Agent Skills 0.6.9 is a docs, hardening, and contributor-process release. No new skills this time; it sharpens the security and observability guidance in existing skills, adds setup and workflow docs, and lands a governance mechanism for the catalog's own development.

Highlights

• Advanced per-agent configuration guide (#316, @nucliweb). The canonical reference for keeping SKILL.md frontmatter portable and pushing vendor-specific runtime controls (model, tools, turn limits, thinking level) into metadata or a per-agent adapter, so the same skill file works across Claude Code, Cursor, Gemini, Antigravity, and other spec-conformant clients.
• Rejected skill-change ledger (#544, from #535). An append-only record of skill and description changes that were proposed and rejected, together with the eval score that rejected them, so the same idea does not get re-litigated in a new PR. Checking it is now a pre-flight step in CONTRIBUTING, and the ledger row lands on the default branch so closing the rejected PR cannot erase the record.

Hardening (existing skills)

• security-and-hardening: destructive path operations (delete, move, overwrite) now require symlink resolution, an allowlisted root, a minimum depth, and an ownership check read before the call (#547, @notbucki). And rate limiting must count in a shared store across instances, since a per-instance counter silently stops working the moment you run more than one instance (#536, @CahidArda).
• observability-and-instrumentation: when several entry points write to one log stream, stamp the entry point next to the correlation ID at the point the run starts. A correlation ID says which run; it does not say which code path started it (#546, @notbucki).

Docs

• Copilot: the standalone copilot CLI (plugin install) and Copilot inside VS Code are separate setups with different invocation models, now documented as such (#550, @DEOWL-kan, addressing #542).
• Lifecycle: the spec, plan, and task artifacts are the handoff between sessions. Run the whole lifecycle in one session for a small task; use a fresh session per phase for anything non-trivial (#549, @DEOWL-kan, from #513).
• Antigravity: the command-wrapper discoverability limitation is documented (#532, @ayobamiseun, from #445).
• Routing: database-migration and dependency-audit vocabulary added to the relevant skill descriptions (#537, @notbucki).

Thanks

Thanks to everyone who contributed this release: @nucliweb, @DEOWL-kan, @notbucki, @CahidArda, @ayobamiseun, @mvanhorn, and @federicobartoli.

Full Changelog: 0.6.8...0.6.9

Agent Skills 0.6.8 adds a new skill for setting and holding a project's quality bar, deepens the performance guidance with real backend and database substance, and clears a round of fixes.

First, a thank you. This repository just passed 90,000 stars. That is entirely down to the people who use these skills, file sharp issues, send careful PRs, and field-test them on real projects. Thank you, genuinely. This release is a good snapshot of that: a new skill, a large contribution from a collaborator, and a handful of fixes that came straight from your reports.

Highlights

• New skill: constraint-driven-development (#472). Establishes a project's quality bar as a written contract (CONSTRAINTS.md), interviews you on which dimensions matter, supplies sane defaults when you have no number in mind, maps every dimension to a de facto tool with install and run commands, and watches the diff for a weakened bar: new suppressions, skipped tests, stripped assertions, unimplemented stubs, thresholds edited down. It ships a reference floor-guard so agents enforce the floor the same way across runs and stacks instead of reinventing one each time. Thanks to @federicobartoli for a field-test-driven review that shaped it.
• performance-optimization, deepened (#521, @nucliweb). Real backend and database depth: reading the query plan before reaching for an index, when an index will not help, connection-pool exhaustion, and caching strategies (layer choice, key design keyed on the viewer, one invalidation strategy, stampede protection). Decision material in the skill, patterns and checklist in references/performance-checklist.md.

Skills and content

• performance-optimization now documents its Guard step (it was declared in the workflow but never written up), and a new validator rule enforces that any workflow advertising numbered steps documents each one (#525, @CBOSSX).
• planning-and-task-breakdown no longer silently overwrites an incomplete plan: if tasks/plan.md still has unchecked tasks for different work, it stops and asks rather than destroying state that may be mid-build in another session (#526, @ayobamiseun, from #518).

