{ "owner": "ssheleg", "defaultAgents": [ "cursor", "opencode", "kilo", "kimi-code-cli", "hermes-agent", "codex", "gemini-cli", "windsurf", "zed", "kiro-cli", "goose" ], "providerContract": { "version": 1, "note": "The ONE versioned provider-resolution contract every consumer reads — toolkit, make-skill, the runtime shadow guard and update (FIX-UP-07.03). A consumer resolves a skill's active provider by THIS shape, not by importing a sibling consumer's runtime: no consumer depends on another's code, so a stale-plugin/fresh-hub digest mismatch surfaces IDENTICALLY everywhere. resolveProviders() in bin/sshlg-skills.js is the reference implementation; a version bump is a breaking change every consumer must re-read.", "keyFields": [ "host", "scope", "skillId" ], "states": [ "active", "installed-not-enabled", "none" ], "precedence": [ "n/a", "UNKNOWN" ], "activeShape": [ "realpath", "digest", "version", "namespace", "loaded" ], "mismatchSignal": "when two installed+enabled candidates share a (host, scope, skillId) but differ in digest, state stays 'active' and precedence is 'UNKNOWN' — the shadow. A stale plugin beside a fresh hub copy is this case, and every consumer reads it the same way." }, "skills": [ { "name": "super-ux", "repo": "ssheleg/super-ux", "dir": "skills/super-ux", "skillNames": [ "vision", "ux-foundation", "ux-flows", "ux-scenarios", "ux-audit", "brand-voice", "copywriting" ], "pluginMarketplace": "ssheleg/super-ux", "pluginInstall": "super-ux@super-ux", "desc": "Scenario-driven UI development: a versioned design chain in docs/ux/ — the product vision, personas and jobs, user flows and the paid-acquisition funnel among them, a screens-and-states map with Figma frames, traced scenarios, evidence-backed audits, fix plans — plus docs/brand/, the verbal identity: one voice, per-surface registers, a string registry and a 41-check copy linter. /ux and /brand entry points, two doc-drift linters and a contract doctor.", "version": "0.66.3", "entry": "/ux", "role": "what the interface must do", "npm": "super-ux", "shape": "static", "shapeWhy": "The chain is fixed — foundation, flows, screens, scenarios — and every layer is a committed file. `/ux-audit` batches on the fly, and the batch list is printed before the run so what executed is recoverable.", "commit": "7807c66184c647db349145c1cb2a322d2a522250" }, { "name": "task-pipeline", "repo": "ssheleg/task-pipeline", "dir": "skills/task-pipeline", "pluginMarketplace": "ssheleg/task-pipeline", "pluginInstall": "task-pipeline@task-pipeline", "desc": "Full-cycle delivery orchestrator: an intake grill turns the request into a complete brief, then ten gated stages carry it from docs to acceptance, refusing to advance until each gate passes. Ships `project-audit`: a cold-start audit of a whole project — discovery, a probe registry whose unmet needs read as `blind` rather than clean, production evidence including one artefact served under two channels, and an HTML report beside a JSON sidecar that says what moved since the last run. Read-only.", "skillNames": [ "task-pipeline", "evidence-docs", "project-audit" ], "version": "1.102.4", "entry": "/task-pipeline", "role": "how a change reaches the repository", "npm": "task-pipeline-skill", "shape": "static", "shapeWhy": "The stage list is decided before the run and stays decided, because stage 10 has to account for what ran. THREE places discover structure, and they do not land the same way: the module map and the carry-over ledger are committed artifacts, and since v1.69.0 the work graph is a third — `.task-pipeline/graph.json`, mutated mid-run by `graph.py add` and deliberately NOT committed. Every mutation records why it happened, which is what keeps a run from explaining its completion by a plan that existed only at the end; that the graph itself does not survive the run is an open row rather than a settled decision.", "commit": "b02dc1269281c9a245a922365f78ffb14cb4bab1" }, { "name": "agent-sync", "repo": "ssheleg/agent-sync", "dir": "skills/agent-sync", "pluginMarketplace": "ssheleg/agent-sync", "pluginInstall": "agent-sync@agent-sync", "desc": "Coordination plane for concurrent agents: leases with a TTL so