AgentToolHub
SkillClaude CodeCursorClineOpenClawWindsurfVS CodeChatGPT

cc-skill-security-review

AAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 2,115+ agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.

Features

  • ✓Local catalog search for project skills
  • ✓Agent-owned selection and manifest validation
  • ✓CLI for stack composition and plan persistence
  • ✓Workbench for review and evidence import
  • ✓Community-driven plugin and bundle support
  • ✓Visit GitHub for more tools and details

Installation Guide

For Codex and Claude, start with the AAS Core guide: configure the local MCP, ask the agent to inspect the project and choose exact IDs from the full catalog, review the proposed aas-stack.json, then run CLI validation and planning. The MCP and validation are read-only. Planning writes only the requested plan artifact; it does not materialize skill payloads or AAS managed state in the target.

Use direct installation when your host does not yet have a native AAS Core adapter, when you already know the exact skill IDs, or when you deliberately prefer manual selection:

  • Specialized plugins when the job has a clear domain.

  • Full library install when you want every skill available in a local skills directory.

  • Bundles and workflows when you want role-based recommendations or ordered execution playbooks.

    • From selection to use

    On unreleased main, aas stack install-preview --manifest <file> --destination <skill-directory> prepares a direct-installer dry run from the agent-selected IDs. It does not execute installation or choose skills; destination names must satisfy the installer's filename restrictions. See [the manifest handoff](docs/users/aas-core.md#use-the-reviewed-selection).

  • Describe the project outcome to Codex or Claude with the local AAS MCP configured.

  • Have the agent compare candidates and read the selected instructions and support files. Preserve the exact IDs in aas-stack.json and review their prerequisites.

  • Validate the manifest and review a CLI plan when you need an artifact-based check. Workbench can help inspect the artifacts.

  • For actual use, preview the supported direct installer with those same IDs, an exact release and the intended host directory. Review its own changes, then repeat without --dry-run when installation is authorized. Invoke the skill in a real task and keep the resulting check or artifact for reuse.

    • For example, after reviewing brainstorming and systematic-debugging for a Codex project, run from that project directory:

    bash
    npm exec --yes --ignore-scripts --package=agentic-awesome-skills@16.8.0 -- \
  agentic-awesome-skills --release 16.8.0 --path .agents/skills \
  --skills brainstorming,systematic-debugging --dry-run

    Replace the example IDs with the reviewed selection. The direct installer has its own preview and ownership format; it does not consume or apply a Core plan. Core apply/recovery remain experimental. [Worked cases](docs/users/workflows.md#recorded-worked-cases) show observed inputs and outputs without claiming guaranteed model performance.

    Direct skill install

    bash
    # Antigravity: preview an exact, agent-selected set before writing.
npx agentic-awesome-skills --antigravity --skills brainstorming,systematic-debugging --dry-run

# Antigravity CLI slash commands (agy): ~/.gemini/antigravity-cli/skills/<skill>/SKILL.md
npx agentic-awesome-skills --agy

    On main, the npm installer uses a shallow partial clone and checks out the canonical skills/ tree after verifying the cloned commit against the immutable gitHead recorded for that exact npm package version. Git 2.25+ is required. Plugin mirrors, documentation and app assets are excluded from that temporary checkout; every canonical skill and support file remains available. See the [measured distribution comparison](docs/maintainers/distribution-efficiency.md). If the GitHub tag moved or npm identity metadata is unavailable, installation stops before copying content. Use --tag main only when you intentionally accept a mutable, explicitly unverified repository ref.

    Antigravity watches ~/.agents/skills and may load enough installed instructions
    to exhaust its context, slow startup, trigger truncation errors, or enter a crash
    loop. For that target, the installer stops before cloning or writing unless you
    provide --skills, a metadata filter, or the explicit --all override. The bare
    npx agentic-awesome-skills command uses the same protected Antigravity target.

    The recommended flow is to ask Codex or Claude with the read-only AAS Core MCP
    configured to inspect the project, search the complete catalog, and choose exact
    skill IDs. The agent selects the IDs; AAS MCP validates them without installing; the agent
    or user then previews the direct installation with the command above and repeats
    it without --dry-run after review.

    Other direct-install targets retain the legacy-compatible full-catalog behavior
    when no selectors are supplied. The CLI prints the catalog's risk summary first:
    a full install includes critical and authorized-use-only offensive
    instructions. Installation copies files; it does not execute their commands,
    but an agent may act on an installed skill later. Prefer an exact reviewed set:

    bash
    npx agentic-awesome-skills audit --skills brainstorming,backend-dev-guidelines
npx agentic-awesome-skills --skills brainstorming,backend-dev-guidelines --dry-run

    If you deliberately accept the context and crash-loop risk, the complete
    Antigravity catalog remains available through explicit consent:

    bash
    npx agentic-awesome-skills --antigravity --all

    The audit reads the selected skill directories without executing them and
    reports command, network, credential, filesystem, privileged, destructive,
    symlink, and binary signals. It is a review aid, not a safety certificate. See
    [Security, trust, and antivirus alerts](docs/users/security-and-antivirus.md).

    Focused single-skill install with GitHub CLI (preview)

    GitHub CLI can preview and install one exact skill for Copilot and other supported hosts. Use an exact SKILL.md path in this large, mirrored repository so the selected source is unambiguous and discovery stays fast:

    bash
    gh skill preview sickn33/agentic-awesome-skills skills/brainstorming/SKILL.md
gh skill install sickn33/agentic-awesome-skills skills/brainstorming/SKILL.md \
  --agent github-copilot --scope user --pin v14.2.0

    gh skill support is currently a GitHub CLI preview and may change. Install a focused skill or plugin surface for the job; do not use --all unless you intentionally want every discovered canonical and mirrored skill.

    Verify the install

    bash
    test -d ~/.agents/skills && echo "Skills installed in ~/.agents/skills"

    Run your first skill

    text
    Use @brainstorming to plan a SaaS MVP.

    Prefer plugins for Claude Code, Codex, or another compatible client?

  • Use a specialized plugin when you want a focused marketplace-style distribution.

  • Use the full-library plugin only when you want the widest plugin-safe catalog.

  • Read [Plugins for compatible agent clients](docs/users/plugins.md) for host-specific installs, portable Agent Plugins bundles, and direct skills installs.

    • Reviews