# Skillshed

> Skillshed is a plugin marketplace of vetted agent skills for Claude Code and Codex. One command installs it on macOS or Linux. A small core is always on; stack packs (Next.js/Vercel, Supabase, Expo, Inngest) switch on per project. Third-party skills are pinned to a commit and content hash, scanned for prompt injection, and updated only through reviewed pull requests. MIT licensed.

Install: `curl -fsSL https://skillshed.munyamakosa.com/install/llms | bash`

Turn a pack on in the current project: `skillshed use <pack>`. Search for new skills: `skillshed find <keywords>`. Update: `skillshed update`.

## Docs

- [README](https://github.com/farmhutsoftwareteam/skillshed#readme): install, packs, everyday commands
- [Security model](https://github.com/farmhutsoftwareteam/skillshed#security-prompt-injection-and-supply-chain): pinning, scanning, reviewed updates
- [vendor.lock.json](https://github.com/farmhutsoftwareteam/skillshed/blob/main/vendor.lock.json): every third-party skill with its source and commit

## Skills (81)

### matt (always on, 31 skills)

- ask-matt: Ask which skill or flow fits your situation.
- code-review: Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes: Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?).
- codebase-design: Shared vocabulary for designing deep modules.
- diagnosing-bugs: Diagnosis loop for hard bugs and performance regressions.
- domain-modeling: Build and sharpen a project's domain model.
- git-guardrails-claude-code: Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute.
- grill-me: A relentless interview to sharpen a plan or design.
- grill-with-docs: A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.
- grilling: Grill the user relentlessly about a plan, decision, or idea.
- handoff: Compact the current conversation into a handoff document for another agent to pick up.
- implement: Implement a piece of work based on a spec or set of tickets.
- implement-spec: Implement the result of /to-spec and /to-tickets in code.
- improve-codebase-architecture: Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
- migrate-to-shoehorn: Migrate test files from `as` type assertions to @total-typescript/shoehorn.
- pr: Use when writing a PR body.
- prototype: Build a throwaway prototype to answer a design question.
- research: Investigate a question against high-trust primary sources and capture the findings as a Markdown file in the repo.
- retro: Conduct a retrospective on a coding session.
- scaffold-exercises: Create exercise directory structures with sections, problems, solutions, and explainers that pass linting.
- setup-matt-pocock-skills: Configure this repo for the engineering skills: set up its issue tracker, triage label vocabulary, and domain doc layout.
- setup-pre-commit: Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo.
- tdd: Test-driven development.
- teach: Teach the user a new skill or concept, within this workspace.
- to-questionnaire: Turn a decision you can't fully answer into a questionnaire for someone else to fill in.
- to-spec: Turn the current conversation into a spec and publish it to the project issue tracker: no interview, just synthesis of what you've already discussed.
- to-tickets: Break a plan, spec, or the current conversation into a set of tracer-bullet tickets, each declaring its blocking edges, published to the configured tracker (edges as text in one file per ticket locally, or native blocking links on a real tracker).
- triage: Move issues and external PRs through a state machine of triage roles, categorise, verify, grill if needed, and write agent-ready briefs.
- wait-what: Stop.
- wayfinder: Plan a huge chunk of work (more than one agent session can hold) as a shared map of decision tickets on your issue tracker, and resolve them one at a time until the way to the destination is clear.
- wizard: Generate an interactive bash wizard that walks a human through steps only they can perform.
- writing-for-agents: Writing documents for agents.

### core (always on, 4 skills)

- find-skill: Use when a task needs a capability no installed or indexed skill covers, or the user asks to find, add or install a new skill.
- security-audit: Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons.
- skill-router: Use when a task might match one of the Skillshed skills but no loaded skill clearly fits, or the task belongs to a stack (Next.js/Vercel, Supabase, Expo, Inngest) whose pack may not be enabled here.
- vet-skill: Use when adding, importing or updating a third-party skill (skills.sh, GitHub, a vendor sync PR) to check it for prompt injection, data exfiltration or unsafe scripts before it is trusted.

