agent-skills

agent-skills

The secure, validated skill registry for professional AI coding agents. Extend Antigravity, Claude Code, Cursor, Copilot and more with absolute confidence.

Stars: 1429

Visit
 screenshot

Agent Skills is a secure, validated skill registry for professional AI coding agents. It provides a library of verified, tested, and safe capabilities to extend various AI agents with confidence. The tool addresses security concerns in marketplace skills by offering 100% open-source code, static analysis for credential theft prevention, immutable integrity to prevent supply chain attacks, and human curation to ensure safety boundaries. Users can install skills through an interactive wizard, choose from a variety of supported AI coding agents, and benefit from a growing catalog of featured skills for development, cloud, automation, design, and security tasks.

README:

Tech Leads Club

npm version total downloads monthly downloads license build status

node version typescript nx cloud semantic-release

github stars contributors last commit ai powered

🧠 Agent Skills

The secure, validated skill registry for professional AI coding agents

In an ecosystem where over 13% of marketplace skills contain critical vulnerabilities, Agent Skills stands apart as a hardened library of verified, tested, and safe capabilities. Extend Antigravity, Claude Code, Cursor, and more with absolute confidence.

https://tech-leads-club.github.io/agent-skills/

πŸ“– Table of Contents

✨ What are Skills?

Skills are packaged instructions and resources that extend AI agent capabilities. Think of them as plugins for your AI assistant β€” they teach your agent new workflows, patterns, and specialized knowledge.

packages/skills-catalog/skills/
  (category-name)/
    skill/
      SKILL.md          ← Main instructions
      templates/        ← File templates
      references/       ← On-demand documentation

πŸ›‘οΈ Security & Trust

Your environment's safety is our top priority. Unlike open marketplaces where 13.4% of skills contain critical issues, agent-skills is a managed, hardened library.

Vulnerability Mitigation

We directly address the threats identified in the Snyk 2026 Agent Threat Report:

Threat Public Marketplaces Agent Skills Guarantee
Malicious Payloads Obfuscated code, binaries, or "black box" instructions 100% Open Source: No binaries, fully readable text/code. Every line is auditable.
Credential Theft Skills silently exfiltrating env vars to remote servers Static Analysis: CI/CD pipeline blocks skills with suspicious network calls or secret access.
Supply Chain Attacks Authors pushing malicious updates to existing skills Immutable Integrity: Lockfiles and content-hashing ensure code never changes without your explicit upgrade.
Prompt Injection Hidden instructions to hijack agent behavior ("jailbreaks") Human Curation: Every prompt is manually code-reviewed by maintainers for safety boundaries.

CLI Defense-in-Depth

The installer itself implements strict technical controls:

  • Filesystem Isolation: Recursive path traversal protection preventing access outside target directories.
  • Input Sanitization: Strict validation of skill names and paths to neutralize injection vectors.
  • Symlink Guard: Safe handling of symbolic links to prevent aliasing attacks.
  • Integrity Verification: Lockfile-based validation ensuring reproducible and authorized skill management.
  • Automated Auditing: All skills undergo continuous security scanning with mcp-scan.

πŸ€– Supported Agents

Install skills to any of these AI coding agents:


Tier 1 (Popular) Tier 2 (Rising) Tier 3 (Enterprise)
Claude Code Aider Amazon Q
Cline Antigravity Augment
Cursor Gemini CLI Droid (Factory.ai)
GitHub Copilot Kilo Code OpenCode
Windsurf Kiro Sourcegraph Cody
OpenAI Codex Tabnine
Roo Code
TRAE

Missing your favorite agent? Open an issue and we'll add support!

🌟 Featured Skills

A glimpse of what's available in our growing catalog:

Skill Category Description
tlc-spec-driven Development Project and feature planning with 4 phases: Specify β†’ Design β†’ Tasks β†’ Implement. Creates atomic tasks with verification criteria and maintains persistent memory across sessions.
aws-advisor Cloud Expert AWS Cloud Advisor for architecture design, security review, and implementation guidance. Leverages AWS MCP tools for documentation-backed answers.
playwright-skill Automation Complete browser automation with Playwright. Test pages, fill forms, take screenshots, validate UX, and automate any browser task.
figma Design Fetch design context from Figma and translate nodes into production code. Design-to-code implementation with MCP integration.
security-best-practices Security Language and framework-specific security reviews. Detect vulnerabilities, generate reports, and suggest secure-by-default fixes.