Fixes and tooling

• The code-reviewer persona now uses the same severity labels as the code-review skill (Critical / Required / Optional / Nit), so a finding is labeled the same whichever entry point runs the review.
• Validator: the section-exemption lookup uses Object.hasOwn, so a skill directory named constructor can no longer slip past the required-section checks via the prototype chain (#505, @abhisheksharma2411).
• OpenCode setup docs corrected for repo-scoped skill installation (#516, @alexmarco, closes #515).
• git-workflow-and-versioning picked up pull-request vocabulary so it routes for PR-phrased asks (#508, @superandy8288).

Thanks

Thanks to everyone who contributed this release: @nucliweb, @ayobamiseun, @CBOSSX, @abhisheksharma2411, @alexmarco, @superandy8288, and @federicobartoli. And thank you to the wider community for getting us past 90,000 stars.

Full Changelog: 0.6.7...0.6.8

Agent Skills 0.6.7 is a fixes-and-content release: a live Codex hook fix, honest plugin-manifest versions, a new provider, real skill-content additions, and a round of CI guards.

Highlights

• Codex SessionStart hook fixed (#474, @ayobamiseun). The session-start hook now emits the standard SessionStart envelope on every path, so Codex CLI (and Claude Code) stop rejecting it. Resolves the hook failure in #465.
• Plugin manifests now tell the truth about versions (#451, @Liyuk, closes #440). Every manifest is pinned to the release version, with a CI check that keeps them in lockstep with the tag, so update detection works and the versions can't silently drift again.
• Command Code is a native provider (#450, @vipulgupta2048). Command Code reads the pack's skills/ directly via cmd skills, so it's real support, not just a listing. See docs/commandcode-setup.md.
• Shared reference links fixed and guarded (#469, @coolTheWorld, closes #468). The skill links to the shared references/ checklists were wrong even in a full install; they now resolve, with a CI validator to keep them that way.

Skills and content

• spec-driven-development: a Phase 0 capability map for large, multi-capability requests, propose a module map and dependency order before speccing, while leaving the simple single-spec path untouched (#476, @ayobamiseun, from #431).
• planning-and-task-breakdown: the task-list target is now pluggable, so teams on an external tracker (beads, Jira, Linear) aren't forced into tasks/todo.md (#487, @ayobamiseun, closes #482).
• api-and-interface-design: an idempotency-key implementation guide, derive the key from the intent, not the attempt (#479, @abhisheksharma).
• security-and-hardening: a Data Privacy & Compliance section, classify data as you add it (#470, @HMAKT99).
• source-driven-development: retrieval safety, treat fetched docs as untrusted data and never hardcode outbound endpoints from examples (#53, @KoolP).

Tooling and fixes

• Codex install flow completed and plugin metadata aligned (#452, @dev-minggyu).
• Antigravity install path corrected for current agy releases (#481, @yunaremaia, from #445).
• Eval hardening: reject incomplete grader results (#473, @NgoQuocViet200), a more discriminating TDD case (#471, @federicobartoli), throwaway-workspace cleanup (#458) and --behavioral skill-name validation (#456, @Sunil56224972).
• New CI guards: artifact-path validator for spec/plan/todo (#464, @nucliweb) and Node 24 runtimes (#459, @ENNEADLABS).

Thanks

Thanks to everyone who contributed this release: @ayobamiseun, @Liyuk, @coolTheWorld, @vipulgupta2048, @HMAKT99, @abhisheksharma, @federicobartoli, @NgoQuocViet200, @yunaremaia, @dev-minggyu, @KoolP, @Sunil56224972, @nucliweb, and @ENNEADLABS.

Full Changelog: 0.6.6...0.6.7

Agent Skills 0.6.6 is primarily a fix release. It restores the four agent personas that were silently not loading on the Claude Code plugin, and rounds out the ecosystem-neutral pass and the performance-optimization workflow.

