claude-skills: 345 Agent Skills Built to Keep Python Sandboxed and Auditable

Project overview

claude-skills is an open-source, MIT-licensed repository that packages domain expertise into self-contained skill folders — each with a SKILL.md playbook, optional Python CLI tools, reference documents, and template assets. The library currently advertises 345 skills, 78 plugins, and 90-plus slash commands across 17 domains: engineering, product, marketing, compliance, finance, and research among them. It targets 13 AI coding agents including Claude Code, OpenAI Codex, Gemini CLI, Cursor, Hermes Agent, Mistral Vibe, Aider, Windsurf, Kilo Code, OpenCode, Augment, Antigravity, and OpenClaw.

The security framing matters because these skills instruct agents to run Python on your local machine. The repository enforces a strict stdlib-only rule — no pip dependencies, no external services, no API keys. That design choice narrows the attack surface: every script depends only on Python's standard library, so a reviewer can read a file end to end and know its full import graph. The SECURITY.md file reinforces this with explicit DO and DON'T lists covering eval(), shell execution, credential storage, and directory traversal.

From a tooling perspective, the project also ships a growing set of security-relevant skills. The agent-decision-receipts skill produces tamper-evident, post-quantum-signed receipts for consequential agent actions, explicitly mapped to EU AI Act Article 12. The zero-hallucination-coder skill enforces a Discuss → Map → Decompose → Execute → Verify loop with a YAGNI ladder to prevent invented APIs or placeholder imports. The named-persona-adversarial-review skill routes code review through sourced engineering philosophies with confidence-level attribution and an anti-fabrication rule for quotes.

Why it is trending now

• 611 period stars at trending rank 10, driven by the breadth of 345 skills across 17 domains for 13 different AI coding agents.
• Zero-dependency, stdlib-only Python constraint means every script is self-contained and auditable without resolving a dependency tree.
• Installation is two commands on Claude Code: `/plugin marketplace add alirezarezvani/claude-skills` then `/plugin install engineering-skills@claude-code-skills`.
• Recent merges added accountability-oriented skills — agent-decision-receipts with post-quantum signing, zero-hallucination-coder, and named-persona-adversarial-review — all documented in CHANGELOG.md.
• Per-domain counter validation via `scripts/derive_counters.py --check` now catches drift between the README skills table and on-disk SKILL.md counts, closing a silent accuracy gap in CI gate G3.

Problem it solves

• AI coding agents increasingly execute Python on developer machines, but most plugin ecosystems pull transitive pip dependencies that are hard to audit line by line.
• Teams lack a portable standard for giving agents domain-specific playbooks — security review, compliance audits, code review — without re-explaining standards in every prompt.
• Consequential agent actions (deployments, data access, infrastructure changes) rarely produce auditable receipts tied to regulatory frameworks like EU AI Act Article 12.
• Code generated by agents can introduce invented APIs, phantom imports, or placeholder logic that compiles but fails at runtime, with no structured verification step.

How it works

1. Each skill is a folder with a SKILL.md playbook, optional scripts/ directory of Python CLI tools, references/ for curated knowledge, and assets/ for templates.
2. On Claude Code, you add the marketplace and install individual plugins; on Codex you run `npx agent-skills-cli add alirezarezvani/claude-skills --agent codex`; on Gemini CLI you clone and run `./scripts/gemini-install.sh` or `python3 scripts/sync-gemini-skills.py`.
3. Python scripts follow strict conventions: stdlib-only imports, argparse with --help and --json flags, exit codes 0/1/2, and no network calls or credential access.
4. Skills with `allowed-tools` in YAML frontmatter are restricted to only those tools — for example `allowed-tools: Read, Grep, Glob` prevents file writes or command execution.
5. The agent-decision-receipts skill uses a stdlib manifest builder and delegates signing to the Apache-2.0 openagentontology package (an opt-in install), producing tamper-evident receipts for each consequential action.

Who should pay attention?

Risks and cautions

• SECURITY.md defines severity levels with response timelines: Critical (24-48 hours for RCE, unauthorized data access, privilege escalation), High (1 week), Medium (2 weeks), Low (1 month).
• Users are instructed not to open public GitHub issues for vulnerabilities — reports go through alirezarezvani.com contact form or Medium private message.
• The allowed-tools frontmatter field restricts each skill to specific capabilities, e.g. `allowed-tools: Read, Grep, Glob` blocks writes and command execution.
• Python scripts must follow secure coding practices: input validation, parameterized queries, no eval() or exec() with user input, no shell commands with unsanitized input, no credential storage in code.
• The repository provides a safe_read_file example that validates filenames with regex, prevents directory traversal, and confines reads to a safe directory.
• Supported versions: 1.x.x receives active support; versions below 1.0 are unsupported. All skills are currently at version 1.0.0.

Alternatives to compare

What this trend reveals