### expo (per project, 23 skills)

- eas-app-stores: Build and submit iOS and Android apps with EAS to TestFlight, the App Store, or Google Play.
- eas-hosting: Deploy Expo websites and Expo Router API routes to EAS Hosting - export the web bundle, run eas deploy for production and PR preview URLs, manage environment secrets and custom domains, and work within the Cloudflare Workers runtime.
- eas-observe: Use for anything related to EAS Observe - adding `expo-observe` to an Expo project (AppMetricsRoot/ObserveRoot HOC, markInteractive and ObserveInteractiveMarker, the useObserve hook, the Expo Router / React Navigation integrations for per-route metrics, user-defined events via `Observe.logEvent`, error reporting via ObserveErrorBoundary and `Observe.reportError`, native crash reporting, source map upload for symbolicated stack traces, and runtime config such as sampleRate and dispatchInDebug), querying via the EAS CLI (`eas observe:metrics-summary`, `observe:metrics`, `observe:routes`, `observe:events`, `observe:session`, `observe:versions`, `observe:errors`, `observe:event`), interpreting the resulting metrics (cold/warm launch, TTR, TTI, navigation cold/warm TTR, update download, and the TTI frameRate/device/network params for triaging slow startups), or shipping an Observe integration inside a third-party package.
- eas-simulator: Run and control a user's app on a remote iOS/Android simulator hosted on EAS cloud.
- eas-update: Configure and use EAS Update for over-the-air JavaScript and asset updates with expo-updates and EAS CLI.
- eas-update-insights: Check the health of published EAS Update: crash rates, install/launch counts, unique users, payload size, and the split between embedded and OTA users per channel.
- eas-workflows: Helps understand and write EAS workflow YAML files for Expo projects.
- expo-animation: Build animations in React Native and Expo, making the decisions in the order that determines whether they feel right — should it animate, which thread it runs on, which properties, spring or timing, how the gesture hands off, how it degrades.
- expo-app-clip: Add an iOS App Clip target to an Expo app.
- expo-brownfield: Integrate Expo and React Native into an existing native iOS or Android app.
- expo-data-fetching: Use when implementing or debugging ANY network request, API call, or data fetching.
- expo-design-system: Build and maintain a design system inside an Expo app - a reusable theme of design tokens (color, spacing, typography, radius, shadow, motion), reusable component structure with variant/size/state prop conventions, and rules for when to extract a repeated view into a shared component.
- expo-dev-client: Build and distribute Expo development clients locally or via TestFlight for internal testing.
- expo-dom: Use Expo DOM components to run web code in a webview on native and as-is on web.
- expo-examples: Expo's official example projects - the expo/examples repo of ~70 `with-*` integrations (Stripe, Clerk, Supabase, OpenAI, maps, Reanimated, SQLite, Skia, NativeWind, and more).
- expo-module: Guide for creating and writing Expo native modules and views using the Expo Modules API (Swift, Kotlin, TypeScript).
- expo-native-ui: Build beautiful, native-feeling Expo screens.
- expo-overview: Entry point and router for every Expo or EAS task.
- expo-project-structure: Folder structure for a new Expo app.
- expo-router: Navigation and routing for Expo Router.
- expo-ui: Build native UI with the @expo/ui package: real SwiftUI on iOS and Jetpack Compose on Android.
- expo-upgrade: Guidelines for upgrading Expo SDK versions and fixing dependency issues
- expo-web-to-native: Migrate an existing web React app to a native iOS/Android app with Expo.