β†’ Browse all skills


πŸš€ Quick Start

Install Skills in Your Project

npx @tech-leads-club/agent-skills

This launches an interactive wizard:

  1. Choose Action β€” "Install skills" or "Update installed skills"
  2. Browse & Select β€” Filter by category or search
  3. Choose agents β€” Pick target agents (Cursor, Claude Code, etc.)
  4. Installation method β€” Copy (recommended) or Symlink
  5. Scope β€” Global (user home) or Local (project only)

Each step shows a ← Back option to return and revise your choices.

CLI Options

Note: You can use either npx @tech-leads-club/agent-skills or install globally and use agent-skills directly.

# Interactive mode (default)
npx @tech-leads-club/agent-skills
# or: agent-skills (if installed globally)

# List available skills
agent-skills list
agent-skills ls        # Alias

# Install one skill
agent-skills install -s tlc-spec-driven

# Install multiple skills at once
agent-skills install -s aws-advisor coding-guidelines docs-writer

# Install to specific agents
agent-skills install -s my-skill -a cursor claude-code

# Install multiple skills to multiple agents
agent-skills install -s aws-advisor nx-workspace -a cursor windsurf cline

# Install globally (to ~/.gemini, ~/.claude, etc.)
agent-skills install -s my-skill -g

# Use symlink instead of copy
agent-skills install -s my-skill --symlink

# Force re-download (bypass cache)
agent-skills install -s my-skill --force

# Update a specific skill
agent-skills update -s my-skill

# Update all installed skills
agent-skills update

# Remove one skill
agent-skills remove -s my-skill

# Remove multiple skills at once
agent-skills remove -s skill1 skill2 skill3
agent-skills rm -s my-skill    # Alias

# Remove from specific agents
agent-skills remove -s my-skill -a cursor windsurf

# Force removal (bypass lockfile check)
agent-skills remove -s my-skill --force

# Manage cache
agent-skills cache --clear           # Clear all cache
agent-skills cache --clear-registry  # Clear only registry
agent-skills cache --path            # Show cache location

# View audit log
agent-skills audit                   # Show recent operations
agent-skills audit -n 20             # Show last 20 entries
agent-skills audit --path            # Show audit log location

# Show contributors and credits
agent-skills credits

# Show help
agent-skills --help

Global Installation (Optional)

npm install -g @tech-leads-club/agent-skills
agent-skills  # Use 'agent-skills' instead of 'npx @tech-leads-club/agent-skills'

⚑ How It Works

The CLI fetches skills on-demand from our CDN:

  1. Browse β€” The CLI fetches the skills catalog (~45KB)
  2. Select β€” You choose the skills you need
  3. Download β€” Selected skills are downloaded and cached locally
  4. Install β€” Skills are installed to your agent's configuration

Caching

Downloaded skills are cached in ~/.cache/agent-skills/ for offline use.

# Clear the cache
rm -rf ~/.cache/agent-skills

πŸ›  For Contributors

Prerequisites

  • Node.js β‰₯ 22
  • npm (comes with Node.js)

Setup

git clone https://github.com/tech-leads-club/agent-skills.git
cd agent-skills
npm ci
npm run build

Development Commands

Command Description
npm run start:dev Run CLI locally (interactive mode)
npm run g <name> Generate a new skill
npm run build Build all packages
npm run test Run all tests
npm run lint Lint codebase
npm run format Format code with Prettier
npm run scan Run incremental security scan

Creating a New Skill

# With category (recommended)
nx g @tech-leads-club/skill-plugin:skill my-skill --category=development

# Full options
nx g @tech-leads-club/skill-plugin:skill my-skill \
  --description="What my skill does" \
  --category=development \
  --author="github.com/username" \
  --skillVersion="1.0.0"

The generator creates:

