{
  "markdown": "# Claude Code Skills Collection\n\n**142 production-ready skills for Claude Code CLI**\n\nVersion 3.6.3 | Last Updated: 2026-08-06\n\n<div align=\"center\">\n\n**🔌 Platform / Harness Support**\n\nThese plugins ship as Claude Code marketplace plugins (`.claude-plugin/` manifests) and Codex CLI plugins (`.codex-plugin/` manifests). Other harnesses consume the same skills via [skills.sh](#installing-with-skillssh) — the cross-harness bridge.\n\n| Harness | Marketplace support | How to install |\n|---------|---------------------|----------------|\n| **Claude Code** | ✅ **Native** (federated) | `/plugin marketplace add secondsky/claude-skills`, then `/plugin install <name>@claude-skills` |\n| **ZCode** | ✅ **Native** (reads `.claude-plugin/` manifests) | Add this repo as a marketplace in the ZCode GUI |\n| **Codex CLI** | ✅ **Native** (federated) | `codex plugin marketplace add secondsky/claude-skills`, then `/plugins` in the Codex TUI |\n| **Cursor** | ⚠️ Adaptation needed | Cursor has an official marketplace, but expects `.cursor-plugin/plugin.json` (UI \"Add to Cursor\") this repo does not generate yet. Use skills.sh. |\n| **opencode** | ❌ No marketplace | npm plugins only (`opencode.json` `plugin[]`). Use skills.sh or vendor manually. |\n| **Gemini CLI** | ❌ No marketplace | `gemini extensions install <url>` only. Use skills.sh or vendor manually. |\n\n</div>\n\n---\n\nA curated collection of battle-tested skills for building modern web applications with Cloudflare, AI integrations, React, Tailwind, and more.\n\n---\n\n## Quick Start\n\n### Marketplace Installation (Recommended)\n\n```bash\n# Add the marketplace\n/plugin marketplace add https://github.com/secondsky/claude-skills\n\n# Install individual skills as needed\n/plugin install cloudflare-d1@claude-skills\n/plugin install tailwind-v4-shadcn@claude-skills\n/plugin install gemini-cli@claude-skills\n```\n\nSee [MARKETPLACE.md](MARKETPLACE.md) for complete catalog of all 142 skills.\n\n### Codex CLI Installation\n\nThis repo generates `.codex-plugin/` manifests and a `.agents/plugins/marketplace.json` for all 142 plugins, so Codex CLI can install them natively:\n\n```bash\n# Add the marketplace (from GitHub)\ncodex plugin marketplace add secondsky/claude-skills\n\n# Browse and install plugins in the Codex TUI\n#   /plugins          # opens the plugin browser\n#   Space             # enable/disable a plugin\n```\n\nSkills are auto-discovered from each plugin's `skills/` directory — the same `SKILL.md` files Claude Code uses. Claude-specific slash commands and subagents are not carried into Codex (use Codex's `/import` command for that).\n\n---\n\n## Installing with skills.sh\n\n[skills.sh](https://skills.sh) is an open agent-skills registry and `npx skills` CLI (maintained by Vercel) that auto-detects your coding agent — Claude Code, Cursor, Codex, Copilot, Cline, opencode, and 70+ others — and installs each skill into the correct directory for that harness. It is the **universal cross-harness path** for harnesses without a marketplace (opencode, Gemini CLI) or where this repo's manifest format isn't generated yet (Cursor).\n\n```bash\n# Install one skill (auto-detects your agent)\nnpx skills add secondsky/claude-skills --skill cloudflare-d1\n\n# Install several specific skills\nnpx skills add secondsky/claude-skills --skill cloudflare-d1 --skill tailwind-v4-shadcn\n\n# Try a skill once without installing (pipes its prompt to your agent)\nnpx skills use secondsky/claude-skills@cloudflare-d1 | claude\n\n# Target a specific agent explicitly\nnpx skills add secondsky/claude-skills --skill cloudflare-d1 --agent codex\n\n# List what's installed, search, update, remove\nnpx skills ls -g\nnpx skills find cloudflare\nnpx skills update cloudflare-d1\nnpx skills remove cloudflare-d1\n```\n\n> **Bulk install note:** `npx skills add secondsky/claude-skills --all` installs every discovered skill at once, but discovery walks skills.sh's standard container directories (`skills/`, `.claude/skills/`, …). This repo nests skills under `plugins/<name>/skills/<skill>/`, so `--all` may not pick up everything in one pass — install the skills you need by name with `--skill`, or run `npx skills add secondsky/claude-skills -l` to list what it finds.