### inngest (per project, 15 skills)

- inngest-agent-evals: Use when building, migrating, or debugging Agent Evals on Inngest: scoring AI agent or workflow outcomes, deferred scorers, sessions, traces, step experiments, experiment variant attribution, Insights queries, or production eval loops for prompts, models, tools, providers, and agent behavior.
- inngest-agents: Use when building durable AI agents or agentic workflows with Inngest and AgentKit, including model calls, tool calls, multi-agent networks, human approval, realtime progress, provider rate limits, crash-safe execution, and Agent Evals handoff.
- inngest-api: Use when the user explicitly asks for the Inngest REST API v2, raw HTTP, OpenAPI, API docs, API authentication, or an endpoint that the Inngest CLI does not expose.
- inngest-api-cli: Use when operating Inngest API resources from the terminal with `npx inngest-cli@latest api`: Cloud/local run debugging, event-run lookup, function traces, function invocation, app syncs, webhooks, environments, keys, account checks, and Insights queries.
- inngest-brownfield-audit: Use when analyzing an existing TypeScript or JavaScript codebase to decide where and how to introduce Inngest.
- inngest-cli: Use when installing or running the Inngest CLI and Dev Server for local development, local testing, serve endpoint debugging, Docker or Docker Compose setup, MCP configuration, self-hosted `inngest start`, or deployment workflow checks.
- inngest-cloud: Inspect and operate Inngest Cloud through its OAuth MCP connection.
- inngest-durable-functions: Use when building functions that must survive process crashes, retry automatically on failure, run on a schedule, react to events, or maintain state across infrastructure failures — e.g., webhook handlers that drop events, flaky cron jobs, background jobs that fail mid-execution, or workflows that need to resume where they left off.
- inngest-events: Use when designing event-driven workflows, decoupling services, implementing fan-out patterns (one trigger, many downstream handlers), implementing idempotent event handling with IDs (24-hour dedupe window), or handling at-least-once delivery from external sources like Stripe webhooks.
- inngest-flow-control: Use when handling external API rate limits (e.g., OpenAI 429s, HubSpot or Stripe rate limits), preventing duplicate work from rapid event bursts (debouncing user actions), spreading load over time, ensuring per-tenant fairness, processing events in batches, limiting concurrent runs of the same operation, or assigning priority to important runs.
- inngest-middleware: Use when adding cross-cutting concerns to durable functions — structured logging or tracing across all functions, error tracking with Sentry, payload encryption for sensitive data, dependency injection of clients (DB, Stripe, etc.) into function handlers, custom telemetry, or behavior that should apply uniformly across many functions.
- inngest-realtime: Use when streaming durable workflow updates to a UI in real time — live order status pages that animate as steps complete, AI agent token streaming from a function to the browser, log tailing for long-running jobs, or human-in-the-loop approval flows that publish a prompt and wait for a user reply.
- inngest-setup: Use when adding durable execution to a TypeScript project — building retry-safe webhook handlers, background jobs that survive crashes, scheduled tasks, or long-running workflows that outlive a single request.
- inngest-steps: Use when implementing delays that must survive process restarts (e.g., 24-hour cart abandonment, scheduled follow-ups), waiting for human approval or external events with timeouts (review gates, webhook callbacks, async API completion), polling external services without losing state on crashes, calling other functions and awaiting their results, memoizing expensive operations so they don't re-run on retry, or running async work in parallel inside a workflow.
- inngest-v3-v4-migration: Use when upgrading an existing TypeScript codebase from Inngest SDK v3 to v4, or when fixing mixed v3/v4 API usage.

### nextjs-vercel (per project, 6 skills)

- next-bundle-optimizer: Audit and reduce Next.js browser initial-load work.
- next-cache-components-adoption: Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces.
- next-cache-components-optimizer: Optimize the meaningful UI available immediately from a Next.js route on an initial load (hard navigation) or named client-side navigation (soft navigation).
- next-dev-loop: Verify Next.js runtime behavior after editing app code.
- next-partial-prefetching-adoption: Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces.
- next-partial-prefetching-optimizer: Optimize what selected Next.js client navigations include before the click under Partial Prefetching.

### supabase (per project, 2 skills)

- supabase: Use when doing ANY task involving Supabase.
- supabase-postgres-best-practices: Postgres best practices maintained by Supabase, for Postgres running anywhere.