Highlights

• The four personas load again on Claude Code (#449, reported by @ingnicolaboccato-lab). The explicit agents array in .claude-plugin/plugin.json was suppressing Claude Code's own discovery of agents/*.md, so code-reviewer, security-auditor, test-engineer, and web-performance-auditor were loading for nobody on the plugin. Removing the key restores all four. Reproduced and verified on Claude Code 2.1.219: Agents (0) before, Agents (4) after. If you installed the plugin, update to pick this up. Scoped to the Claude Code manifest; the Codex manifest is unchanged.
• Verify step for performance work (#403, @asiridalugoda). performance-optimization gains an explicit keep-or-revert step: re-measure the same way you took the baseline, and if the change is within noise or fails its tests, revert it. Neutral is a revert, not a keep. It also adds a short ledger so a reverted optimization does not get silently retried later.
• Ecosystem-neutral pass completed (#425, @ayobamiseun). Phase 2 of #404 extends the work started in 0.6.5 across the rest of the catalog: skills describe the repository's own test, build, and audit commands with one concrete example, rather than hardcoding npm, so the guidance reads correctly on Python, Go, Rust, and the rest.

Tooling and fixes

• Regression coverage for the command validator, locking down command-parity behavior after the recent validator churn (#443, @ayobamiseun).
• Document the per-skill reference limitation from #361, so anyone installing a single skill knows the repo-level references/ directory does not travel with it (#442, @ayobamiseun).

Thanks

Thanks to everyone who contributed this release: @ingnicolaboccato-lab, @asiridalugoda, and @ayobamiseun.

Full Changelog: 0.6.5...0.6.6

Agent Skills 0.6.5 graduates the eval framework from opt-in to CI-enforced, hardens the validators, and kicks off an ecosystem-neutral pass so the skills stop assuming a JavaScript stack. Mostly a quality-and-infrastructure release on top of 0.6.4.

Highlights

• Eval gates are now trusted and enforced in CI (#381, @ZhiyaoWen999). The deterministic trigger-and-routing tier runs on every push with a rank-1 floor, the gates are ratcheted so routing quality can only move up, and dialogue evals are supported for skills whose deliverable is the conversation itself rather than a file edit. The framework shipped in 0.6.4; this is where it starts actually guarding the pack.
• Validators hardened (#387/#405, @kevglynn; #379, @nucliweb). The skill validator no longer trips over headings inside fenced code blocks or negated trigger phrases, and the lint rules were extracted into scripts/lib/skill-lint.js with their own tests so the rules are unit-tested instead of buried in the runner.
• Ecosystem-neutral pass, Phase 1 (#419, @ayobamiseun). test-driven-development no longer hardcodes npm; it describes the repository's own test command with one concrete example, so the guidance reads correctly on Python, Go, Rust, and the rest. This is the first skill in a broader pass.

Skills and content

• ADR skill now detects and matches an existing ADR convention before creating a new one, and stays repository-local and forge-agnostic (#402, @CybotTM).
• Fixed the orchestration-patterns reference mapping in the getting-started docs so the links resolve (#407, @Quantum22).

Tooling and fixes

• fix(hooks): opt-in hook paths are now quoted in the setup docs, so installs no longer break on paths with spaces (#420, @jagadishs-oss).
• fix(hooks): the simplify-ignore-test hook asserts its no-jq guard instead of failing when jq is absent (#406, @youjinch).

Docs

• The shared references/ design is now documented with its rationale, and the skill-local references/ directory is described as the emerging convention for self-contained skills (#401, @kevglynn; #236, @nucliweb; closes #329).
• New skill-gap issue form so people can report guidance that doesn't match reality in a structured way (#418, @Alex7develop).
• README spacing and copy tidy-ups (#107, @ZuoFuhong).

Thanks

Thanks to everyone who contributed this release: @ZhiyaoWen999, @nucliweb, @kevglynn, @ayobamiseun, @CybotTM, @Quantum22, @jagadishs-oss, @youjinch, @Alex7develop, and @ZuoFuhong.

Full Changelog: 0.6.4...0.6.5

Agent Skills 0.6.4 adds two big pieces, an in-repo skill eval framework and native Codex support, alongside a security-hardening pass, real skill-content additions, and a wave of adoption and contributor docs.

