Agent-skills
lastmod 2026-04-08created 2026-04-081 edits
A collection of production-grade engineering skills for AI coding agents
About
- Open source in which Addy Osmani, AI director at Google Cloud, packaged senior-engineer-level workflows into structured skills to solve the problem of AI coding agents skipping specs, tests, and security reviews
- Consists of 7 slash commands and 19 skills covering the entire development lifecycle (define→plan→build→verify→review→ship)
- /spec Define what to build : "Spec before code"
- /plan Plan how to implement : "Into small atomic tasks"
- /build Incremental implementation : "One slice at a time"
- /test Prove it works : "Tests are evidence"
- /review Pre-merge quality gate : "Improve code health"
- /code-simplify Simplify code : "Clarity over cleverness"
- /ship Production deployment : "Faster is safer"
Full list of 19 skills
- Define (clarify what to build)
- idea-refine: structures divergent/convergent thinking to turn vague ideas into concrete proposals
- spec-driven-development: writes a PRD covering goals, commands, structure, code style, tests, and boundaries before writing code
- planning-and-task-breakdown: breaks a spec into small, verifiable tasks with acceptance criteria and dependency ordering
- incremental-implementation: implement, test, verify, and commit in thin vertical slices; supports feature flags and rollback-friendly changes
- test-driven-development: applies Red-Green-Refactor, the test pyramid (80/15/5), DAMP over DRY, and the Beyonce Rule
- context-engineering: gives the agent the right information at the right time (rules files, context packing, MCP integration)
- frontend-ui-engineering: component architecture, design systems, state management, responsive design, WCAG 2.1 AA accessibility
- api-and-interface-design: contract-first design, Hyrum's Law, One-Version Rule, error semantics, boundary validation
- browser-testing-with-devtools: real-time runtime data via Chrome DevTools MCP (DOM inspection, console logs, network traces, performance profiling)
- debugging-and-error-recovery: 5-step triage (reproduce→localize→reduce→fix→guard), stop-the-line rule
- code-review-and-quality: 5-axis review, change size (~100 lines), severity labels (Nit/Optional/FYI), review speed standards
- code-simplification: Chesterton's Fence, Rule of 500, reducing complexity while preserving exact behavior
- security-and-hardening: OWASP Top 10 prevention, authentication patterns, secret management, dependency audits, 3-tier boundary system
- performance-optimization: measure-first approach, Core Web Vitals targets, profiling workflow, bundle analysis
- git-workflow-and-versioning: trunk-based development, atomic commits, change size (~100 lines), commit-as-savepoint pattern
- ci-cd-and-automation: Shift Left, Faster is Safer, feature flags, quality gate pipelines
- deprecation-and-migration: code-as-liability mindset, compulsory/advisory deprecation, zombie code removal
- documentation-and-adrs: Architecture Decision Records, API docs, inline documentation standards (document the "why")
- shipping-and-launch: pre-launch checklist, feature flag lifecycle, staged rollout, rollback procedures, monitoring setup
Agent personas
- 3 expert personas preconfigured for targeted reviews
- code-reviewer: senior staff engineer perspective, 5-axis code review against the standard "Would a staff engineer approve this?"
- test-engineer: QA specialist perspective, test strategy, coverage analysis, Prove-It pattern
- security-auditor: security engineer perspective, vulnerability detection, threat modeling, OWASP assessment
Reference checklists
- 4 quick references that skills consult when needed
- testing-patterns.md: test structure, naming, mocking, React/API/E2E examples, anti-patterns
- security-checklist.md: pre-commit checks, authentication, input validation, headers, CORS, OWASP Top 10
- performance-checklist.md: Core Web Vitals targets, frontend/backend checklists, measurement commands
- accessibility-checklist.md: keyboard navigation, screen readers, visual design, ARIA, testing tools
Skill design principles
- Process, not prose: skills are workflows the agent follows, with steps, checkpoints, and exit criteria, not reference documents
- Anti-rationalization: every skill has built-in common excuses agents use to skip steps ("I'll add tests later") along with rebuttals
- Verification is non-negotiable: every skill ends with evidence requirements (passing tests, build output, runtime data), and "seems right" is not enough
- Progressive disclosure: SKILL.md is the entry point, and supporting references are loaded only when needed to minimize token usage
Installation (supported tools)
- Claude Code (recommended): /plugin marketplace add addyosmani/agent-skills, then /plugin install agent-skills@addy-agent-skills
- Local development: git clone, then claude --plugin-dir /path/to/agent-skills