Install verified skills for AI coding agents safely
When using AI coding tools like Claude Code or Cursor, you may want to add 'skills' that instruct the agent to perform new tasks. However, many skills in public marketplaces have security issues, making them difficult to use with confidence. This repository is a list of skills that have passed security checks to reduce such risks. When you select and install a needed function, the agent automatically loads the necessary instructions and materials to perform that task.
Why only security-verified skills are included
The repository explains why it is necessary by citing statistics that 13.4% of all skills in public AI skill marketplaces have critical security issues. All skills are open source and do not include binary files. They undergo static analysis in the CI/CD pipeline, and file integrity is verified using hash values. Additionally, Snyk Agent Scan is used for pre-deployment scanning, and the CLI tool itself applies multi-layered security measures such as path isolation and symbolic link guards.
Supported AI coding agents
This repository is designed to be compatible with various AI coding agents. It supports widely used tools such as Claude Code, Cursor, GitHub Copilot, and Windsurf, as well as Aider, Antigravity, Amazon Q, Gemini CLI, Kiro, OpenAI Codex, Roo Code, TRAE, Tabnine, Sourcegraph Cody, Augment, Droid, and OpenCode. If a specific agent is not on the list, you can open an issue to request its addition.
Representative skill examples
The current catalog includes skills in various categories such as development, cloud, automation, design, and security. For example, 'tlc-spec-driven' provides a four-stage workflow for planning, designing, and breaking down tasks in a project. 'aws-advisor' helps with AWS architecture design and security reviews, while 'playwright-skill' performs browser automation tests. The 'figma' skill connects Figma designs to code conversion, and 'security-best-practices' identifies language-specific security vulnerabilities and suggests fixes.
Installation and management
Installation is conducted as an interactive wizard starting with the npx @tech-leads-club/agent-skills command. You select the desired skills, specify the target agent, and determine the installation scope by copying or using symbolic links. Downloaded skills are cached in ~/.cache/agent-skills/ for offline use, and you can track installation history with the agent-skills audit command.
Pre-use considerations
This repository applies the MIT license (software engine) and CC-BY-4.0 (skill files), while third-party skills follow their original licenses. If you use the catalog, you must credit Tech Leads Club. It also supports a method where agents directly search the skill catalog and retrieve only necessary files via an MCP server, so if you use an MCP-compatible client, you should refer to the relevant settings. If you want to extend AI agent capabilities in a security-first environment, it is recommended to additionally review the SECURITY.md document to determine if you can trust this repository's verification process.
