Superpowers
obra/superpowersA 15-skill development methodology that makes coding agents clarify the goal, write a plan, work through it with subagents and verify before calling it done.
Recommended
Check first Depth 3/5
Agent Skills (Addy Osmani) Claude skills
25 engineering-lifecycle skills and 9 slash commands (spec, plan, build, test, review, ship) that make coding agents follow senior-engineer workflows.
Our verdict Recommended
A thorough, well-structured process pack with no risky code; it overlaps with Superpowers, so pick one primary workflow.
What Agent Skills (Addy Osmani) does
This pack packages a software delivery lifecycle as skills. Nine slash commands map to its stages: /spec, /plan, /build, /test, /constraints, /review, /webperf, /code-simplify and /ship. Each command pulls in the relevant skills, and skills also trigger on their own when the task matches, for example api-and-interface-design when you design an API or frontend-ui-engineering when you build UI.
The 25 skills are long, structured SKILL.md files (about 14 KB on average) with a consistent layout: when to use it, the process, common rationalizations an agent might use to cut corners, and verification steps. Topics include test-driven development, spec-driven and incremental implementation, code review and simplification, debugging, security and hardening, performance, observability, CI/CD, git workflow, documentation and ADRs, deprecation and migration, and a few unusual ones such as interview-me (requirements questioning, one question at a time) and doubt-driven-development (a second model reviews the first model's work from a read-only sandbox). /build auto plans once, then implements each task test-first with a commit per task, pausing on failures or risky steps. Beyond the skills there are a few shared reference checklists (security, performance, constraint floors), one small shell script that creates a docs/ideas folder, and a Claude Code plugin manifest. There are no executable test suites for the skills themselves.
Good for
- Teams that want one consistent spec-to-ship process across several agents
- Engineers who want focused skills for review, security hardening, performance or API design
- Projects that already use Claude Code, Cursor, Codex or Copilot and want a shared rule set
Not for
- Tiny scripts or one-off fixes where a multi-stage process is overhead
- Work that needs domain references (legal, science, design systems) rather than engineering process
What's inside depth 3/5
25 skills averaging about 14 KB of detailed instructions, a handful of shared reference files and one trivial shell script, but no tests or evals shipped with the skills.
- Skills
- 25
- Reference docs
- 6
- Scripts
- 1
- Tests / evals
- 96
- Templates
- 0
- Avg SKILL.md
- 13.5 KB
Counted from the repository file tree. How we score depth.
Dependencies and costs
- Codex CLI or Gemini CLI only if you use the optional cross-model review in doubt-driven-development
Security review
Review before installingA broad set of engineering workflow skills, slash commands and personas, almost all Markdown. No skill declares allowed-tools, and the plugin manifests do not install any hooks; the optional sdd-cache and simplify-ignore hooks are shell scripts a user must wire into their own settings. The browser-testing skill suggests an unpinned npx chrome-devtools-mcp@latest server and documents the risk of attaching to your real Chrome profile.
Worth knowing
- Runs remote code at an unpinned versionThe suggested MCP config runs
npx -y chrome-devtools-mcp@latest --isolated, an unpinned package fetched at each launch; the skill also documents an opt-in--autoConnectmode that attaches to your running Chrome and warns against using it by default.skills/browser-testing-with-devtools/SKILL.md:35 - Relies on a CLI or package we could not reviewRelies on the chrome-devtools-mcp npm package, and (doubt-driven-development/SKILL.md line 144) optionally on the codex or gemini CLIs, none of whose code is in the repo.skills/browser-testing-with-devtools/SKILL.md:35
- Makes network requestsOptional WebFetch cache hooks (documented in hooks/SDD-CACHE.md, not wired by the plugin) issue curl HEAD requests to the same URLs the agent fetches, to revalidate cached pages.hooks/sdd-cache-pre.sh:71
What we checked
The repository (223 files) on Oct 29, 2026. Not a full review: we read 7 of 53 code files; it relies on code outside the repository: npm package chrome-devtools-mcp (run via npx @latest); optional codex / gemini CLIs used for cross-model review; hooks/sdd-cache-post.sh, hooks/simplify-ignore.sh and the Node scripts under scripts/ were only pattern-scanned, not read in full.
NVIDIA SkillSpector static scan: 183 pattern hits (Agent Snooping 81, MCP Rug Pull 47, Tool Misuse 17, Excessive Agency 17, Privilege Escalation 8, YARA Match 4). Most of the 183 hits are documentation: agent config paths in setup guides, MCP-style snippets, example DELETE routes, git reset --hard advice, a prompt-injection warning that quotes 'Ignore previous instructions', and rm -f on the simplify-ignore hook's own cache. The Node scripts only call git, the claude CLI (maintainer eval runner, opt-in) and local file operations; the eval runner's pre-approved tools apply only to its throwaway workspace.
A review, not a certification. Skills change after we check them — read the files before installing.
License
MIT — commercial use allowed.
Can it run unattended?
Not really. /build auto runs a whole plan after one approval and commits per task, but it is designed to pause on failures and risky steps rather than run unattended for hours.
Skills in this repository
| Skill | Installs |
|---|---|
| code-review-and-quality | 75K |
| security-and-hardening | 73K |
| frontend-ui-engineering | 70K |
| performance-optimization | 67K |
| spec-driven-development | 67K |
| planning-and-task-breakdown | 66K |
| documentation-and-adrs | 66K |
| debugging-and-error-recovery | 65K |
| code-simplification | 65K |
| api-and-interface-design | 65K |
| test-driven-development | 64K |
| incremental-implementation | 64K |
| context-engineering | 64K |
| git-workflow-and-versioning | 62K |
Linked skills have their own review.
Alternatives to Agent Skills (Addy Osmani)
Matt Pocock's Skills
mattpocock/skillsSmall, composable engineering skills: grill-me interviews, shared glossary, TDD, triage, prototyping, code review, handoff and a flow router.
Recommended
Check first Depth 2/5
Compound Engineering
EveryInc/compound-engineering-pluginEvery's plugin of 36 skills for a brainstorm, plan, build, review and capture-the-learning loop, with an optional hands-off /lfg pipeline.
Recommended
Broad access Depth 4/5
wshobson/agents
wshobson/agentsA multi-harness plugin marketplace with 94 plugins, 202 agents, 185 skills and 105 commands for Claude Code, Codex, Cursor, OpenCode, Copilot, Antigravity and Pi.
With caveats
Check first Depth 2/5
FAQ
What is addyosmani/agent-skills?
It is a collection of 25 engineering skills and 9 slash commands by Addy Osmani that guide coding agents through defining, planning, building, testing, reviewing and shipping software. Each skill is a structured SKILL.md with a process and a verification checklist.
How do I install Agent Skills?
Run npx skills add addyosmani/agent-skills for all skills, or add --skill <name> for one. In Claude Code you can use /plugin marketplace add addyosmani/agent-skills and then /plugin install agent-skills@addy-agent-skills. Installing a single skill does not copy the repo-level references folder, which the README tracks as a known issue.
Is Agent Skills safe to install?
We found no hidden network calls, credential reads or obfuscated code. The scanner's high-severity hits are examples and warnings in the documentation. The one shell script only creates a directory.
Agent Skills vs Superpowers: which one?
Both enforce a plan, test and review workflow. Superpowers is a tightly linked methodology built around subagents and a design-first loop, while Agent Skills is a broader set of independent engineering topics (API design, security, performance, CI/CD) you can adopt one by one.
Sources: GitHub repository (stars, license, file tree, last push Oct 29, 2026); install counts from skills.sh via Best Skills (CC BY 4.0). Review based on the README and SKILL.md files as published.