Addy Osmani agent-skills: 25 Production Workflows for Coding Agents

Addy Osmani published agent-skills on GitHub as a production-grade skill library for coding agents: 25 skills, nine lifecycle commands, four review personas, and install paths for Claude Code, Cursor, Codex, Gemini CLI, Copilot, and 70+ agents via the open npx skills CLI. The repo trended with hundreds of new stars on November 10, 2026 because it encodes how senior engineers actually ship — not just how models autocomplete.

If you already use Matt Pocock's engineering skills or Janestreet's Socratic tutor pack, this is a different editorial bet: a full DEFINE → PLAN → BUILD → VERIFY → REVIEW → SHIP belt with explicit anti-rationalization tables in each skill.

TL;DR

What the repository contains

Spec-through-ship workflow diagram beside assembled structure for Addy Osmani agent-skills lifecycle commands

The README frames skills as workflows, quality gates, and best practices senior engineers use, packaged so agents follow them consistently. ASCII art in the repo maps:

DEFINE → PLAN → BUILD → VERIFY → REVIEW → SHIP

with commands /spec, /plan, /build, /test, /constraints, /review, /webperf, /code-simplify, /ship.

The 25 skills (grouped)

Meta: using-agent-skills routes work to the right workflow.

Define: interview-me, idea-refine, spec-driven-development, constraints-and-standards.

Plan: planning-and-task-breakdown.

Build: incremental-implementation, test-driven-development, context-engineering, source-driven-development, doubt-driven-development, frontend-ui-engineering, api-and-interface-design.

Verify: browser-testing-with-devtools, debugging-and-error-recovery.

Review: code-review-and-quality, code-simplification, security-and-hardening, performance-optimization.

Ship: git-workflow-and-versioning, ci-cd-and-automation, deprecation-and-migration, documentation-and-adrs, observability-and-instrumentation, shipping-and-launch.

Each skill's SKILL.md follows a consistent anatomy: overview, when-to-use, process steps, rationalization tables, red flags, and verification evidence — the same anti-rationalization pattern we highlighted in teardown posts on offline HTML skills.

Commands vs skills

Commands are entry points that activate skills automatically. Claude Code installs them as plugin commands; where a built-in /review collides, the README says to use /agent-skills:review.

Notable product detail: /build auto mode generates a plan and implements every task in one approved pass — still test-driven per task, still commits per task, but fewer human clicks between tasks.

How to install without breaking your repo layout

The README is explicit that hosts use different folders:

Portability caveat (issue #361 in README): installing a single skill via npx skills add … --skill name copies only that skill folder, not repo-level references/ checklists. Whole-repo install, clone, or manual copy fixes that.

Personas for multi-angle review

Under agents/, the pack ships:

• code-reviewer — five-axis staff-engineer bar
• test-engineer — coverage and prove-it framing
• security-auditor — OWASP-style pass
• web-performance-auditor — Core Web Vitals with metric-honesty rules

docs/agents.md covers orchestration, including the rule that personas do not spawn personas — relevant if you chain multi-agent orchestration benchmarks in production.

How this compares to other skill libraries

Osmani's README links docs/comparisons.md for Superpowers and Matt Pocock — read that file in-repo for his stated deltas. We do not treat comparisons as independent benchmarks.

Context: Osmani moved to Anthropic to work on Claude Code in September, covered in our Addy Osmani hire post. This repo is personal open source, not an Anthropic product release — still worth watching because it influences how Claude Code power users structure repos.

Security and supply-chain hygiene

Supply-chain audit metaphor for vetting third-party agent skill packs before production install

Skills are not passive docs. They can instruct agents to run scripts under scripts/, edit CONSTRAINTS.md, or call browser tools. Before you npx skills add:

1. Read the SKILL.md files you will enable — same bar as agent skills security threats.
2. Pin with skills-lock.json patterns where your harness supports them.
3. Separate "marketing skills" from repo-specific skills — our stack-diagram skill post shows narrow skills that do one job well.
4. Check the format spec — the open Agent Skills specification describes the SKILL.md folder layout and how agents load skills on demand, so you know what a skill can bundle before you enable it.

The repo includes evals/ with 25 case files and CI under .github/workflows/ — a sign the maintainer expects regression testing on skill routing, similar in spirit to scenario-labs game-art skills.