\n\n### Security scanning caveat\n\nskills.sh runs every published skill through three scanners (Gen Agent Trust Hub, Socket, Snyk) plus an LLM-based meta-analyzer, and publishes the results at [skills.sh/audits](https://skills.sh/audits). The LLM analysis stage has been publicly shown (Trail of Bits, June 2026) to both miss genuinely malicious skills **and** flag unfamiliar version pins (e.g. newest dependency versions) as suspicious false positives. **Treat skills.sh warnings as advisory, not authoritative** — and verify against this repo's own version pins before acting on a warning.\n\n---\n\n## Repository Structure\n\nThis repository contains **142 production-tested skills** for Claude Code, each focused on a specific technology or capability.\n\n**Individual Skills**: Each skill is a standalone unit with:\n- `SKILL.md` - Core knowledge and guidance\n- Templates - Working code examples\n- References - Extended documentation\n- Scripts - Helper utilities\n\n**Installation Options**:\n1. **Marketplace** (recommended) - Install individual skills via `/plugin install <name>@claude-skills`\n2. **Cross-harness** - Install into any supported agent with `npx skills add secondsky/claude-skills --skill <name>` (see [Installing with skills.sh](#installing-with-skillssh))\n\n---\n\n## Available Skills (142 Individual Skills)\n\nEach skill is individually installable. Install only the skills you need.\n\n**Full Catalog**: See [MARKETPLACE.md](MARKETPLACE.md) for detailed listings.\n\n### Categories\n\n| Category | Skills | Examples |\n|----------|--------|----------|\n| **tooling** | 24 | turborepo, plan-interview, code-review |\n| **frontend** | 26 | nuxt-v4, nuxt-v5, tailwind-v4-shadcn, tanstack-query, nuxt-studio, maz-ui, threejs |\n| **cloudflare** | 21 | cloudflare-d1, cloudflare-workers-ai, cloudflare-agents |\n| **api** | 16 | api-design-principles, graphql-implementation |\n| **ai** | 7 | gemini-cli, ml-model-training, tanstack-ai |\n| **web** | 10 | hono-routing, firecrawl-scraper, web-performance |\n| **security** | 6 | csrf-protection, xss-prevention, cybersecurity |\n| **mobile** | 5 | react-native-app, react-native-skills |\n| **woocommerce** | 4 | woocommerce-backend-dev |\n| **testing** | 4 | vitest-testing, playwright-testing |\n| **design** | 4 | design-review, design-system-creation |\n| **auth** | 4 | better-auth |\n| **architecture** | 3 | microservices-patterns, architecture-patterns |\n| **data** | 2 | recommendation-engine, recommendation-system |\n| **cms** | 2 | hugo, wordpress-plugin-core |\n| **database** | 1 | drizzle-orm-d1 |\n| **seo** | 2 | seo-optimizer, seo-keyword-cluster-builder |\n| **documentation** | 1 | technical-specification |\n\n---\n\n## How It Works\n\n### Auto-Discovery\n\nClaude Code automatically checks `~/.claude/skills/` for relevant skills before planning tasks:\n\n```\nUser: \"Set up a Cloudflare Worker with D1 database\"\n           ↓\nClaude: [Checks skills automatically]\n           ↓\nClaude: \"Found cloudflare-d1 skills.\n         These prevent 12 documented errors. Use them?\"\n           ↓\nUser: \"Yes\"\n           ↓\nResult: Production-ready setup, zero errors, ~65% token savings\n```\n\n**Note**: Due to token limits, not all skills may be visible at once. See [⚠️ Important: Token Limits](#-important-token-limits) below.