Agent Skills: The Open-Source Skill Pack That Turns AI Coding Agents Into Senior Engineers — 76,000+ GitHub Stars

AI coding agents are powerful, but they have a well-known problem: they take shortcuts. They skip specs, write minimal tests, ignore security reviews, and ship prototype-quality code that looks correct but wouldn't survive a production code review.

Agent Skills solves this by encoding the workflows, quality gates, and best practices that senior engineers at companies like Google use every day — and making AI agents follow them consistently across every phase of development.

Created by Addy Osmani, Engineering Lead at Google and one of the most respected voices in web development, Agent Skills has exploded to 76,000+ GitHub stars — making it one of the fastest-growing developer tools of 2026.

What Is Agent Skills and Why Does It Matter?

Agent Skills is not a prompt library. It's a collection of 24 structured engineering workflows that cover the entire software development lifecycle:

DEFINE      PLAN        BUILD       VERIFY      REVIEW      SHIP
┌──────┐   ┌──────┐   ┌──────┐   ┌──────┐   ┌──────┐   ┌──────┐
│ Idea │──▶│ Spec │──▶│ Code │──▶│ Test │──▶│ QA   │──▶│ Go   │
│Refine│   │ PRD  │   │ Impl │   │Debug │   │ Gate │   │ Live │
└──────┘   └──────┘   └──────┘   └──────┘   └──────┘   └──────┘
  /spec      /plan      /build      /test     /review     /ship

Each skill is a step-by-step workflow with verification gates, anti-rationalization tables (countering the excuses agents use to skip steps), and evidence requirements. "Seems right" is never sufficient — every skill ends with concrete proof the work is done correctly.

The Problem With Vanilla AI Agents

When you ask an AI coding agent to build a feature, here's what typically happens:

• No spec is written — the agent jumps straight to code
• Tests are an afterthought — minimal coverage at best
• Security is ignored — no input validation, no auth patterns
• Code review is skipped — no one checks for maintainability
• Documentation is missing — no ADRs, no API docs

The result? Code that works in a demo but would never pass a senior engineer's review. Agent Skills fixes this by giving agents the discipline that years of engineering experience teach.

The 8 Slash Commands That Cover Your Entire Workflow

Agent Skills maps to 8 slash commands that trigger the right skills automatically:

The /build auto variant is particularly powerful: it generates the plan and implements every task in a single approved pass. You approve the plan once, then it runs autonomously — but every task is still test-driven and committed individually.

The 24 Skills — A Deep Dive

Here's the full skill inventory organized by development phase:

Define Phase

• interview-me — One-question-at-a-time interview that extracts what you actually need (not what you think you should want) until ~95% confidence
• idea-refine — Structured divergent/convergent thinking to turn vague ideas into concrete proposals
• spec-driven-development — Complete PRD covering objectives, commands, structure, code style, testing, and boundaries

Plan Phase

• planning-and-task-breakdown — Decompose specs into small, verifiable tasks with acceptance criteria and dependency ordering

Build Phase

• incremental-implementation — Thin vertical slices with feature flags, safe defaults, and rollback-friendly changes
• test-driven-development — Red-Green-Refactor with the test pyramid (80/15/5), DAMP over DRY, and the Beyonce Rule
• context-engineering — Feed agents the right information at the right time
• source-driven-development — Ground every framework decision in official documentation
• doubt-driven-development — Adversarial review of every non-trivial decision: CLAIM → EXTRACT → DOUBT → RECONCILE
• frontend-ui-engineering — Component architecture, design systems, WCAG 2.1 AA accessibility
• api-and-interface-design — Contract-first design with Hyrum's Law and the One-Version Rule

Verify Phase

• browser-testing-with-devtools — Chrome DevTools MCP for live runtime data, DOM inspection, and performance profiling
• debugging-and-error-recovery — Five-step triage: reproduce, localize, reduce, fix, guard

Review Phase

• code-review-and-quality — Five-axis review with ~100-line change sizing and severity labels
• code-simplification — Chesterton's Fence and the Rule of 500
• security-and-hardening — OWASP Top 10 prevention with a three-tier boundary system
• performance-optimization — Measure-first approach with Core Web Vitals targets