two agents cannot claim the same work, race-free id reservation, a run journal and a generated board, over a pluggable knowledge cloud.", "skillNames": [ "agent-sync" ], "version": "1.23.5", "entry": "/agent-sync", "role": "who is holding this file right now", "npm": "@ssheleg/agent-sync", "shape": "static", "shapeWhy": "Leases, ids and the journal are a fixed protocol; what varies is who holds what, which is state rather than shape.", "commit": "c286eb6d9db3a73cc42f6668539c43bcee11dab0" }, { "name": "make-skill", "repo": "ssheleg/make-skill", "dir": "skills/make-skill", "pluginMarketplace": "ssheleg/make-skill", "pluginInstall": "make-skill@make-skill", "desc": "A skill that builds skills: create, retrofit, audit and publish agent skills and Claude Code plugins — Agent Skills standard conformance, marketplace layout, version sync, validator + CI, every distribution channel, MCP and A2A rules — plus skill-search, the first step that finds the installed skill a task needs.", "skillNames": [ "make-skill", "skill-search" ], "version": "0.33.5", "entry": "/skill-audit", "role": "how the skill or plugin itself is built", "npm": "@ssheleg/make-skill", "shape": "static", "shapeWhy": "The standard is a checklist and the audit walks it in order; a skill that passes is auditable against the same list next time.", "commit": "1a214b073c7d74905b77aca9d687af3362934c7b" }, { "name": "sheleg-design", "repo": "ssheleg/sheleg-design-skill", "dir": "skills/sheleg-design", "pluginMarketplace": "ssheleg/sheleg-design-skill", "pluginInstall": "sheleg-design@sheleg-design-skill", "desc": "The taste layer: cinematic scroll-driven landing pages (one scroll clock, motion that degrades to calm, WebGL particle formations), product-UI style packs with a ready token layer each, and the Figma border — tokens as variables, design to code.", "skillNames": [ "sheleg-design" ], "version": "1.66.5", "entry": "/sheleg-design", "role": "how it looks and moves", "npm": "sheleg-design-skill", "shape": "static", "shapeWhy": "Packs and tokens are chosen, not discovered. The choice is recorded in the pack, so a second run reproduces the first.", "extraLinks": [ { "label": "Browse all {n} style packs", "url": "https://ssheleg.github.io/sheleg-design-skill/", "countGlob": "plugins/sheleg-design/skills/sheleg-design/styles/*.md", "countExclude": [ "STYLE_PACK_TEMPLATE.md" ], "note": "the catalogue, rendered from each pack's own token layer — a data surface too large for this page, kept where it is built" } ], "commit": "0f3c7701eae79f99526a8b892ee880901a568f8b" }, { "name": "seo-aeo-audit", "repo": "ssheleg/seo-aeo-audit", "dir": "skills/seo-aeo-audit", "pluginMarketplace": "ssheleg/seo-aeo-audit", "pluginInstall": "seo-aeo-audit@seo-aeo-audit", "desc": "Evidence-first website audit for search and answer engines: ten tracks from crawl access to AI citation mechanics, every finding backed by an observation and every recommendation tiered, ending in a prioritized change plan and a link-building brief.", "skillNames": [ "seo-aeo-audit" ], "version": "0.32.4", "entry": "/seo-aeo-audit", "role": "whether a machine will find it", "npm": "@ssheleg/seo-aeo-audit", "shape": "static, with a bounded discovery", "shapeWhy": "The ten tracks are fixed; **which** are in scope is decided per site at step 0 and written into the report, so the executed set is recoverable. An eleventh pass (Discover) is added by a stated condition, never by taste.", "commit": "993aa5135c29feb3dfac5df671dde3cc94889c7c" }, { "name": "sheleg-dev", "repo": "ssheleg/sheleg-dev", "dir": "skills/sheleg-dev", "pluginMarketplace": "ssheleg/sheleg-dev", "pluginInstall": "sheleg-dev@sheleg-dev", "desc": "The integration layer a product reaches once it has users: Stripe subscription billing reconciled into your own database — checkout, renewals, seats and proration, refunds, claim-first webhook idempotency, reconciliation and price drift; crypto payments that survive under-payment, duplicate webhooks and rate drift; GA4/Ads/Meta/LinkedIn under Consent Mode v2; Google sign-in with the account pre-hijacking guard, and the server-side Google auth surface; Core Web Vitals work that moves the