addyosmani/agent-skills
Production-grade engineering skills for AI coding agents.
How agent-skills is put together
This repository is a content/prompt-engineering library rather than an application: it packages 24 'skills' (structured Markdown workflows with steps, verification gates, and anti-rationalization tables) plus 8 slash commands and agent personas for AI coding agents such as Claude Code, Cursor, Codex, Gemini CLI, Copilot, OpenCode, Windsurf, Kiro, Antigravity, and Command Code. There is no runtime codebase or data flow; the primary artifacts are Markdown skill definitions under skills/, per-agent command definitions in .claude/commands/ (Markdown), commands/ and .gemini/commands/ (TOML), shell-based lifecycle hooks in hooks/, shared reference checklists in references/, evaluation cases as JSON in evals/cases/, and plugin/marketplace manifest JSON files at the root and in .claude-plugin/, .codex-plugin/, and .agents/. Distribution is via git clone, native plugin marketplaces, or the external `npx skills` CLI.
Languages
Infrastructure
Major components
skills/
24 self-contained Markdown skill workflows (e.g., spec-driven-development, test-driven-development, security-and-hardening) each defined by a SKILL.md with steps, gates, and anti-rationalization tables.
commands/
Eight lifecycle slash-command definitions (/spec, /plan, /build, /test, /review, /webperf, /code-simplify, /ship) authored as TOML for agents that consume that format.
.claude/
Claude Code integration: Markdown slash commands in .claude/commands/ and a contributing rule in .claude/rules/skills-contributing.md.
.gemini/commands/
Gemini CLI variants of the eight lifecycle commands in TOML format.
hooks/
Shell hook scripts (session-start.sh, sdd-cache-pre/post.sh, simplify-ignore.sh) with a hooks.json registration file, documentation, and paired test scripts.
agents/
Four agent persona definitions: code-reviewer.md, security-auditor.md, test-engineer.md, web-performance-auditor.md.
references/
Shared supplementary checklists and patterns (security, accessibility, performance, observability, testing, definition-of-done, orchestration-patterns) referenced by multiple skills.
evals/
Per-skill evaluation case definitions as JSON files under evals/cases/ covering all 24 skills, documented by evals/README.md.
A quiet week with a single security-minded fix to the skill validator's allowlist logic.
5 weeksWeek of 2026-08-17
Week of 2026-08-17latest
A quiet week with a single security-minded fix to the skill validator's allowlist logic.
Week of 2026-08-10
A busy release week that shipped version 0.6.7 with new planning features, an idempotency guide, and several reliability fixes.
Week of 2026-08-03
The heaviest week of the month: 33 commits delivering security guards, CI gates, provider support, and a long tail of manifest consistency fixes.
Week of 2026-07-27
Documentation and tests landed to support the new Command Code provider and clarify skill reference rules.
Week of 2026-07-20
Ecosystem-neutral wording swept across docs and catalogs, plus community contributions for verification steps and contributor tooling.
Over the past month this repository — a collection of reusable 'skills' (guides and tools) for AI coding assistants — has been hardening its quality and safety rails while broadening ecosystem support. Early August saw a burst of work adding a new 'Phase 0 scope check' planning step, pluggable task lists, idempotency-key guidance, and a wave of fixes to validation, install paths, and CI. The most recent weeks have been quieter, focused on small validator fixes and documentation polish.
Week by week
2026-08-17A quiet week with a single security-minded fix to the skill validator's allowlist logic.latest1 change
Fix
Tightened the skill allowlist check
The validator now checks skills against a proper allowlist instead of accidentally matching built-in object property names, closing a subtle correctness and security gap.
2026-08-10A busy release week that shipped version 0.6.7 with new planning features, an idempotency guide, and several reliability fixes.6 changes
Feature
Phase 0 scope check for specs
Requirements spanning multiple capabilities now get an upfront capability map so teams confirm scope before diving into detailed plans.
Feature
Pluggable task list target for planning
Planning workflows can now write their task list to a configurable destination rather than one fixed location.
Docs
Idempotency-key implementation guide
New API documentation explains how to safely implement idempotency keys so repeated requests don't cause duplicate effects.
Fix
Reject incomplete grader results
The evaluation tooling no longer accepts grader outputs missing required fields, preventing silently misleading test results.
Fix
Standard SessionStart envelope from hooks
Hooks now emit the same standardized session-start message format used elsewhere in the system.
Chore
Release 0.6.7 manifest bump
All plugin manifests were bumped to version 0.6.7 to cut the release.
2026-08-03The heaviest week of the month: 33 commits delivering security guards, CI gates, provider support, and a long tail of manifest consistency fixes.6 changes
Feature
Command Code as a native skills provider
The system now recognizes Command Code as a first-class place where skills can be installed and discovered.
Fix
Path traversal guard on behavioral evals
The --behavioral flag now validates skill names to stop malicious paths from escaping the intended directory.
Chore
CI gate for references/ links
Continuous integration now automatically verifies that links inside each skill's references folder resolve correctly.
Fix
Cleaner eval workspaces
Throwaway directories created during evaluation runs are now deleted afterward instead of piling up.
Chore
CI upgraded off end-of-life Node 20
GitHub Actions were bumped to Node 24 runtimes to stay on supported infrastructure.
Fix
Plugin manifest version consistency
A series of commits pinned every plugin manifest to the release version so installs pick up matching components.
2026-07-27Documentation and tests landed to support the new Command Code provider and clarify skill reference rules.3 changes
Docs
Documented Command Code as a native provider
Docs now explain how Command Code works as a built-in location for skills.
Chore
Tests for the command validator
Automated coverage was added for how commands are validated, locking in correct behavior.
Docs
Explained per-skill reference limitation
Documentation clarifies a known limitation around how references are resolved per individual skill.
2026-07-20Ecosystem-neutral wording swept across docs and catalogs, plus community contributions for verification steps and contributor tooling.6 changes
Docs
Ecosystem-neutral command catalog
The commands catalog was rewritten so it doesn't favor any single AI coding assistant.
Docs
Keep-or-revert verification step for performance optimization
The performance-optimization skill gained a final checkpoint to either keep or roll back changes after measuring results.
Docs
Clarified supporting files vs. references/ subdirectory
Skill anatomy docs now distinguish loose helper files from the dedicated per-skill references folder.
Fix
Quoted opt-in hook paths
Hook configuration paths with spaces are now properly quoted so they don't break.
Docs
Skill-gap issue form for contributors
A new issue template helps contributors propose missing skills in a structured way.
Docs
Outbound-endpoint hygiene rule
The source-driven-development guide added a rule and checklist item for keeping external network calls safe and intentional.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required