agent-skills: A Hardened, Validated Skill Registry for Pro Coding Agents

The agent skills ecosystem has a security problem the README cites directly: in open marketplaces, 13.4% of skills contain critical issues. tech-leads-club/agent-skills positions itself as a managed alternative. Every skill in this registry goes through static analysis in CI/CD, lockfile-based integrity, content hashing, human-curated prompts, and a pre-publish Snyk Agent Scan. The CLI uses defense-in-depth (sanitization, path isolation, symlink guards, atomic lockfile, audit trail) so install-time behavior is constrained.

Why This Skill Matters

The repo targets professional AI coding agents across three tiers: Tier 1 (Claude Code, Cline, Cursor, GitHub Copilot, Windsurf, OpenAI Codex, Roo Code, TRAE), Tier 2 (Aider, Antigravity, Augment, Gemini CLI, Kilo Code, Kiro, Sourcegraph Cody), Tier 3 (Amazon Q, Droid, OpenCode, Tabnine). If your agent is on the list, every skill you install through this registry runs against the same defensive checks.

The catalog is fetched on-demand from a CDN (~45 KB) rather than committed. A Featured Skills section highlights five examples: tlc-spec-driven (four-phase project and feature planning with atomic tasks and persistent memory), aws-advisor (architecture, security, implementation backed by AWS MCP tools), playwright-skill (browser automation), figma (design-to-code via MCP), security-best-practices (language/framework-specific security reviews). The full catalog is browsable through an interactive wizard.

The license model is layered: the application code (CLI, scripts, tools) is MIT; the maintainer-authored SKILL.md files are CC-BY-4.0 with attribution required; third-party skills retain their original licenses.

Installation

The interactive wizard handles everything. Run once to browse and install:

npx @tech-leads-club/agent-skills

For non-interactive installs or scripts:

# Install globally
npm install -g @tech-leads-club/agent-skills

# Then install specific skills by name
agent-skills install -s tlc-spec-driven
agent-skills install -s aws-advisor coding-guidelines docs-writer

# Target a specific agent
agent-skills install -s my-skill -a cursor claude-code

# Or symlink instead of copy
agent-skills install -s my-skill --symlink

# Maintenance
agent-skills list
agent-skills update -s my-skill
agent-skills update            # all skills
agent-skills remove -s my-skill
agent-skills cache --clear
agent-skills audit             # integrity audit
agent-skills credits
agent-skills --help

For MCP-compatible clients, add this to your MCP config:

{ "mcpServers": { "agent-skills": { "command": "npx", "args": ["-y", "@tech-leads-club/agent-skills-mcp"] } } }

The catalog is cached at ~/.cache/agent-skills/; clear it with rm -rf ~/.cache/agent-skills/ if a stale cache causes odd behavior. The full threat model lives in SECURITY.md.

Real Workflow: Install the Spec-Driven Skill Into Claude Code

You want a skill that turns a one-line feature idea into a phased plan with atomic tasks and persistent session memory. The registry's tlc-spec-driven skill is built for exactly that.

Step 1. Run the wizard:

npx @tech-leads-club/agent-skills

Step 2. Find tlc-spec-driven in the catalog, choose Claude Code as the target, and confirm. The CLI copies (or symlinks) the skill into the Claude Code skills directory after running the static-analysis and integrity checks.

Step 3. Open Claude Code and ask:

Plan a small /api/sync endpoint that batches user activity events.

Step 4. The skill activates and walks through Specify → Design → Tasks → Implement. Each phase produces atomic tasks with verification criteria; the session memory persists across phases so you do not lose context when context windows roll over.

Step 5. After the plan is approved, ask the same Claude Code session to start implementing. The skill's Tasks phase output feeds straight into implementation without re-deriving scope.

Real Workflow: Use the CLI's Audit and Update Commands Across a Team

You have several team members running different agents and you want everyone to be on the same registry-backed skills, with regular integrity checks.

Step 1. Each team member installs the registry globally once:

npm install -g @tech-leads-club/agent-skills

Step 2. Each member installs the team's agreed set against their own agent. Example for a Cursor user:

agent-skills install -s tlc-spec-driven -a cursor
agent-skills install -s security-best-practices -a cursor

Step 3. Set up a weekly check. Run agent-skills audit to confirm lockfiles and content hashes match what the registry served. If anything drifted, the audit tells you which skill and why (local edit, manual override, or upstream change).

Step 4. When the registry publishes an updated version of a skill, run agent-skills update -s <skill> to pull the new version through the same checks. Run agent-skills update without an argument to refresh everything at once.

Step 5. If a team's environment has custom mirrors, point the registry at your mirror by setting the cache directory and clearing the existing cache before update.

Tips

• Treat the wizard as the entry point the first time; use the explicit agent-skills install -s <name> form in scripts and CI.
• Pick --symlink for skills you intend to edit locally — the registry stays the source of truth and your edits overlay.
• Run agent-skills audit on a schedule (cron / scheduled CI) rather than only when something breaks.
• Cite Tech Leads Club in your project documentation if you reuse the registry's skill files; CC-BY-4.0 attribution is required.
• If your agent is not on the supported list, open an issue — the README invites agent additions through the issue tracker.

When Not to Use This

If you only need a single skill that you have already vetted on the upstream side, install it directly rather than going through the registry — you do not need the audit overhead for a single trusted install. Also skip the registry if your security model requires air-gapped installs with no CDN fetch: this registry pulls the catalog from a CDN at install time, so a fully offline deployment needs a mirror you control.

See the leaderboard for more skill registries.