score, and Sentry error tracking wired so it does not forward your own credentials to a third party and so a stack trace names the commit that caused it.", "skillNames": [ "stripe-billing", "crypto-payments", "error-tracking", "ad-tracking", "google-signin", "google-auth", "frontend-performance" ], "version": "0.16.3", "entry": null, "role": "integrations: money in, tracking, errors, sign-in, speed", "npm": "@ssheleg/sheleg-dev", "shape": "static", "shapeWhy": "Each integration is a fixed sequence of seams; nothing decides its own next step.", "commit": "916b683a896ce429ac3fa89a7a8514d9104aad4a" }, { "name": "agent-stack", "repo": "ssheleg/agent-stack", "dir": "skills/agent-stack", "pluginMarketplace": "ssheleg/agent-stack", "pluginInstall": "agent-stack@agent-stack", "desc": "Production patterns for AI agent systems, in four skills. The orchestrator: tool-calling loops that survive context pressure, pipelines with human checkpoints and resume, provider routing with fallback and health checks, four memory layers with confidence decay, and the shape of the work as a graph — an edge that carries no data is no edge, and a parallel layer gets a checker before the node that consumes it. The harness: what the agent is TOLD — system prompts, tool descriptions, technique choice, workflow versus agent, static versus dynamic, plus a seven-track audit of somebody else's agent and a scanner for the defects that are mechanically visible. The evals: suites that measure whether it actually works. The interop layer: MCP 2026-07-28 and what it deprecated, A2A 1.0, the registry, the gateway. Plus the wallet side of reselling LLM access.", "skillNames": [ "agent-orchestrator", "agent-evals", "agent-interop", "agent-harness" ], "version": "0.31.4", "entry": null, "role": "orchestration, prompts, evals, protocols, and the LLM wallet", "npm": "@ssheleg/agent-stack", "shape": "static", "shapeWhy": "Reference material, not a run. What varies is which reference a task loads, which the SKILL.md table decides in advance.", "commit": "52b0584dbe3a10468072fe0a642ff2d414d66544" }, { "name": "telegram-dev", "repo": "ssheleg/telegram-dev", "dir": "skills/telegram-dev", "pluginMarketplace": "ssheleg/telegram-dev", "pluginInstall": "telegram-dev@telegram-dev", "desc": "Telegram, split by the API each surface actually speaks, in three skills. telegram-bots covers the official HTTP Bot API: update_id as the only idempotency key an update carries, the allowed_updates default that subscribes you to everything except chat_member and the two reaction types while returning ok, the webhook secret header that is the real check, rate limits as a design constraint rather than an error path, and Telegram Stars with a ten-second pre-checkout window and the grant that belongs to successful_payment. telegram-userbots covers MTProto and Telethon: the session file as a credential equal to the password, FloodWaitError as the API telling you exactly how long to wait, pinning across minor releases that move session and entity-cache behaviour, and the account-ban risk a bot token does not carry — opening with whether a user account is needed at all. telegram-miniapps covers the web layer, whose entire security model is one signed query string: verifying initData server-side, the auth_date window, the Ed25519 path for a third party, and the SDK package whose name moved. Both the verifier and the delivery invariants ship as runnable fixtures with their mutants.", "skillNames": [ "telegram-bots", "telegram-userbots", "telegram-miniapps" ], "version": "0.5.4", "entry": null, "role": "which Telegram API each surface speaks, and what each one costs", "npm": "@ssheleg/telegram-dev", "shape": "static", "shapeWhy": "Three fixed surfaces with fixed seams; the only branch is which of the three a task is on, and the first table in each SKILL.md decides that before any code.", "commit": "d064a936d6c45a9d738942e3973269c90e1f18f5" }, { "name": "xr-dev", "repo": "ssheleg/xr-dev", "dir": "skills/xr-dev", "pluginMarketplace": "ssheleg/xr-dev", "pluginInstall": "xr-dev@xr-dev", "desc": "Quest product delivery from platform choice to launch and operation, with stage owners, evidence