Adoption: greenfield vs legacy codebases

docs/adoption.md (linked from README) splits rollout:

• Greenfield: run the full /spec → /ship chain from day one.
• Legacy: incremental, verification-first — align with incremental implementation themes in harness evolution posts.

For teams standardized on MCP instead of skills, pair this pack with MCP comparison guides — skills instruct procedure; MCP exposes tools. Osmani's browser-testing-with-devtools skill assumes Chrome DevTools MCP-style workflows.

What developers are saying

The older Hacker News thread on related agent-skills discourse (id 47670950 on the candidate feed) had low engagement when we checked. Trending stars on GitHub are the stronger signal for this repo — treat social proof as install interest, not a security audit.

Reference checklists and shared artifacts

The references/ directory holds seven checklists skills pull on demand: definition-of-done, testing-patterns, security-checklist, performance-checklist, accessibility-checklist, observability-checklist, and orchestration-patterns. Keeping them at repo root is why the README warns that per-skill npx installs skip shared files — your agent might reference paths that were never copied.

CONSTRAINTS.md is another standing artifact: the constraints-and-standards skill helps teams write it once so agents stop renegotiating lint rules every session. That mirrors how Microsoft Copilot managed runtime templates bake policy into repo scaffolding.

Hooks, scripts, and CI

The repository ships hooks/ for lifecycle automation and scripts/ (13 utilities per README) used in contributor workflows. .github/workflows/ runs validation on skill routing using the evals/ corpus (25 case files). If you fork the pack for a company monorepo, treat those evals as a template for regression tests on skill selection — the same mindset as EVOAudit harness evolution research.

Google engineering culture embedded in prose

The README explicitly cites practices from Software Engineering at Google and Google's engineering practices guide: Hyrum's Law in API design, the Beyonce Rule in testing, change-sizing norms in review, Chesterton's Fence in simplification, trunk-based git workflow, Shift Left in CI/CD, and treating deprecation as liability. None of that replaces your team's written standards, but it explains why the skills read opinionated rather than generic.

If you are standardizing agent behavior across Cursor and Codex in the same repo, align this pack with Claude Code command reference habits so humans and agents share vocabulary for /review and /test.

When not to install the full pack

Skip the entire marketplace install if you only need one narrow skill (for example browser-testing-with-devtools) and you are token-sensitive. Copy that skills/<name>/ folder manually plus any checklist it references. For diagram-heavy repos, compare with stack-diagram's single-purpose skill before importing 25 workflows you will never trigger.

Practical first steps today

1. Clone or npx skills add the whole repo if you need references/ checklists.
2. Run /spec or interview-me on a vague ticket before /build auto mode.
3. Wire /constraints once per repo so agents stop re-deciding lint and test rules every session — mirrors DESIGN.md discipline posts.
4. Compare doubt-driven-development against your existing human review for high-stakes merges.

Licensing and contribution expectations

The repository uses the MIT License. CONTRIBUTING.md and AGENTS.md describe how maintainers expect agents and humans to propose skill changes. plugin.json at the repo root wires Antigravity and Copilot CLI discovery — useful if your org standardizes on a single plugin manifest per monorepo.

If you maintain an internal skills registry, index this repo beside explainx.ai's public skills directory so new hires see both domain-specific packs (TypeScript, CAD, diagrams) and process-wide packs (spec-to-ship). Document which commands are safe in CI versus interactive-only so automated agents do not invoke /ship on pull requests without human ack.

Stars climbed on November 10, 2026 because the pack sits at the intersection of two hungry audiences: teams adopting Claude Code plugins after Fable 5.2 hype, and engineers tired of one-off SKILL.md files with no verification section. Neither audience should skip reading the Red Flags sections inside each skill — they exist precisely because agents rationalize skipping tests. Schedule a quarterly re-read when the repo tags a release, the same way you bump npm dependencies after security advisories. Capture which slash commands your team actually uses in a one-page RUNBOOK.md so new hires do not invoke /ship during exploratory chats.

Related reading

• What are agent skills?
• Matt Pocock agent skills for real engineers
• Addy Osmani joins Anthropic (Claude Code)
• Janestreet Socratic tutor skills
• skills-lock.json for reproducible skills
• AWS Quick Skills catalog patterns

Repository star counts, skill names, and install commands are accurate as of November 10, 2026 — confirm on github.com/addyosmani/agent-skills.