Highlights

• Skill eval framework (#342). A three-tier system that checks the pack actually works: structural validation, a deterministic trigger-and-routing tier that runs in CI (does each skill's description carry the words users say, and do any two skills collide), and an opt-in behavioral tier that grades a real execution trace against per-skill expectations. Neither of the packs we get compared to ships this in-repo.
• Native Codex support (#88). Install as a Codex plugin with codex plugin marketplace add addyosmani/agent-skills; the root skills/ directory is read directly through .codex-plugin/plugin.json, no duplication.
• Fastest install path in the README. npx skills add addyosmani/agent-skills now leads the Quick Start, one command across 70+ agents, with per-skill installs for the headline skills.
• Supply-chain hardening (#392). The dependency guidance is now package-manager and version aware, with an install-script gate that blocks unreviewed lifecycle scripts before the first install, the exact hole the recent npm postinstall worms used.

Skills and content

• Dependency-upgrade workflow added to code-review-and-quality (#346, @HMAKT99).
• Database expand/contract schema migrations added to deprecation-and-migration (#345, @HMAKT99).
• Frontend and performance descriptions now carry the vocabulary users actually type; trigger rank-1 rate up to 86% (#358, @ZhiyaoWen999).
• Playwright examples switched to accessibility-first role and label locators (#359, @debs-obrien).

Tooling and fixes

• Harden the eval and command validators for CRLF and Windows line endings, plus a fixture path-traversal guard (#372, @ShiroKSH).
• webperf config note: keep CrUX API keys in environment variables, never hard-coded (#357, @orbisai0security).
• Document the HTTPS git-config workaround for /plugin install SSH failures on Windows and macOS (#368, @mvanhorn).

Docs

• New adoption guide: greenfield vs brownfield rollout, with a verification-first path for established codebases (#396, @nucliweb).
• New developer-onboarding guide for people working on the repo itself (#397, @nucliweb).
• Cursor setup modernized for native .cursor/skills (#218, @nguyenducthaonguyen).
• comparison.md refreshed and expanded with a fuller "how to decide" section; no-translations policy documented (#375, @nucliweb); AGENTS.md and CLAUDE.md clarified as repo-scoped (#374, @nucliweb); a Team section added to the README.

Thanks

Thanks to everyone who contributed this release: @nucliweb, @federicobartoli, @HMAKT99, @ZhiyaoWen999, @ShiroKSH, @mvanhorn, @nguyenducthaonguyen, @debs-obrien, and @orbisai0security.

Full Changelog: 0.6.3...0.6.4

Agent Skills 0.6.3 sharpens code review, adds two new reference checklists and an honest comparison doc, and introduces a set of guardrails that steer new-skill work away from duplication, plus a wave of community fixes and polish.

Highlights

• Deeper code review. code-review-and-quality gains structural-depth lenses (reduce-don't-relocate, a named Structural Remedies catalog, a file-size gate, and finding prioritization), and its severity labels now line up with the skill's own taxonomy. (#304, #302)
• Two new reference checklists. An observability checklist (on-call questions, RED/USE metrics, symptom-based alerting) and a project-wide Definition of Done. (#240, #317)
• How it compares. A new docs/comparison.md puts agent-skills side by side with Superpowers and Matt Pocock's skills, with a link to a controlled head-to-head. (#300)
• Guardrails against duplicate skills. A CONTRIBUTING pre-flight checklist, a path-scoped .claude/rules/ guardrail, a PR-overlap guideline, and validator/CI upgrades that enforce naming, description triggers, and command-description parity. (#301, #313, #325, #323, #270, #255)

Skills, commands & references

• git-workflow-and-versioning: add release and versioning guidance (semver, tags, changelog). (#334, @HMAKT99)
• spec-driven-development now delegates task mechanics to planning-and-task-breakdown. (#303, @nucliweb)
• planning: document the tasks/plan.md and tasks/todo.md output paths. (#337, @hiyochi)
• browser-testing: default to an isolated profile. (#239, @federicobartoli)
• debugging: fix the step range. (#293, @shihyuho)

