The GitHub repository addyosmani/agent-skills sits at 90,797 stars after adding 196 in a single day on GitHub's daily trending list S¹. It packages 25 skills and nine slash commands designed to make AI coding agents follow the same workflows a senior engineer would: write a spec, plan the build, test the result, review before merging S¹. Whether prompt-level instructions can enforce that discipline on agents that will install malicious packages from a README edit remains unproven.

My read: This is the most structured attempt I've seen to bottle senior-engineer judgement into reusable commands for AI coding agents. The nine slash commands map cleanly to a real development lifecycle, and the context-triggered skill activation is a smart idea: if an agent detects it is building a UI, it loads frontend-ui-engineering automatically S¹. What I don't buy yet is the '70+ agents' claim S¹, which reads like marketing copy until someone verifies the integration list. And the portability gap in issue #361, where single-skill installs miss shared reference files S¹, tells me this is still early-stage tooling wearing a production label.

Nine commands, one pipeline

The slash commands map to the development lifecycle: /spec defines what to build, /plan maps the approach, /build implements incrementally, /test proves it works, /constraints sets the quality bar, /review checks before merge, /webperf audits performance, /code-simplify cleans up, and /ship sends it to production S¹. The README describes a /build auto mode that generates a plan and implements every task in a single approved pass, pausing on failures or risky steps S¹. That pause-on-failure behaviour is the detail that matters. It is the difference between an agent that charges through a build blindly and one that stops when something looks wrong.

Skills that wake up on context

The 25 skills activate automatically based on what the agent is doing. Designing an API triggers api-and-interface-design. Building UI triggers frontend-ui-engineering S¹. The install path is a single command: npx skills add addyosmani/agent-skills loads all 25 S¹. There is also a native Claude Code marketplace integration via /plugin marketplace add addyosmani/agent-skills S¹. The README claims the CLI works with more than 70 agents including Claude Code, Cursor, Codex, Copilot, and Cline S¹, though this is an unverified assertion from the project's own documentation.

The gap in the fine print

Install a single skill rather than the full set and you get only the skills/ directory, not the repo-level references/ directory that holds shared checklists S¹. This portability gap is tracked in issue #361 S¹. It means a developer who cherry-picks one skill may find it referencing checklists that are not present on their machine. The release history shows version 0.5.0 shipped in April 2026, adding a Source-Driven Development skill that grounds framework decisions in official documentation P². That is a young project by version number, whatever the star count says.

The /review gate meets the malware problem

AI coding agents will install malicious packages from a simple README edit. A tool like agent-skills, which enforces a /review step before merge, sits squarely in the defense layer against that kind of attack. The /constraints command, which sets the quality bar before code is written, is the kind of gate that could stop an agent from accepting a dependency it should not. But a slash command is only as strong as the agent's willingness to obey it, and the evidence for that is still thin.

What to do about it

For a team running Claude Code or Cursor on a real codebase, the value proposition is straightforward: you get a structured set of prompts that enforce spec-then-build-then-test discipline without writing your own. A small web agency building client sites could install the full skill set, run /spec before starting a new landing page, and use /webperf before shipping to catch performance regressions the agent would otherwise skip. The practical step this week: run npx skills add addyosmani/agent-skills in a throwaway branch, try /build auto on a small feature, and watch whether the agent actually pauses when it hits a failure or barrels through. If it pauses, the discipline is real. If it does not, the skills are suggestions, not gates.

What we don't know yet

No third party has verified the 'production-grade' label or the '70+ agents' claim S¹. The star count, while large, is a platform metric that reflects trending algorithms and social sharing, not necessarily enterprise adoption. Issue #361 remains open, meaning the single-skill install path is incomplete. And we have no data on whether teams using these skills ship fewer bugs than teams without them. The next signal: watch issue #361 for a resolution that ports the references/ directory into per-skill installs, and check the repository for a 0.6.0 release that would indicate active maintenance beyond the April 0.5.0 tag P². We will check both against the next release. Subscribe if you want the follow-up when we see whether 0.6.0 closes that gap.

Sources: S1 — addyosmani/agent-skills: Production-grade engineering skills for AI co · P2 — Agent Skills 0.5.0 · P3 — TemidireAdesiji/arxiv-sentinel · P4 — README.md · P5 — princeton-pli/RLMT

More from Not A Tech Guy

Generated from an audited evidence pack with primary-source research. Social-media items are discussion signals, not verified facts. Nothing here is financial, legal or medical advice.

agent-skills by the numbers