Ship Phase

• git-workflow-and-versioning — Trunk-based development with atomic commits
• ci-cd-and-automation — Shift Left, Faster is Safer, feature flags
• deprecation-and-migration — Code-as-liability mindset with zombie code removal
• documentation-and-adrs — Architecture Decision Records and inline documentation standards
• observability-and-instrumentation — Structured logging, RED metrics, OpenTelemetry tracing
• shipping-and-launch — Pre-launch checklists, staged rollouts, rollback procedures

Real-World Example: Building a REST API With Agent Skills

Let's walk through how Agent Skills transforms a typical AI coding session. Say you need a REST API for user authentication:

Without Agent Skills (Typical AI Output)

// AI agent generates this directly
app.post('/login', async (req, res) => {
  const { email, password } = req.body;
  const user = await User.findOne({ email });
  if (user && await bcrypt.compare(password, user.password)) {
    const token = jwt.sign({ id: user.id }, 'secret123');
    res.json({ token });
  } else {
    res.status(401).json({ error: 'Invalid' });
  }
});

Problems: No spec, no input validation, hardcoded secret, no rate limiting, no tests, no error handling for database failures.

With Agent Skills (Production-Grade Output)

Step 1: /spec — The agent writes a complete PRD covering auth flows, token lifecycle, error semantics, security boundaries, and testing requirements.

Step 2: /plan — The spec is decomposed into atomic tasks with acceptance criteria.

Step 3: /build — TDD-driven implementation:

// Step 3a: Write tests FIRST (Red)
describe('POST /auth/login', () => {
  it('returns 400 for invalid email format', async () => {
    const res = await request(app)
      .post('/auth/login')
      .send({ email: 'not-an-email', password: 'test123' });
    expect(res.status).toBe(400);
    expect(res.body.error).toMatch(/email/i);
  });

  it('returns 401 for non-existent user', async () => { /* ... */ });
  it('returns 401 for wrong password', async () => { /* ... */ });
  it('returns 429 after 5 failed attempts', async () => { /* ... */ });
  it('returns JWT with correct claims on success', async () => { /* ... */ });
});

// Step 3b: Implement (Green)
import { z } from 'zod';
import rateLimit from 'express-rate-limit';

const loginSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8).max(128),
});

const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  message: { error: 'Too many login attempts' },
});

app.post('/auth/login', authLimiter, async (req, res) => {
  const parsed = loginSchema.safeParse(req.body);
  if (!parsed.success) {
    return res.status(400).json({ 
      error: 'Validation failed', 
      details: parsed.error.issues 
    });
  }

  const { email, password } = parsed.data;
  
  try {
    const user = await userRepository.findByEmail(email);
    if (!user || !await bcrypt.compare(password, user.passwordHash)) {
      await auditLog.recordFailedLogin(email);
      return res.status(401).json({ error: 'Invalid credentials' });
    }

    const token = jwt.sign(
      { sub: user.id, role: user.role }, 
      process.env.JWT_SECRET,
      { expiresIn: '1h', issuer: 'auth-service' }
    );

    await auditLog.recordSuccessfulLogin(user.id);
    res.json({ token, expiresAt: new Date(Date.now() + 3600000).toISOString() });
  } catch (err) {
    logger.error('Login error', { error: err.message, email });
    res.status(500).json({ error: 'Internal server error' });
  }
});

Step 4: /review — Five-axis code review checks correctness, security, performance, maintainability, and test coverage before merge.

The difference is night and day. Same AI agent, but with structured workflows it produces code that would pass a senior engineer's review.