  • packages/skills-catalog/skills/(development)/my-skill/SKILL.md

πŸ“ Project Structure

agent-skills/
β”œβ”€β”€ packages/
β”‚   β”œβ”€β”€ cli/                      # @tech-leads-club/agent-skills CLI
β”‚   └── skills-catalog/           # Skills collection
β”‚       └── skills/               # All skill definitions
β”‚           β”œβ”€β”€ (category-name)/  # Categorized skills
β”‚           └── _category.json    # Category metadata
β”œβ”€β”€ tools/
β”‚   └── skill-plugin/             # Nx skill generator
β”œβ”€β”€ skills-registry.json          # Auto-generated catalog
β”œβ”€β”€ .github/
β”‚   └── workflows/                # CI/CD pipelines
└── nx.json                       # Nx configuration

πŸ“ Skill Structure

packages/skills-catalog/skills/
β”œβ”€β”€ (category-name)/              # Category folder
β”‚   └── my-skill/                 # Skill folder
β”‚       β”œβ”€β”€ SKILL.md              # Required: main instructions
β”‚       β”œβ”€β”€ scripts/              # Optional: executable scripts
β”‚       β”œβ”€β”€ templates/            # Optional: file templates
β”‚       └── references/           # Optional: on-demand docs
└── _category.json                # Category metadata

SKILL.md Format

---
name: my-skill
description: What this skill does. Use when user says "trigger phrase".
metadata:
  version: 1.0.0
  author: github.com/username
---

# My Skill

Brief description.

## Process

1. Step one
2. Step two

Category Metadata

_category.json:

{
  "(development)": {
    "name": "Development",
    "description": "Skills for software development",
    "priority": 1
  }
}

Best Practices

  • Keep SKILL.md under 500 lines β€” use references/ for detailed docs
  • Write specific descriptions β€” include trigger phrases
  • Assume the agent is smart β€” only add what it doesn't already know
  • Prefer scripts over inline code β€” reduces context window usage

πŸ”’ Security Scan

Every skill is scanned with mcp-scan before publishing. The scan is incremental β€” only skills whose content changed since the last run are re-scanned.

npm run scan              # Incremental (default)
npm run scan -- --force   # Force full re-scan

How it works

Each skill has a SHA-256 content hash (computed from all its files). Results are cached in .security-scan-cache.json (gitignored). On the next run, skills whose hash hasn't changed skip re-scanning and load results from cache.

Content hash unchanged β†’ load from cache (fast)
Content hash changed   β†’ re-scan with mcp-scan

Handling false positives

If mcp-scan flags a finding that is intentional (e.g. a first-party MCP server integration), add it to the allowlist:

packages/skills-catalog/security-scan-allowlist.yaml

version: '1.0.0'

entries:
  - skill: my-skill
    code: W011
    reason: >
      Fetches from trusted first-party API β€” expected behavior.
    allowedBy: github.com/username
    allowedAt: '2026-01-01'
    expiresAt: '2027-01-01' # Optional but recommended
  • Match is by skill + code β€” no re-scan needed after adding an entry
  • expiresAt is optional but recommended β€” forces periodic review
  • Expired entries re-activate the finding automatically
  • Use YAML for better readability, comments, and cleaner diffs

The allowlist is committed to the repo and reviewable in PRs.

πŸ”„ Release Process

This project uses Conventional Commits for automated versioning:

Commit Prefix Version Bump Example
feat: Minor (0.X.0) feat: add new skill
fix: Patch (0.0.X) fix: correct symlink path
feat!: Major (X.0.0) feat!: breaking API change
docs: No bump docs: update README
chore: No bump chore: update deps

Releases are automated via GitHub Actions when merging to main.

🀝 Contributing

  1. Fork the repository
  2. Create a feature branch (git checkout -b feat/amazing-skill)
  3. Commit with conventional commits (git commit -m "feat: add amazing skill")
  4. Push to your fork (git push origin feat/amazing-skill)
  5. Open a Pull Request

πŸ›‘οΈ Content & Authorship

This repository is a collection of curated skills intended to benefit the community. We deeply respect the intellectual property and wishes of all creators.

If you are the author of any content included here and would like it removed or updated, please open an issue or contact the maintainers.

πŸ“„ License

MIT Β© Tech Leads Club

⭐ Star History

Star History Chart


Built with ❀️ by the Tech Leads Club community

For Tasks:

Click tags to check more tools for each tasks

For Jobs:

Alternative AI tools for agent-skills

Similar Open Source Tools

For similar tasks

For similar jobs