gates and next actions. quest-lifecycle connects immersive design, engine discovery, account readiness, development, capture and launch planning. quest-native covers C/C++ OpenXR and MR capability boundaries; quest-spatial covers Kotlin, ECS, measured panel budgets and hybrid activities; quest-perf covers rendering experiments and sustained device performance; quest-tooling covers current-source research and CLI/MCP discovery; quest-store covers submission, monetization, Store assets and growth; quest-webxr covers browser and packaged PWA delivery. Engine-specific Meta companions and official Godot XR documentation remain separate sources, with explicit fallbacks when tools or devices are absent.", "skillNames": [ "quest-lifecycle", "quest-native", "quest-spatial", "quest-perf", "quest-tooling", "quest-store", "quest-webxr" ], "version": "0.4.6", "entry": null, "role": "how a Quest product moves from platform choice to launch and operation", "npm": "@ssheleg/xr-dev", "shape": "static", "shapeWhy": "Fixed platform owners with an explicit lifecycle entry. The agent selects the earliest unresolved stage from repository and device evidence, then records the owner, prerequisites and next action instead of starting a competing delivery process.", "extraLinks": [ { "label": "Follow the Quest product lifecycle", "url": "https://github.com/ssheleg/xr-dev/blob/main/plugins/xr-dev/skills/quest-lifecycle/SKILL.md", "note": "Stage map, engine paths and immersive design acceptance, with separate evidence for build, device, Store and operation." } ], "commit": "5a36fc119e03d3a2cab9d40bd232a334b34fa3cc" }, { "name": "web3d-dev", "repo": "ssheleg/web3d-dev", "dir": "skills/web3d-dev", "pluginMarketplace": "ssheleg/web3d-dev", "pluginInstall": "web3d-dev@web3d-dev", "desc": "Realtime 3D on the web with three.js and React Three Fiber, in three skills split by the question. web3d-runtime owns how the scene runs: WebGPURenderer and its WebGL2 fallback, TSL and compute, post-processing, device loss, the frame loop and profiling, led by the failures that are silent in r186 — render() before init() throws, positionNode collapsing every instance to a point, computeAsync not waiting for the GPU, twenty drei components that do not run on WebGPU. web3d-assets owns the glTF pipeline from a source to the frame within a written budget — gltf-transform and gltfpack, KTX2 and meshopt, loaders and colour spaces, sourcing and licences — and delegates orders to the asset service when the machine runs one. web3d-animation owns a two-sided animation protocol with a shared clip canon: rigs, clips, blending, retargeting, root motion, crowds and vertex-animation textures. Every fact is pinned to three@0.186.1 and the gate checks each code block against that release's exports.", "skillNames": [ "web3d-runtime", "web3d-assets", "web3d-animation" ], "version": "0.2.7", "entry": null, "role": "how realtime 3D on the web runs, ships its assets and moves", "npm": "@ssheleg/web3d-dev", "shape": "static", "shapeWhy": "Three fixed questions with fixed seams — runtime, assets, motion — and one shared contract, the clip canon, duplicated into both skills that need it and checked identical.", "commit": "70614f3ead494f8242a4a3757cdb1cd9c588d70c" } ], "agents": [ { "name": "Claude Code", "id": "claude-code", "channel": "plugin", "reads": "~/.claude/plugins", "note": "installed as plugins, never as a plain ~/.claude/skills copy — that copy shadows the plugin and serves its frozen version forever" }, { "name": "DeepSeek Harness", "id": "dsh", "channel": "reads the hub directly", "reads": "~/.agents/skills (rank 500)", "note": "no plugin to write: the skills subsystem is in the default web profile, and its local provider scans six roots nearest-first — a project-local .dsh/skills or .agents/skills outranks the installed one" }, { "name": "Cursor", "id": "cursor", "channel": "skills CLI", "reads": "~/.agents/skills", "note": "plus a Cursor rules file the launcher writes for routing" }, { "name": "Codex", "id": "codex", "channel": "skills CLI", "reads": "~/.agents/skills", "note": "routing block goes to ~/.codex/AGENTS.md. Codex ALSO keeps a native plugin