Fixes & polish

• Use repo-relative script paths (drop the old /mnt/skills/user/ form). (#307, @creazyfrog)
• Fix the Gemini /ship agent path. (#306, @creazyfrog)
• Explain the expected "commands/ ignored" plugin warning, and clear the underlying lint without breaking Antigravity. (#305, @creazyfrog; #273, @CollabxConstruct)
• Antigravity code-simplify reads AGENTS.md. (#288, @Dashsoap)
• Make helper scripts executable. (#289, #276, @Dashsoap)
• hooks.json path fallback for manual installs. (#269, @worldfunction4)
• Move agents/README.md to docs/agents.md to fix a custom-agent frontmatter warning. (#260, @nucliweb)

Docs & CI

• Document the /webperf command and setup. (#247, @Bortlesboat; #268, @CooperSheroy)
• README and getting-started tidy: list orchestration-patterns, add code-simplify. (#290, #283, @Dashsoap)
• Standardize actions/checkout to v6. (#275, @Dashsoap)

Thanks

Big thanks to everyone who contributed this release: @nucliweb, @federicobartoli, @HMAKT99, @Dashsoap, @creazyfrog, @An-idd, @Swing-G, @hiyochi, @shihyuho, @Bortlesboat, @CooperSheroy, @CollabxConstruct, and @worldfunction4.

Full Changelog: 0.6.2...0.6.3

What's Changed

• fix(marketplace): use relative path source to bypass install bug by @git-clone-abhinav in #163
• docs(copilot): fix agent file naming — use *.agent.md extension by @creazyfrog in #183
• docs: route all lifecycle skills from meta-skill by @superShen0916 in #186
• fix: update marketplace.json to use explicit GitHub source format by @addyosmani in #215
• Strengthen security skills: threat modeling, SSRF, supply chain & AI/LLM by @addyosmani in #219
• fix(browser-testing): correct chrome-devtools-mcp install config by @nucliweb in #221
• feat(build): add /build auto for a one-pass plan + implement by @addyosmani in #220
• feat(agents): add web-performance-auditor persona and /webperf command by @nucliweb in #222
• feat: add observability-and-instrumentation skill by @federicobartoli in #223
• feat: add native support for Antigravity CLI (agy) by @hk1997 in #227

New Contributors

• @git-clone-abhinav made their first contribution in #163
• @superShen0916 made their first contribution in #186
• @hk1997 made their first contribution in #227

Full Changelog: 0.6.1...0.6.2

What's Changed

• Fix: Add guidance to prevent redundant build verification commands by @sbusanelli in #70
• fix(plugin): declare skills and agents paths in plugin.json by @creazyfrog in #114
• docs: list using-agent-skills in README by @aqilaziz in #142
• test: add session-start JSON regression coverage by @Bortlesboat in #132
• Add doubt-driven-development skill by @federicobartoli in #139
• docs: clarify README skill count by @MiladZarour in #159
• fix(spec-driven-development): add explicit cross-skill paths by @245678000000 in #169
• docs(skills): tighten frontmatter for idea-refine and browser-testing-with-devtools by @spboyer in #174
• docs: clarify when skills should include scripts/ by @toby-bridges in #170
• fix(#75): Docs inconsistency: conflicting skill description and anatomy guidance by @toby-bridges in #167
• feat: add interview-me skill (during the Define phase) by @addyosmani in #164
• Add CI skill validator by @googlarz in #60
• feat(interview-me): add reason to low-confidence numbers by @danielart in #187
• fix(#145): drop pinning version field from plugin.json by @felixlogotel in #189

New Contributors

• @devmarkpro made their first contribution in #108
• @sbusanelli made their first contribution in #70
• @creazyfrog made their first contribution in #114
• @aqilaziz made their first contribution in #142
• @Bortlesboat made their first contribution in #132
• @MiladZarour made their first contribution in #159
• @245678000000 made their first contribution in #169
• @spboyer made their first contribution in #174
• @toby-bridges made their first contribution in #170
• @googlarz made their first contribution in #60
• @danielart made their first contribution in #187
• @felixlogotel made their first contribution in #189

Full Changelog: 0.6.0...0.6.1

Agent Skills 0.6.0

This is an orchestration release. Personas, skills, and slash commands now compose as three explicit layers, and /ship runs three specialist personas in parallel against the current change before synthesizing a go/no-go decision. New tool integrations land for Gemini CLI, Kiro, and OpenCode, and source-driven-development gains an opt-in citation cache.

