
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@tschallacka/ai-skills
Advanced tools
A small collection of reusable SKILL.md instructions for coding agents.
The skills are plain Markdown, version-controlled, and portable across
compatible agent tools.
| Skill | Purpose | Documentation |
|---|---|---|
| Planning | Creates durable plans with goals, steps, verification, progress tracking, and handoffs. | planning/SKILL.md |
| Project-specific deviations | Records confirmed project behavior and environment quirks that future agents should not rediscover. | project-specificies/SKILL.md |
| Resource-limited testing | Runs resource-intensive commands under platform-appropriate CPU and memory controls. | resource-limited-testing/SKILL.md |
Use a skill only when its frontmatter trigger matches the task or when the user explicitly requests it. Each skill documents when not to activate.
Run this command and choose the skills and agent destination interactively:
curl -fsSL https://raw.githubusercontent.com/tschallacka/ai-skills/refs/heads/master/install.sh | bash
The installer can install all three skills or one skill, and supports these global skill roots:
| Destination | Agent or standard |
|---|---|
~/.agents/skills | Universal Agent Skills root; recommended shared destination |
~/.codex/skills | Codex CLI |
~/.claude/skills | Claude Code |
~/.config/opencode/skills | OpenCode |
~/.openclaw/skills | OpenClaw managed skills |
~/.cline/skills | Cline |
The universal root is also discovered by OpenCode and OpenClaw. Installing the same skill into multiple roots can create duplicate definitions or precedence conflicts, so choose only the roots you need.
Install the package globally to expose the installer command. The npm package
keeps the skills in this repository and links ai-skills-install directly to
the existing install.sh script:
npm install -g @tschallacka/ai-skills
ai-skills-install
For a one-off run without a global install:
npx --yes --package @tschallacka/ai-skills ai-skills-install
The npm package does not install skills automatically as an npm lifecycle side-effect; run the installer command when you are ready to choose a target.
If an installed file differs from the repository version, the installer asks
before replacing it. Approved replacements create a .bak backup first. A
symlinked skill is skipped for manual review rather than following the link
and modifying an unexpected location.
Use --all, --skill, and --target when the choices are already known:
# Install all skills into the shared Agent Skills root
curl -fsSL https://raw.githubusercontent.com/tschallacka/ai-skills/main/install.sh \
| bash -s -- --all --target "$HOME/.agents/skills"
# Install or update only planning for Codex
curl -fsSL https://raw.githubusercontent.com/tschallacka/ai-skills/main/install.sh \
| bash -s -- --skill planning --target "$HOME/.codex/skills"
Use --yes only when unattended replacement is intentional; changed files are
still backed up before replacement:
curl -fsSL https://raw.githubusercontent.com/tschallacka/ai-skills/main/install.sh \
| bash -s -- --all --target "$HOME/.agents/skills" --yes
Review the installer before running it if you do not trust the source. Skills are instructions that may guide agents to run commands or access files.
Run the installer again. It compares each installed file with the repository, skips unchanged files, asks before replacing local changes, and creates a backup for every replaced file.
Run the installer directly from a checkout to use its local files without downloading an archive:
./install.sh
The installer also accepts AI_SKILLS_REPO_URL and AI_SKILLS_REF when a
different repository or branch must be used.
resource-limited-testing uses systemd and cgroup v2 for strongest Linux
isolation, with weaker fallbacks documented for unsupported Linux sessions
and macOS.Distributed under the MIT License.
FAQs
Reusable skills and an installer for coding agents
The npm package @tschallacka/ai-skills receives a total of 9 weekly downloads. As such, @tschallacka/ai-skills popularity was classified as not popular.
We found that @tschallacka/ai-skills demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.