Skills

28 specialists for the engineering work around vibe coding.

Twenty-eight research-backed specialists for the work between “I have an idea” and “it is live in production.” Each skill owns one job, carries its own restraints and verification contract, and loads only when it is relevant.

Each package has a workflow and verification contract. The current upgrade repairs demonstrated gaps; cross-runtime behavior and comparative outcomes remain empirical questions. See the 28-row upgrade ledger.

npx skills add udaysharmadev/Skills --all

Try a direct request such as “Use sleuth to find why this value stays stale after a write.” You should receive a reproduction, a causal explanation, a scoped fix and its check output. /concierge is optional when the owner is unclear.

Building one feature, fixing one bug, or cleaning one frightening repo: you do not need to memorize 28 commands. Use the owner you know, or ask concierge.

From idea to production

flowchart LR
    A["IDEAhotseat"] --> U["UNDERSTANDspelunk"]
    U --> R["RESEARCHscout"]
    R --> S["SPECdistill"]
    S --> P["PLANmasterplan"]
    P --> B["BUILDpilot · backend"]
    B --> D["DESIGNpolish · friction · ditto"]
    D --> V["PROVEproof · roadtest · referee"]
    V --> C["CLEANunslop · janitor · frugal"]
    C --> H["SHIPcleared · runway"]
    H --> M["REMEMBERrecall"]
    B -. "architecture" .-> X["blueprint · headroom"]
    V -. "diagnose" .-> Y["sleuth · hotpath · harden"]

This is a map, not a mandatory chain. Most requests need one skill. Larger workflows compose only where the next specialist needs the previous one’s output.

Why this is different

Research-backed depth

Every skill received an individual research pass. Its provenance note records the lessons that changed behavior, where those lessons were encoded, rejected ideas, and knowledge that should be refreshed as the field moves. The research index keeps that evidence browseable without putting it into runtime context.

Specialist judgment

These are not “act like an expert” prompts.

• sleuth keeps competing hypotheses alive until an experiment separates them.
• headroom attaches a trigger metric to every scaling recommendation, and tells you what not to build yet.
• harden separates severity, confidence, exploit preconditions, and impact.
• unslop protects load-bearing weirdness instead of rewriting everything clean.
• frugal optimizes successful-task token cost, never raw token count.
• runway verifies the deployed fingerprint through the public URL, not the command’s exit code.

Progressive disclosure

Twenty-eight skills do not become one enormous system prompt. Discovery sees compact names and descriptions; the relevant SKILL.md loads on demand; only its necessary references or helper scripts load after that. This follows the Agent Skills specification.

Restraint is part of the product

Every skill says when not to use it, when to stop, what it cannot verify, and which actions need the user’s approval. No rewrite for activity. No security theater. No deploy that quietly becomes an infrastructure migration.

One portable core

The core is Markdown, self-contained skill folders, conditional references, small standard-library helpers, and explicit fallbacks. Richer runtimes can add browsers, web research, subagents, or GitHub access; missing capabilities reduce the evidence available, not the honesty of the answer. See the compatibility matrix.

Just talk normally

Still unsure? /concierge is the front door. The beginner-friendly skill chooser covers the rest.

The 28 specialists

Think

• concierge: inspect the project and route the smallest sufficient workflow.
• handsfree: stop babysitting the agent. Routine decisions are autonomous; only real human gates interrupt you.
• hotseat: stress-test an idea through seven genuinely different lenses.
• spelunk: map an unfamiliar repository without reading it blindly.
• scout: replace stale API memory with version-pinned evidence.
• distill: turn a vague request into a compact, executable brief.
• masterplan: produce vertical slices grounded in files that exist.
• recall: preserve decisions and expensive lessons without dumping transcripts.

Build

• pilot — execute an approved plan one verified slice at a time.
• backend — protect server contracts, data integrity, auth, jobs, and migrations.
• blueprint — document real architecture with diagrams that render.
• headroom — design for today, the next threshold, and eventual scale.