cache, so a filesystem sweep sees historical cache SKILL.md copies alongside the hub — those are NOT the active provider. A read-only resolver separates installed/enabled/applicable/loaded and counts only the active one; native plugin install/update is passed to a supported host API, and UNSUPPORTED when no such API is present." }, { "name": "Gemini CLI", "id": "gemini-cli", "channel": "skills CLI", "reads": "~/.agents/skills", "note": "routing block goes to ~/.gemini/GEMINI.md" }, { "name": "OpenCode", "id": "opencode", "channel": "skills CLI", "reads": "~/.agents/skills", "note": "" }, { "name": "Windsurf", "id": "windsurf", "channel": "skills CLI", "reads": "~/.agents/skills; ~/.codeium/windsurf/skills; ~/.config/devin/skills", "note": "Current documentation redirects to Devin Desktop/Cascade; .windsurf remains a legacy project skill path." }, { "name": "Zed", "id": "zed", "channel": "skills CLI", "reads": "~/.agents/skills", "note": "Native Zed Agent discovers direct skill children; embedded external agents use their own loaders. Project skill loading depends on trust." }, { "name": "Kilo Code", "id": "kilo", "channel": "skills CLI", "reads": "~/.agents/skills; ~/.kilo/skills", "note": "Current Kilo platform uses .kilo; older .kilocode layouts are not a universal current contract." }, { "name": "Kimi CLI", "id": "kimi-code-cli", "channel": "skills CLI", "reads": "~/.agents/skills; $KIMI_CODE_HOME/skills (default ~/.kimi-code/skills)", "note": "Current Kimi Code 2.x uses .kimi-code; older Python CLI paths are a different generation. Shared storage is native; no duplicate copy is required." }, { "name": "Hermes", "id": "hermes-agent", "channel": "skills CLI", "reads": "$HERMES_HOME/skills (default ~/.hermes/skills)", "note": "Profile-local installation; ~/.agents/skills requires skills.external_dirs. Family skills are installed as a copy (--copy), never a link into ~/.agents/skills, so a skill_manage(patch) changes Hermes' copy only and the next update restores the pinned bytes (B-217). Project skills require trust; copying a skill does not register native plugins or hooks." }, { "name": "OpenClaw", "id": "openclaw", "channel": "skills CLI", "reads": "/skills (default ~/.openclaw/skills)", "note": "Opt-in (--agent openclaw), not a default target: the skills CLI detects it by the ~/.openclaw folder alone, and its caps (150 skills / 18,000 chars in the prompt, 300 candidates and 200 loaded per root) show part of the family. Shared ~/.agents/skills is discovered only with the default state directory; custom profiles must use their native roots." }, { "name": "Kiro", "id": "kiro-cli", "channel": "skills CLI", "reads": "~/.kiro/skills", "note": "Native Kiro global root; shared ~/.agents/skills loading is not established by the inspected primary documentation." }, { "name": "Goose", "id": "goose", "channel": "skills CLI", "reads": "~/.agents/skills", "note": "" }, { "name": "GitHub Copilot", "id": "github-copilot", "channel": "skills CLI", "reads": "~/.agents/skills; ~/.copilot/skills", "note": "Current CLI/IDE skill roots vary by surface; native plugin features need their own registration." }, { "name": "Cline", "id": "cline", "channel": "skills CLI", "reads": "~/.cline/skills", "note": "Current documented precedence gives global skills priority; shared ~/.agents/skills loading is not established." }, { "name": "Roo Code", "id": "roo", "channel": "skills CLI", "reads": "~/.agents/skills; ~/.roo/skills", "note": "Mode-specific skill directories participate in discovery; verify the active mode." }, { "name": "Amp", "id": "amp", "channel": "skills CLI", "reads": "~/.agents/skills; ~/.config/agents/skills; ~/.config/amp/skills", "note": "Its documented search order includes global local roots before project roots; do not assume project-first precedence." } ], "agentsUpstream": { "count": 79, "globalCount": 77, "source": "skills@1.7.2 published dist/cli.mjs; lib/host-targets.snapshot.js", "read": "2026-10-09", "note": "Dated installer-target snapshot, independently checked against the pinned upstream agents.ts. Eve and PromptScript are project-only. This count does not assert native runtime compatibility." } }