
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@txnlab/skills
Advanced tools
Agent skills for TxnLab's Algorand ecosystem.
This repo serves two purposes:
@txnlab/skills, an npm package for discovering, installing, and managing the skills in this repoSkills are reusable instruction packages that extend AI coding agents (Claude Code, Codex, Cursor, etc.) with specialized knowledge about TxnLab's projects.
npx @txnlab/skills add nfd
That's it. The nfd skill is now available to your AI agent. If no agent is auto-detected, specify one with --agent:
npx @txnlab/skills add nfd --agent claude-code
| Skill | Description |
|---|---|
nfd | Work with NFDomains, the Algorand Name Service for .algo domains |
use-wallet | Integrate Algorand wallet connections with @txnlab/use-wallet |
haystack-router | Route and execute optimal swaps on Algorand DEXes via Haystack |
skill-creator | Guide for creating effective Agent Skills following the spec |
npx @txnlab/skills list
npx @txnlab/skills info <skill-name>
npx @txnlab/skills add <skill-name> # Install one skill
npx @txnlab/skills add nfd use-wallet # Install multiple
npx @txnlab/skills add --all # Install all skills
npx @txnlab/skills add nfd -a claude-code # Target specific agent
npx @txnlab/skills add nfd --local # Install to project-level directory
npx @txnlab/skills remove <skill-name>
npx @txnlab/skills remove --all
npx @txnlab/skills remove nfd -a claude-code # Target specific agent
npx @txnlab/skills remove nfd --local # Remove from project-level directory
npx @txnlab/skills validate # Validate all
npx @txnlab/skills validate <skill-name> # Validate one
npx @txnlab/skills dev link <skill-name> # Symlink skill for local dev
npx @txnlab/skills dev link --all # Symlink all skills
npx @txnlab/skills dev link nfd --force # Overwrite existing non-symlink target
npx @txnlab/skills dev unlink --all # Remove dev symlinks
| Flag | Commands | Description |
|---|---|---|
-a, --agent <agent> | add, remove, dev | Target specific agent (repeatable) |
-g, --global | add, remove | Use global skill directory (default) |
-l, --local | add, remove | Use project-level skill directory |
--all | add, remove, dev | Apply to all skills |
--force | dev link | Overwrite existing non-symlink targets |
-y, --yes | remove | Skip confirmation prompts |
-v, --version | (global) | Show version |
-h, --help | (all) | Show help |
Requires Node.js >= 18.
npx @txnlab/skills add <skill-name>
npm install -g @txnlab/skills
txnlab-skills add <skill-name>
The CLI auto-detects installed agents and installs skills to the appropriate directory:
| Agent | Global path | Local path |
|---|---|---|
| Claude Code | ~/.claude/skills/ | .claude/skills/ |
| Codex | ~/.codex/skills/ | .codex/skills/ |
| Cursor | ~/.cursor/skills/ | .cursor/skills/ |
| OpenCode | ~/.opencode/skills/ | .opencode/skills/ |
If no agent is detected, use --agent to specify one manually.
# Clone the repo
git clone https://github.com/TxnLab/skills.git
cd skills
# Install dependencies
bun install
# Symlink all skills for testing ("bun run dev" runs the CLI from source)
bun run dev dev link --all
# Edit skills — changes are picked up immediately via symlinks
# Validate your work
bun run dev validate
# Run tests
bun test
# Clean up
bun run dev dev unlink --all
skills/skill-creator/SKILL.md for the skill creation guideskills/<skill-name>/SKILL.md with valid YAML frontmatter (name and description required)scripts/, references/, and assets/ directories as neededbun run validate to check your skill passes validationtxnlab-skills validatename field must match the directory nameThis project follows the open Agent Skills specification. Skills are portable across any agent that supports the spec.
FAQs
Agent skills for TxnLab's Algorand ecosystem
We found that @txnlab/skills demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.