Key Benefits of Agent Skills

• 🏗️ Production-Grade Output — Skills encode Google's engineering culture: Hyrum's Law, the Beyonce Rule, trunk-based development, and more
• 🔒 Security by Default — OWASP Top 10 prevention, input validation, and secrets management baked into every relevant skill
• 🧪 Test-Driven Discipline — The Beyonce Rule: "If you liked it, you should have put a test on it." Red-Green-Refactor enforced
• 📋 Spec Before Code — Prevents the #1 AI coding mistake: building the wrong thing fast
• 🔄 Works With 70+ Agents — One install command works across Claude Code, Cursor, Copilot, Codex, Cline, Windsurf, Gemini CLI, and more
• 🧠 Anti-Rationalization — Every skill includes tables of common agent excuses ("I'll add tests later") with documented counter-arguments
• 📊 Verification Gates — "Seems right" is never sufficient; every skill requires concrete evidence
• 🎯 4 Specialist Personas — Code reviewer, test engineer, security auditor, and web performance auditor — each bringing their domain expertise
• ⚡ One-Command Install — npx skills add addyosmani/agent-skills and you're running
• 📝 Progressive Disclosure — Skills load supporting references only when needed, keeping token usage minimal

How to Install Agent Skills

Universal Install (Any Agent)

npx skills add addyosmani/agent-skills       # Install all 24 skills
npx skills add addyosmani/agent-skills --list # Browse before installing

Individual Skills

npx skills add addyosmani/agent-skills --skill code-review-and-quality
npx skills add addyosmani/agent-skills --skill test-driven-development
npx skills add addyosmani/agent-skills --skill interview-me

Claude Code (Native)

/plugin marketplace add addyosmani/agent-skills
/plugin install agent-skills@addy-agent-skills

Cursor

Copy skill files to .cursor/skills/ and add policies to .cursor/rules/*.mdc.

Codex CLI

codex plugin marketplace add addyosmani/agent-skills

What Makes Agent Skills Different From Other Skill Packs?

Unlike generic prompt libraries, Agent Skills follows three design principles:

1. Process, not prose — Skills are workflows agents follow, not reference docs they read. Each has steps, checkpoints, and exit criteria.
2. Anti-rationalization built in — Every skill includes a table of common excuses agents use to skip steps, with documented counter-arguments.
3. Verification is non-negotiable — Every skill ends with evidence requirements: tests passing, build output, runtime data. No hand-waving.

The skills also bake in best practices from Google's engineering culture, including concepts from "Software Engineering at Google" and Google's engineering practices guide. This isn't abstract theory — it's embedded directly into the step-by-step workflows agents follow.

Frequently Asked Questions

Is Agent Skills free to use?

Yes, Agent Skills is completely free and open-source under the MIT license. You can install it with a single command and use it with any AI coding agent.

Which AI coding agents does Agent Skills support?

Agent Skills works with 70+ AI coding tools including Claude Code, Cursor, GitHub Copilot, Codex, Cline, Windsurf, Gemini CLI, Kiro, Antigravity, and OpenCode. The skills are plain Markdown, so they work with any agent that accepts system prompts or instruction files.

How many skills are included?

Agent Skills includes 24 skills total: 23 lifecycle skills covering the entire development process (from idea to shipping) plus one meta-skill that helps agents choose the right workflow. There are also 4 specialist personas and 7 reference checklists.

Can I install just the skills I need?

Yes! You can install individual skills using the --skill flag: npx skills add addyosmani/agent-skills --skill test-driven-development. This is useful if you only want specific workflows like TDD, code review, or security hardening.

Does Agent Skills slow down AI coding?

It adds structure but doesn't add unnecessary steps. The /build auto mode generates a plan and implements every task autonomously in a single pass. The skills prevent rework by catching issues early — which actually speeds up the overall development process.

Who created Agent Skills?

Agent Skills was created by Addy Osmani, an Engineering Lead at Google who is widely known for his work on Chrome, web performance, and developer tools. He's the author of several popular open-source projects and engineering guides.

What's the difference between Agent Skills and other skill packs like Superpowers?

Agent Skills focuses on production-grade engineering discipline with anti-rationalization tables, verification gates, and Google's engineering best practices baked in. Other skill packs tend to focus more on prompting techniques or general coding assistance without the structured workflow enforcement.

🔗 Resources: Agent Skills on GitHub | Skills CLI | Addy Osmani's Blog