\n\n### Skill Structure\n\nEach plugin is a directory under `plugins/<plugin-name>/` containing one or more skills:\n\n```\nplugins/[plugin-name]/\n├── .claude-plugin/\n│   └── plugin.json       # Plugin manifest (marketplace metadata)\n├── README.md\n├── skills/\n│   └── [skill-name]/\n│       ├── SKILL.md          # Core knowledge and guidance\n│       ├── templates/        # Ready-to-copy templates\n│       ├── scripts/          # Helper utilities\n│       └── references/       # Extended documentation\n└── (optional) agents/, commands/, hooks/\n```\n\n---\n\n## Recent Additions\n\n### July 2026\n\n**Offensive Security** (new category):\n- **cybersecurity** — Unified OSS-only cybersecurity skill with progressive disclosure. Fuses 7 community skills (mukul975 business-logic/XSS/host-header/forced-browsing/open-redirect, rysweet/amplihack cybersecurity-analyst, Aradotso security-detections-mcp) ported to fully open-source tooling (OWASP ZAP, Dalfox, ffuf, Nuclei, mitmproxy, interact.sh, Semgrep, Sigma). Covers threat modeling (STRIDE/PASTA/VAST, MITRE ATT&CK), web-vuln testing, SAST, code audit, AI/LLM-app security, and detection engineering. Live-target testing is gated behind an authorization disclaimer; static analysis, code review, and threat modeling are always available. Cross-references the 5 existing defensive security plugins (`csrf-protection`, `xss-prevention`, `vulnerability-scanning`, `security-headers-configuration`, `defense-in-depth-validation`) for remediation. Integrates 20 Aradotso dev-security skills across 5 grouped reference docs.\n\n### May 2026\n\n**Supply Chain Security** (cross-cutting):\n- **dependency-upgrade** expanded with **Socket CLI integration** — proactive malicious package detection, typosquatting alerts, and CI/CD security gates. New 418-line reference guide, 2 GitHub Actions templates, and expanded supply chain security comparison (3 tools)\n- **31 skills now include \"Secure Installation\" guidance** — contextually-tailored security sections across all high-risk skill categories (scaffolding, MCP/agent SDKs, multi-provider installs, Docker, CI/CD). Covers 8 Bun skills, 5 Nuxt skills, 6 Cloudflare skills, 4 AI/agent skills, and 8 frontend/tooling skills\n- Supply chain security is now a **first-class cross-cutting concern** woven into the skill collection — not a standalone topic\n\n### February - April 2026\n\n**Full-Stack Frameworks**:\n- **nuxt-v5** (v1.0.0) - Full Nuxt 5 support with 4 skills (core, data, server, production), 3 diagnostic agents, and interactive setup wizard\n- **threejs** (v1.0.0) - 3D web graphics: scenes, geometries, shaders, animations, post-processing\n\n**Infrastructure**:\n- **JSON schema validation** - Automated plugin.json validation with CI support\n- **GitHub issue templates** - Skill-specific issue templates for bug reports, feature requests, and submissions\n\n**Plugin Enhancements**:\n- **mutation-testing** - Added Bun native runner support\n- **dependency-upgrade** - Added supply chain security content\n\n### December 2025 - January 2026\n\n**Frontend Expansion**:\n- **nuxt-studio** (v1.0.0) - Visual CMS for Nuxt Content with live preview, OAuth auth, and R2 storage integration\n- **maz-ui** (v1.0.0) - 50+ Vue/Nuxt components with theming, i18n, form generation, and 14 composables\n\n**Developer Workflow**:\n- **plan-interview** (v2.0.0) - Adaptive interview-driven spec generation with autonomous quality review\n- **turborepo** (v2.8.0) - Updated to official Vercel skill with enhanced monorepo build optimization\n\n**Mobile Development**:\n- **react-native-skills** (v1.0.0) - React Native & Expo best practices with performance optimization patterns\n\n**Enhanced Authentication**:\n- **better-auth** (v2.2.0) - Expanded to 18 framework integrations with 30+ authentication plugins\n\n---\n\n## ⚠️ Important: Token Limits\n\n### Skill Visibility Constraint\n\nClaude Code has a **15,000 character limit** for the total size of skill descriptions in the system prompt. This limit also applies to commands and agents.