llm_wiki_skill_llm_wiki_4de71f7c/readme"
}