security

Zach's Awesome AI Skills

Open-source AI agent skills focused on engineering and personal productivity.

Skills conform to skills.sh / Agent Skills standard and are versioned/released independently.

Install

Skills install via the skills CLI. The CLI auto-detects your agent (Claude Code, Codex, Cursor, etc.) and drops files in the right place.

# Install every skill in this repo (project-local)
npx skills add zcaceres/skills

# Install globally (~/.claude/skills/ for Claude Code)
npx skills add zcaceres/skills -g

# Browse without installing
npx skills add zcaceres/skills --list

Install one or more specific skills with -s <name>:

npx skills add zcaceres/skills -s acid-trip
npx skills add zcaceres/skills -s quality-chaos-monkey
npx skills add zcaceres/skills -s checkpoint
npx skills add zcaceres/skills -s cleanup-computer
npx skills add zcaceres/skills -s clean-ai-slop
npx skills add zcaceres/skills -s quality-cli-agent-friendly-audit
npx skills add zcaceres/skills -s quality-dead-code-analyzer
npx skills add zcaceres/skills -s quality-perf-review
npx skills add zcaceres/skills -s copywriting
npx skills add zcaceres/skills -s decompose
npx skills add zcaceres/skills -s find-docs
npx skills add zcaceres/skills -s gemini-deep-research
npx skills add zcaceres/skills -s investigate-repo
npx skills add zcaceres/skills -s optimize-permissions
npx skills add zcaceres/skills -s pr
npx skills add zcaceres/skills -s quality-project-health
npx skills add zcaceres/skills -s record-gif
npx skills add zcaceres/skills -s reflect-on-conversation
npx skills add zcaceres/skills -s review-code
npx skills add zcaceres/skills -s safety-dotenv-guard
npx skills add zcaceres/skills -s safety-git-reset-guard
npx skills add zcaceres/skills -s safety-op-creds
npx skills add zcaceres/skills -s safety-rm-rf-guard
npx skills add zcaceres/skills -s storage-cleanup
npx skills add zcaceres/skills -s transcribe-youtube
npx skills add zcaceres/skills -s trip-planner
npx skills add zcaceres/skills -s zoom

Add -g for global, or -a <agent> to target a specific agent (e.g. -a claude-code).

Hook skills. safety-dotenv-guard, safety-git-reset-guard, safety-op-creds, safety-rm-rf-guard, and pr each ship a scripts/install.sh that idempotently wires the hook into ~/.claude/settings.json (with a timestamped backup). Two-step install:

npx skills add zcaceres/skills -s <hook-skill>
~/.claude/skills/<hook-skill>/scripts/install.sh

Why two steps: the skills CLI is a pure file copier and runs no publisher code on install. The SKILL.md frontmatter hooks: block only fires while the skill is active in context — not always-on. install.sh gets the hook onto every matching tool call. Requires jq. See each skill's SKILL.md for --project / --target flags and manual wiring as an alternative. The script self-locates, so the same command works whether the skill was installed at user scope or project scope.

Install as a Claude Code plugin

The prefix-grouped skills are also bundled as Claude Code plugins in a marketplace, so a whole group installs at once and its skills are namespaced under the group name:

/plugin marketplace add zcaceres/skills
/plugin install security@zcaceres-skills   # then /security:openssf, /security:gitleaks, …
/plugin install quality@zcaceres-skills    # /quality:chaos-monkey, /quality:perf-review, …

Same skills as npx skills add, grouped and namespaced. The plugin tree under plugins/ and the catalog at .claude-plugin/marketplace.json are generated from skills/ — see Workflow. The safety-* guards aren't bundled yet: their hooks run a compiled binary that a file-copy marketplace can't ship (see the deferral note in scripts/build-plugins.ts).

Skills