\n\n**What this means:**\n- Not all 142 skills may be visible in Claude's context at once\n- Skills are loaded based on relevance and available token budget\n- You can verify how many skills Claude currently sees by asking: *\"How many skills do you see in your system prompt?\"*\n\n### Checking Visible Skills\n\nTo verify which skills are currently loaded:\n\n```bash\n# Ask Claude Code directly\n\"Check what skills/plugins you see in your system prompt\"\n```\n\nClaude will report something like: \"85 of 142 skills visible due to token limits\"\n\n### Workaround: Increase Token Budget\n\nYou can double the headroom for skill descriptions by setting an environment variable:\n\n```bash\n# Increase limit to 30,000 characters\nexport SLASH_COMMAND_TOOL_CHAR_BUDGET=30000\n\n# Then launch Claude Code\nclaude\n```\n\nThis gives you approximately **2x more skill visibility** in the system prompt.\n\n**Note**: This is a temporary workaround. The Claude Code team is working on better solutions for skill discovery and loading.\n\n---\n\n## Token Efficiency\n\n| Metric | Manual Setup | With Skills | Savings |\n|--------|--------------|-------------|---------|\n| **Average Tokens** | 12,000-15,000 | 4,000-5,000 | **~65%** |\n| **Typical Errors** | 2-4 per service | 0 (prevented) | **100%** |\n| **Setup Time** | 2-4 hours | 15-45 minutes | **~80%** |\n\n**Across all 142 skills**: 400+ documented errors prevented.\n\n---\n\n## Contributing\n\n### Prerequisites for Contributors\n\nInstall the official plugin development toolkit:\n\n```bash\n/plugin install plugin-dev@claude-code-marketplace\n```\n\nThis provides:\n- `/plugin-dev:create-plugin` command (8-phase guided workflow)\n- 7 comprehensive skills (hooks, MCP, structure, agents, commands, skills)\n- 2 specialized agents (agent-creator, plugin-validator)\n\n### Quick Steps\n\n1. Create skill directory in `plugins/`\n2. Add `SKILL.md` with YAML frontmatter\n3. Run `./scripts/sync-plugins.sh`\n4. Submit pull request\n\nSee [CONTRIBUTING.md](docs/guides/CONTRIBUTING.md) and [PLUGIN_DEV_BEST_PRACTICES.md](docs/guides/PLUGIN_DEV_BEST_PRACTICES.md) for detailed guidelines.\n\n---\n\n## Documentation\n\n| Document | Purpose |\n|----------|---------|\n| [START_HERE.md](docs/getting-started/START_HERE.md) | **Start here!** Quick navigation guide |\n| [PLUGIN_DEV_BEST_PRACTICES.md](docs/guides/PLUGIN_DEV_BEST_PRACTICES.md) | **Repository-specific best practices** (marketplace, budget, quality) |\n| [MARKETPLACE.md](MARKETPLACE.md) | Full skill catalog and installation guide |\n| [MARKETPLACE_MANAGEMENT.md](docs/guides/MARKETPLACE_MANAGEMENT.md) | Technical infrastructure (plugin.json, scripts, validation) |\n| [CLAUDE.md](CLAUDE.md) | Project context and development standards |\n| [CONTRIBUTING.md](docs/guides/CONTRIBUTING.md) | Contribution guidelines |\n\n---\n\n## Links\n\n- **Repository**: https://github.com/secondsky/claude-skills\n- **Issues**: https://github.com/secondsky/claude-skills/issues\n- **Claude Code**: https://claude.com/claude-code\n\n---\n\n**Built with ❤️ by Claude Skills Maintainers**\n",
  "bytes": 14387,
  "sha": "855faae337a4b4668ba03329240bb0fa1a640a574fe6200a9777dac4e8729124",
  "repo_slug": "secondsky/claude-skills",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/skl_secondsky_claude_skills_plugins_vulnerab_3f6f534d/readme"
}