Addy Osmani's Skills Repo Passes 97,000 Stars at Anthropic

Addy Osmani's agent-skills repository passed 97,000 stars on GitHub this week, gaining 556 of them on Sept. 19 alone, seven months after he first published it and 11 days after he left Google to join Anthropic as a Member of Technical Staff working on Claude Code, according to his own biography page.

The repository packages 25 markdown-based skills covering a software project's lifecycle, from a single meta-skill that routes work to the right process, through five "Define" skills, seven "Build" skills and five "Ship" skills, according to the repository itself, which Osmani created on Feb. 15, 2026, with collaborators Federico Bartoli and Joan León. It ships under the MIT license and installs with a single command, npx skills add addyosmani/agent-skills, that copies the chosen skill's markdown file into a project rather than running any code from it.

What loading a skill actually does

According to the project's own getting-started guide, "each skill is a Markdown file (SKILL.md) that describes a specific engineering workflow," and an agent that loads one follows the instructions in its context window rather than executing a script. Using a skill can still write files to a project, such as SPEC.md from the /spec command and tasks/plan.md from /plan, but the mechanism is instructions read by a model, not a binary run on a developer's machine.

The repository's README states its reason for existing plainly: AI coding agents "default to the shortest path, which often means skipping specs, tests, security reviews, and the practices that make software reliable." The skills attach named engineering principles to specific lifecycle phases: Hyrum's Law and the One-Version Rule inside the API and Interface Design skill under Review, the Beyonce Rule inside Test-Driven Development under Verify, Chesterton's Fence and the Rule of 500 inside Code Simplification, and trunk-based development inside the Git Workflow skill under Ship.

ClawHub, one of the two marketplaces Snyk scanned, is the plugin and skill marketplace built around OpenClaw, the open-source agent framework that passed 388,000 GitHub stars this month. That distinction matters because of what Snyk found five weeks before Osmani published his repository. On Feb. 5, 2026, Snyk's ToxicSkills research reported that of 3,984 skills scanned across the ClawHub and skills.sh marketplaces, 1,467, or 36.82 percent, carried at least one security flaw, 534 carried a critical one, and 76 contained confirmed malicious payloads built for credential theft or backdoor installation, with 8 of those still live on ClawHub as of publication. Six Snyk researchers, led by Luca Beurer-Kellner and Liran Tal, wrote that daily skill submissions to the two marketplaces had jumped from under 50 in mid-January to more than 500 by early February. The Terminal covered a related finding on Sept. 19: three of the largest skills collections, Osmani's among them, have amassed a combined 651,668 stars even as an ETH Zurich study found the same genre of markdown file can make coding agents perform worse while still adding to the inference bill.

The listing Snyk's own scanner marked clean

Osmani's collection is not outside that ecosystem. It is listed on skills.sh, one of the two marketplaces the Snyk audit scanned, where the meta-skill shows 35,800 installs and three passing security-scan badges: Snyk, Socket and Gen Agent Trust Hub. That is a live, specific answer to the question the February audit could only pose statistically across thousands of listings at once, and a different kind of scrutiny than the cost and coverage gaps a rival's blind test found in Cloudflare's own viral security-audit skill earlier this month. It also means Osmani's repository, unlike the two other names that reach comparable scale in this space, has a scan result attached to it rather than only a star count.

Repository	GitHub stars	Created	License
obra/superpowers	288,831	Oct. 9, 2025	MIT
mattpocock/skills	265,820	Feb. 3, 2026	MIT
addyosmani/agent-skills	97,017	Feb. 15, 2026	MIT

What a scan badge doesn't cover

A passing scan on one listing is not a guarantee about the other 24 skills in the same repository, since Snyk's public writeup does not itemize which individual skills within a given collection it tested, only aggregate figures across the marketplaces. Snyk's own February post also did not name addyosmani/agent-skills, obra/superpowers or mattpocock/skills specifically, so there is no public record of whether the other two repositories carry the same kind of scan result, or whether their listings were among the 1,467 flagged.

Osmani's repository still asks a developer to trust markdown instructions written by three named people rather than code with a defined execution boundary, which is a smaller attack surface than a skill that runs a script, but not a zero one: a workflow document that tells an agent to run curl against an attacker-controlled URL, delete a directory, or exfiltrate an environment variable would read the same as any other instruction to the model executing it. Neither Osmani's documentation nor the marketplace listing describes a review process for what the skills instruct an agent to do beyond the three automated scans already listed.

The repository's own issue tracker shows the more mundane failure mode is still unresolved. In issue #542, opened Sept. 2, 2026, a user running GitHub Copilot in VS Code wrote that after installing with the documented npx skills add addyosmani/agent-skills command, "I can't find any commands in my agent, such as: /spec, /plan, /build, /test." The issue carries an enhancement label and no recorded maintainer response as of Sept. 20. What would change this assessment is Snyk publishing which specific listings it tested, rather than a marketplace-wide percentage, and Osmani's team closing the gap between what the install command promises and what a Copilot user actually gets.