Experience

• polish — give interfaces hierarchy and character without generated-UI clichés.
• friction — find where real users hesitate, backtrack, or fail.
• ditto — recreate a reference UI through repeated visual comparison.

Prove

• proof — put regression protection at the cheapest boundary that catches the bug.
• roadtest — walk critical paths in a real browser and keep the evidence.
• sleuth — establish a causal chain before touching the fix.
• referee — review intent first, engineering quality second.
• hotpath — measure, change one thing, measure again, keep or revert.
• harden — reduce attack surface with scoped, evidence-backed findings.

Clean & publish

• unslop — remove accidental complexity in small behavior-preserving batches.
• janitor — keep Git history and the GitHub surface honest and navigable.
• frontpage — build READMEs from verified repository facts.
• findable — fix crawlability and metadata without ranking promises.
• frugal — cut context waste while keeping the quality gate fixed.

Ship

• cleared — issue a readiness verdict backed by fresh evidence.
• runway — deploy at the platform’s natural level and verify it live.

For inputs, outputs, neighbors, and research links for every skill, use the human skill guide. The generated skill index mirrors the frontmatter exactly.

Try the reproducible local failure gallery: a stale cache, an owner-boundary bug and duplicated payment effects, with retained failing seeds and correction checks. They demonstrate local behavior without claiming comparative skill superiority.

A few worth meeting properly

Install

Install the complete bundle:

npx skills add udaysharmadev/Skills --all

Choose skills interactively instead:

npx skills add udaysharmadev/Skills

The public full-bundle command was rechecked on 2026-10-14 with [email protected] in a disposable project: all 28 folders installed. Each selected local package was also installed independently with its resources and helper permissions checked. These are packaging checks; native host activation remains separate. Installation evidence.

Install just one owner:

npx [email protected] add udaysharmadev/Skills --skill sleuth --agent codex --copy --yes

The individual command’s shape was exercised against local package sources; the public bundle check used the default branch. Interactive selection has historical evidence only and was not re-exercised during this upgrade.

After installation, run:

/concierge

How the bundle stays lean

flowchart TD
    A["Agent starts"] --> B["28 names + descriptions are discoverable"]
    B --> C["Relevant skill activates"]
    C --> D["That skill's SKILL.md loads"]
    D --> E["Only necessary references, scripts, or assets load"]
    E --> F["Evidence-backed output or an explicit unverified gap"]

Each skills// folder works when copied alone. Runtime skills refer to neighbors by slug, never by repository-relative paths. The repository’s shared/ directory is for maintainers and validators, not a hidden runtime dependency. Read the architecture overview and handoff contract for the full model.

Research, not prompt folklore

The research notes separate four kinds of evidence: official truth, research evidence, implementation patterns, and community failure signals. Each note records what changed the skill and where the idea landed in runtime files. Fast-moving claims are marked for refresh; tempting but weak ideas are recorded when relevant instead of quietly returning later.

Browse the research provenance index.

Verified sources behind current decisions include WCAG 2.2, Core Web Vitals thresholds, EARS requirement syntax, the Knight Capital SEC findings, Playwright locator semantics, the git-bisect exit contract, Fowler’s expand/migrate/contract pattern, and Google’s code-review guidance. Each ledger records what was confirmed, what changed runtime behavior, and what was deliberately left unencoded.

Trust and safety

These skills can guide agents that edit code, run commands, browse external content, operate Git, and deploy systems. Destructive and high-blast-radius actions are explicitly gated; fetched content is treated as untrusted data; capability fallbacks state what could not be verified. The source is fully inspectable, but this bundle is not a security guarantee. See SECURITY.md.

Documentation

• Documentation home
• Which skill do I need?
• Workflow recipes
• Architecture
• Compatibility
• Maintainer evidence and historical audits

All 28 packages are present. The release report distinguishes structural checks, independent review, observed demonstrations and unverified live comparisons. The follow-up implementation record tracks later repairs on the current branch. No benchmark superiority is claimed here.

Contributing

Behavior changes need evidence, not another paragraph of generic “best practices.” Read CONTRIBUTING.md before opening a pull request.

MIT licensed. See LICENSE.