Orchestration

Three composable layers, defined in AGENTS.md and worked through in references/orchestration-patterns.md:

• Personas - roles with a perspective and an output format (the who)
• Skills - workflows with steps and exit criteria (the how)
• Slash commands - user-facing entry points (the when)

Composition rule: the user (or a slash command) is the orchestrator. Personas do not invoke other personas.

• Turned /ship into a parallel fan-out orchestrator that runs code-reviewer, security-auditor, and test-engineer concurrently and merges their reports
• Replaced /ship's hand-wavy skip-fan-out rule with concrete thresholds (≤2 files, <50 lines, no auth/payments/data/config)
• Added a Composition block to each persona file documenting how it composes with skills
• Added a personas index (agents/README.md) with a composition decision matrix
• Added an orchestration patterns catalog (references/orchestration-patterns.md)
• Added an Agent Teams worked example for competing-hypothesis debugging
• Documented Claude Code subagent and Agent Teams compatibility, including how skills, mcpServers, and permissionMode frontmatter are handled (silently dropped when used as teammates)
• Corrected Agent Teams system-prompt handling — appended, not replaced
• Noted /ship picks up user-defined personas in .claude/agents/ and ~/.claude/agents/ automatically (plugin scope is lowest priority)

New Tool Integrations

Gemini CLI

• Added 7 slash commands under .gemini/commands/ (/spec, /planning, /build, /test, /review, /code-simplify, /ship) mirroring the Claude Code set
• Used /planning instead of /plan to avoid colliding with a Gemini CLI internal command
• Documented the commands in docs/gemini-cli-setup.md

Kiro IDE & CLI

• Added Kiro to the README quick start with setup details and link formatting

OpenCode

• Added a symlink so OpenCode resolves skills correctly out of the box

Hooks

Source-Driven Development citation cache

• Opt-in citation cache so framework-doc lookups don't repeat across sessions

Session-start JSON robustness

• Properly JSON-escape SKILL.md content via jq — fixes invalid JSON when content contains quotes or newlines
• Gracefully fall back with an INFO-priority message when jq is missing on PATH instead of failing silently

Skill Improvements

Frontend UI Engineering

• Fixed button accessibility guidance ([#58](#58))
• Aligned the custom button example with native Space activation timing ([#79](#79))
• Prevented the custom button example from teaching a scrolling interaction bug

Accessibility Checklist

• Skip-to-content link must be visible on focus ([#54](#54))
• Added autocomplete requirement for known fields in forms ([#55](#55))

Performance Checklist

• Expanded INP coverage with concrete optimization techniques ([#84](#84))
• Added a fonts section and the yieldToMain pattern ([#63](#63))

Skill Contribution Guidance

• Aligned skill-contribution guidance across CLAUDE.md, AGENTS.md, docs/skill-anatomy.md, and the README — preserved third-person description guidance and corrected README formatting

Contributors

Thanks to everyone who landed changes in this release:

• [@monraza](https://github.com/monraza) — Gemini CLI slash commands
• [@ltianyi992](https://github.com/ltianyi992) — session-start JSON escape fix
• [@datfinesoul](https://github.com/datfinesoul) — OpenCode skills symlink
• [@federicobartoli](https://github.com/federicobartoli) — source-driven-development citation cache
• [@nucliweb](https://github.com/nucliweb) — INP checklist + fonts/yieldToMain
• [@shaun0927](https://github.com/shaun0927) — button Space preventDefault fix
• [@MarkADom](https://github.com/MarkADom) — skill contribution guidance alignment
• [@yaphi1](https://github.com/yaphi1) — button accessibility guidance fix
• [@BogdanCerovac](https://github.com/BogdanCerovac) — skip-to-content + autocomplete
• [@Keerthi-Sreenivas](https://github.com/Keerthi-Sreenivas) — Kiro IDE/CLI

Full Changelog: 0.5.0...0.6.0