Addy Osmani published agent-skills on GitHub as a production-grade skill library for coding agents: 25 skills, nine lifecycle commands, four review personas, and install paths for Claude Code, Cursor, Codex, Gemini CLI, Copilot, and 70+ agents via the open npx skills CLI. The repo trended with hundreds of new stars on November 10, 2026 because it encodes how senior engineers actually ship — not just how models autocomplete.
If you already use Matt Pocock's engineering skills or Janestreet's Socratic tutor pack, this is a different editorial bet: a full DEFINE → PLAN → BUILD → VERIFY → REVIEW → SHIP belt with explicit anti-rationalization tables in each skill.
TL;DR #
| Question | Answer |
|---|---|
| What ships? | 25 skills plususing-agent-skills meta skill;9 commands ;4 personas ;7 reference checklists |
| Fastest install? | npx skills add addyosmani/agent-skills (per README) |
| Claude Code path? | /plugin marketplace add addyosmani/agent-skills then/plugin install agent-skills@addy-agent-skills |
| License? | MIT per repository LICENSE file |
| Stars (Nov 10)? | 114k+ on GitHub trending snapshot; verify live count on the repo |
| Vs Matt Pocock? | Broader lifecycle; README points to docs/comparisons |
| Risk? | Skills are executable policy — pin and audit like any agent dependency |
What the repository contains #
Spec-through-ship workflow diagram beside assembled structure for Addy Osmani agent-skills lifecycle commands
The README frames skills as workflows, quality gates, and best practices senior engineers use, packaged so agents follow them consistently. ASCII art in the repo maps:
DEFINE → PLAN → BUILD → VERIFY → REVIEW → SHIP
with commands /spec, /plan, /build, /test, /constraints, /review, /webperf, /code-simplify, /ship.
The 25 skills (grouped)
Meta: using-agent-skills routes work to the right workflow.
**Define:** `interview-me`, `idea-refine`, `spec-driven-development`, `constraints-and-standards`.
**Plan:** `planning-and-task-breakdown`.
Build: incremental-implementation, test-driven-development, context-engineering, source-driven-development, doubt-driven-development, frontend-ui-engineering, api-and-interface-design.
**Verify:** `browser-testing-with-devtools`, `debugging-and-error-recovery`.
**Review:** `code-review-and-quality`, `code-simplification`, `security-and-hardening`, `performance-optimization`.
**Ship:** `git-workflow-and-versioning`, `ci-cd-and-automation`, `deprecation-and-migration`, `documentation-and-adrs`, `observability-and-instrumentation`, `shipping-and-launch`.
Each skill's SKILL.md follows a consistent anatomy: overview, when-to-use, process steps, rationalization tables, red flags, and verification evidence — the same anti-rationalization pattern we highlighted in teardown posts on offline HTML skills.
Commands vs skills
Commands are entry points that activate skills automatically. Claude Code installs them as plugin commands; where a built-in /review collides, the README says to use /agent-skills:review.
Notable product detail: /build auto mode generates a plan and implements every task in one approved pass — still test-driven per task, still commits per task, but fewer human clicks between tasks.
How to install without breaking your repo layout #
The README is explicit that hosts use different folders:
| Tool | Location |
|---|---|
| Cursor | Copy under .cursor/skills/ ; keep short policies in.cursor/rules/*.mdc — seedocs/cursor-setup.md |
| OpenCode | .opencode/skills/ plus optionalAGENTS.md |
| Gemini CLI | gemini skills install with--path skills |
| Codex | codex plugin marketplace add /codex plugin add |
| Copilot | Personas in agents/ , prose in.github/copilot-instructions.md ;slash commands are Claude-only |
Portability caveat (issue #361 in README): installing a single skill via npx skills add … --skill name copies only that skill folder, not repo-level references/ checklists. Whole-repo install, clone, or manual copy fixes that.
Personas for multi-angle review #
Under agents/, the pack ships:
- **code-reviewer** — five-axis staff-engineer bar
- **test-engineer** — coverage and prove-it framing
- **security-auditor** — OWASP-style pass
- **web-performance-auditor** — Core Web Vitals with metric-honesty rules
docs/agents.md covers orchestration, including the rule that personas do not spawn personas — relevant if you chain multi-agent orchestration benchmarks in production.
How this compares to other skill libraries #
| Pack | Emphasis | explainx.ai coverage |
|---|---|---|
| Addy Osmani agent-skills | Full SDLC, Google-flavored practices cited in README | This post |
| Matt Pocock skills | TypeScript / real-engineer TDD & planning | Skills guide |
| ECC (affaan-m) | Huge agent + skill count, install risk | ECC harness guide |
| Anthropic / AAIF | Standard format donation | Agent Skills explainer | Osmani's README links docs/comparisons.md for Superpowers and Matt Pocock — read that file in-repo for his stated deltas. We do not treat comparisons as independent benchmarks.
Context: Osmani moved to Anthropic to work on Claude Code in September, covered in our Addy Osmani hire post. This repo is personal open source, not an Anthropic product release — still worth watching because it influences how Claude Code power users structure repos.
