AI coding agents tend to skip the boring parts: writing down what to build, testing first, keeping changes small. Addy Osmani's Agent Skills puts those habits back as plain Markdown instructions your agent follows. Nine commands map to the stages of a project (/spec, /plan, /build, /test, /review, /ship, plus /constraints, /webperf and /code-simplify), and the right skill can also activate on its own when you start designing an API or building a UI.
There are 25 skills in all, covering things like test-driven development, security hardening, debugging, performance, documentation and an interview-me skill that asks one question at a time until it knows what you really want. Four specialist personas play code reviewer, security auditor, test engineer and web performance auditor. It works with Claude Code, Cursor, Codex, Gemini CLI, Copilot, Windsurf, OpenCode and more, and has about 114,000 stars and 97 contributors, with version 0.6.15 out on October 31.
This is a different collection from Anthropic Agent Skills and Vercel Agent Skills, which are both on this list. Anthropic's is a general library that includes document skills, and Vercel's focuses on React performance, UI review and deploying. Addy Osmani's is about the engineering process itself.
- Repository: github.com/addyosmani/agent-skills
- Licence: MIT (MIT License)
- Language: JavaScript. Stars: 113.8K. Forks: 11.9K. Last push: Nov 1, 2026.
- Scan: safe, Nov 7, 2026, commit 301b02b
Who it is for
Developers and small teams who use a coding agent for real projects and want it to plan, test and review like a careful senior engineer. Also useful for newer developers who want to see what that process looks like.
Getting started
1. See the list of skills without installing anything
npx skills add addyosmani/agent-skills --list2. Install all 25 skills into your agent (needs Node)
npx skills add addyosmani/agent-skills3. Or in Claude Code, add it as a plugin to get the commands too
/plugin marketplace add addyosmani/agent-skills4. Then install the plugin and start with a spec
/plugin install agent-skills@addy-agent-skillsIn Claude Code, built-in commands win a name clash, so run its review as /agent-skills:review. /build auto works through every task after you approve the plan once, so use it only when you are happy to step back; it still pauses on failures and risky steps.
Safety scan
We cloned addyosmani/agent-skills at commit 301b02b on Nov 7, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secret hits and no pattern hits in 239 files and about 25,000 lines, mostly Markdown and JavaScript. No binaries committed, no install scripts and no lockfiles to check.
- As a skill repo it got the extra pass. No hidden Unicode anywhere. The injection phrases that appear are warnings to the agent, such as telling it to distrust ignore previous instructions in a fetched page. No exfiltration hosts, no pipe-to-shell, and the only credential mentions are .env files in advice about keeping secrets out of git.
- The repo has no hooks.json and the plugin wires up no hooks. The hooks folder holds optional scripts you would add to your own settings by hand: session-start loads a local skill, sdd-cache stores fetched pages in your project and rechecks them with a curl HEAD request to that same URL, and simplify-ignore swaps protected code blocks for placeholders in the file during a session, then restores them at the end.
- One skill, doubt-driven-development, can offer a second opinion from your own Gemini or Codex command-line tool. It asks first each time and tells the tool to run read-only, and that tool's usage is yours.
- One workflow with nine action uses, all GitHub's own, and no pull_request_target. A licence and contributing guide are present; no Dependabot or security policy, but there are no lockfiles to update. Network hosts in the code are only docs.example.com, example.test and owasp.org.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 1 workflow. None use pull_request_target. No third-party actions. |
| Network hosts | 3 distinct hosts referenced from source; most often docs.example.com, example.test, owasp.org. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has licence file, contributing guide. Missing security policy, automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
By the numbers
| Stars | 113.8K |
|---|---|
| Forks | 11.9K |
| Contributors | 97 |
| Commits | 807 |
| Open issues | 57 |
| Open pull requests | 75 |
| Releases | 17 |
| Latest release | 0.6.15 |
| Licence | MIT |
| Main language | JavaScript |
| Project age | 8 months |
| Last push | Nov 1, 2026 |
| Tracked files | 239 |
| Lines of code | 24.8K |
| Checkout size | 1 MB |
Lines by language: Markdown 14.8K, JavaScript 5,763, Shell 1,706, JSON 1,556, TOML 550, YAML 256.
Questions
Is Addy Osmani's Agent Skills free?
Yes, MIT-licensed with no paid tier and no account. Your only cost is the tokens your coding agent spends following the skills.
Is this the same as Anthropic's or Vercel's agent skills?
No. They are separate repositories with similar names. Anthropic Agent Skills includes document skills for Word, PDF and more, Vercel Agent Skills covers React performance, UI review and deploying, and this one, addyosmani/agent-skills, covers the whole engineering process from spec to ship. They can sit side by side.
Do I have to install all 25 skills?
No. Add one with npx skills add addyosmani/agent-skills --skill test-driven-development. A single-skill install leaves out the shared reference checklists, so the skill still works but those extra paths are missing.
Will it make my agent slower or use more tokens?
Following a spec, plan and test cycle takes more steps than just writing code, so a task can use more tokens. Skills load when they are needed, and the commands let you choose when to use the full process.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.