Security and supply-chain hygiene #
Supply-chain audit metaphor for vetting third-party agent skill packs before production install
Skills are not passive docs. They can instruct agents to run scripts under scripts/, edit CONSTRAINTS.md, or call browser tools. Before you npx skills add:
1. **Read** the`SKILL.md` files you will enable — same bar as[agent skills security threats](https://explainx.ai/blog/agent-skills-security-threat-explainx-verification) .
2. **Pin** with[skills-lock.json patterns](https://explainx.ai/blog/skills-lock-json-reproducible-agent-skills-2026) where your harness supports them.
- Separate "marketing skills" from repo-specific skills — ourstack-diagram skill post shows narrow skills that do one job well.
- Check the format spec — the openAgent Skills specification describes the
SKILL.mdfolder layout and how agents load skills on demand, so you know what a skill can bundle before you enable it.
The repo includes evals/ with 25 case files and CI under .github/workflows/ — a sign the maintainer expects regression testing on skill routing, similar in spirit to scenario-labs game-art skills.
Adoption: greenfield vs legacy codebases #
docs/adoption.md (linked from README) splits rollout:
- Greenfield: run the full
/spec → /shipchain from day one. - Legacy: incremental, verification-first — align withincremental implementation themes in harness evolution posts.
For teams standardized on MCP instead of skills, pair this pack with MCP comparison guides — skills instruct procedure; MCP exposes tools. Osmani's browser-testing-with-devtools skill assumes Chrome DevTools MCP-style workflows.
What developers are saying #
The older Hacker News thread on related agent-skills discourse (id 47670950 on the candidate feed) had low engagement when we checked. Trending stars on GitHub are the stronger signal for this repo — treat social proof as install interest, not a security audit.
Reference checklists and shared artifacts #
The references/ directory holds seven checklists skills pull on demand: definition-of-done, testing-patterns, security-checklist, performance-checklist, accessibility-checklist, observability-checklist, and orchestration-patterns. Keeping them at repo root is why the README warns that per-skill npx installs skip shared files — your agent might reference paths that were never copied.
CONSTRAINTS.md is another standing artifact: the constraints-and-standards skill helps teams write it once so agents stop renegotiating lint rules every session. That mirrors how Microsoft Copilot managed runtime templates bake policy into repo scaffolding.
Hooks, scripts, and CI #
The repository ships hooks/ for lifecycle automation and scripts/ (13 utilities per README) used in contributor workflows. .github/workflows/ runs validation on skill routing using the evals/ corpus (25 case files). If you fork the pack for a company monorepo, treat those evals as a template for regression tests on skill selection — the same mindset as EVOAudit harness evolution research.
Google engineering culture embedded in prose #
The README explicitly cites practices from Software Engineering at Google and Google's engineering practices guide: Hyrum's Law in API design, the Beyonce Rule in testing, change-sizing norms in review, Chesterton's Fence in simplification, trunk-based git workflow, Shift Left in CI/CD, and treating deprecation as liability. None of that replaces your team's written standards, but it explains why the skills read opinionated rather than generic.
If you are standardizing agent behavior across Cursor and Codex in the same repo, align this pack with Claude Code command reference habits so humans and agents share vocabulary for /review and /test.
When not to install the full pack #
Skip the entire marketplace install if you only need one narrow skill (for example browser-testing-with-devtools) and you are token-sensitive. Copy that skills/<name>/ folder manually plus any checklist it references. For diagram-heavy repos, compare with stack-diagram's single-purpose skill before importing 25 workflows you will never trigger.
Practical first steps today #
- Clone or
npx skills addthe whole repo if you needreferences/checklists. - Run
/specorinterview-meon a vague ticket before/buildauto mode. - Wire
/constraintsonce per repo so agents stop re-deciding lint and test rules every session — mirrorsDESIGN.md discipline posts . - Compare
doubt-driven-developmentagainst your existing human review for high-stakes merges.
Licensing and contribution expectations #
The repository uses the MIT License. CONTRIBUTING.md and AGENTS.md describe how maintainers expect agents and humans to propose skill changes. plugin.json at the repo root wires Antigravity and Copilot CLI discovery — useful if your org standardizes on a single plugin manifest per monorepo.
If you maintain an internal skills registry, index this repo beside explainx.ai's public skills directory so new hires see both domain-specific packs (TypeScript, CAD, diagrams) and process-wide packs (spec-to-ship). Document which commands are safe in CI versus interactive-only so automated agents do not invoke /ship on pull requests without human ack.
Stars climbed on November 10, 2026 because the pack sits at the intersection of two hungry audiences: teams adopting Claude Code plugins after Fable 5.2 hype, and engineers tired of one-off SKILL.md files with no verification section. Neither audience should skip reading the Red Flags sections inside each skill — they exist precisely because agents rationalize skipping tests. Schedule a quarterly re-read when the repo tags a release, the same way you bump npm dependencies after security advisories. Capture which slash commands your team actually uses in a one-page RUNBOOK.md so new hires do not invoke /ship during exploratory chats.
Related reading #
Repository star counts, skill names, and install commands are accurate as of November 10, 2026 — confirm on github.com/addyosmani/agent-skills.