@1aboveio/skills

Public distribution of the 1AboveIO first-party skill groups.

Every byte in this package is public and permanently so. The repository it is generated from stays private, and nothing here requires access to it: every first-party skill in this package installs from the unpacked package directory, with no Git fetch and no GitHub credentials. npm publishes no provenance attestation for this package, because npm does not attest provenance for packages built from a private source repository.

Prerequisites

• Node >=22.20.0.
• Exactly [email protected], which this package invokes for you.
• global installation targeting universal and claude-code.
• Installed content is canonical under ~/.agents/skills, with per-skill links under ~/.claude/skills. No copied store is created under any other agent directory.

External prerequisites

External skills are not package members: this package never installs, updates, or removes them. Run the reviewed shell prerequisites separately when you need their capabilities:

Matt Pocock Toolkit

SKILLS_DOWNLOAD_MAX_BYTES=33554432 SKILLS_EXTRACT_MAX_FILES=4096 SKILLS_EXTRACT_MAX_BYTES=67108864 npx [email protected] add https://codeload.github.com/mattpocock/skills/tar.gz/ed37663cc5fbef691ddfecd080dff42f7e7e350d --global --agent universal claude-code --skill batch-grill-me code-review codebase-design diagnosing-bugs domain-modeling grill-me grill-with-docs grilling handoff improve-codebase-architecture prototype research resolving-merge-conflicts setup-matt-pocock-skills tdd to-spec to-tickets triage wayfinder --yes

Impeccable

IMPECCABLE_BUNDLE="$(mktemp "${TMPDIR:-/tmp}/impeccable-skill-v4.1.1.XXXXXX")"
curl --fail --location --output "$IMPECCABLE_BUNDLE" https://github.com/pbakaus/impeccable/releases/download/skill-v4.1.1/universal.zip
printf '%s  %s\n' 'e16133fcf240c042e5b6bdc20ac9f3a996a3ab9652723c6d9d1291dd1760dab4' "$IMPECCABLE_BUNDLE" | shasum -a 256 --check -
IMPECCABLE_BUNDLE_PATH="$IMPECCABLE_BUNDLE" npx --yes [email protected] install --yes --force --providers=claude,codex --scope=global --no-hooks

Usage

npx @1aboveio/skills list
npx @1aboveio/skills install
npx @1aboveio/skills install --group engineering-workflow
npx @1aboveio/skills update --group engineering-workflow

Running install with no --group opens the interactive bundle picker; update with no --group replays the remembered selection instead (see Updating). The automation flags:

• --group <id> — select one group; repeat the flag, or pass a comma-separated list, for several.
• --all — select every group in the catalog below. Mutually exclusive with --group.
• --dry-run — print the planned buckets and native commands, in order, and run none of them.
• --yes — accept every newly declared group member and use native symlink deployment without coordinator prompts.
• --enable-tdd — keep TDD installed and allow implicit/model invocation (the default).
• --disable-tdd — keep TDD installed but allow only explicit user invocation.

Selecting several groups (interactive picker, repeated --group, or --all) installs their members as one native skills add per skill from the unpacked package, so one skill's failure is reported by name and never aborts the rest of the selection. Every native add uses --yes because [email protected] has no independent --symlink flag: this selects the default canonical store plus per-harness symlinks without an installation-method prompt, and also confirms replacement of each planned same-named skill. The coordinator still owns group and new-member consent before planning.

Groups in this package

• engineering-workflow — Engineering Workflow: e2e-test, ensure-coverage, implement-and-pr, rush-issues, rush-release, review-pr, smoke, engineering-runtime
• delivery-infrastructure — Delivery Infrastructure: cloud-build, cloud-debug, cloud-deploy, docker, google-cloud, mergify, podman
• backend — Backend: app-debug, python-backend
• data-science — Data Science: airflow, pyspark
• payment — Payment: fraud-analysis, payment-analysis, tld-detection
• fullstack — Fullstack: better-auth, monorepo, nextjs-fullstack, prisma-setup, shadcn, zod-v4

Internal dependencies, installed with the groups above and not selectable on their own: harness-runtime. They are an implementation detail of those groups, so list and the picker do not offer them and --group rejects them as an unknown bundle. Uninstalling a group leaves them in place.

Updating

update with no --group replays the selection remembered in ${XDG_STATE_HOME:-~/.local/state}/1aboveio-skills/selection.json from the last run that recorded one. A repository checkout and this package share that one file, so switching transports keeps the same groups. Missing or corrupt memory is an error — the coordinator never infers groups from the filesystem — and remembered groups that are no longer selectable are dropped with a warning.

An accepted skill whose installed content already matches this package version's published digest is skipped entirely: no native add and no replacement. When everything remembered is unchanged and no new skill is accepted, the run exits 0 as an explicit no-op. --dry-run prints the unchanged, would-refresh, and would-add buckets without writing state or invoking the native CLI.

When the version you invoke declares a member your remembered group has not accepted — a skill that joined the group after your remembered acceptance was last recorded — update asks about that skill by name before adding it. Each new-member prompt defaults to No; --yes accepts every new member non-interactively. Declined skills are never uninstalled by the coordinator and stay out of the remembered acceptance, so the next update asks again.

When a release archives a previously accepted skill, update asks before removing that installed copy. The default is No; --yes accepts archival non-interactively. Removal is performed by the same pinned native Skills CLI, only after the declared replacement is installed or already current. Declined or failed archival remains in selection memory so a later update offers it again.

Install and update are best-effort per skill: they continue after a single skill failure, summarize every skill as succeeded, unchanged, declined, or failed, and exit non-zero if anything failed. There is no rollback or transactional group update; the native CLI remains the sole filesystem write authority. Selection memory follows the same per-skill rule: it is rewritten when at least one user-facing member succeeded or was already unchanged, holding exactly those members — failed and declined members are omitted — and a run with no user-facing success leaves the prior file untouched.

update --group ... refreshes an explicit selection from the @1aboveio/skills version you invoke, so the installed result is whatever that exact version carries. Public first-party content follows the package version you select, not a branch: pin a version and rerunning it reproduces the same installation.

Removing

This package has no remove command. Removal is the native CLI, over exactly the names a group owns — copy the command for the group you want to remove:

# Engineering Workflow
npx [email protected] remove --global --agent universal claude-code --skill e2e-test ensure-coverage implement-and-pr rush-issues rush-release review-pr smoke engineering-runtime
# Delivery Infrastructure
npx [email protected] remove --global --agent universal claude-code --skill cloud-build cloud-debug cloud-deploy docker google-cloud mergify podman
# Backend
npx [email protected] remove --global --agent universal claude-code --skill app-debug python-backend
# Data Science
npx [email protected] remove --global --agent universal claude-code --skill airflow pyspark
# Payment
npx [email protected] remove --global --agent universal claude-code --skill fraud-analysis payment-analysis tld-detection
# Fullstack
npx [email protected] remove --global --agent universal claude-code --skill better-auth monorepo nextjs-fullstack prisma-setup shadcn zod-v4

Removing a group leaves its dependency groups and every unrelated skill installed.

Lifecycle

[email protected] is the only lifecycle authority for this package. The package plans first-party commands; the native CLI owns installation, linking, replacement, update and removal. External prerequisites have separate upstream lifecycle and are never package steps.

Licensing

First-party skills in this package are MIT, and each installed skill carries its LICENSE. Externally owned skills are not republished, mirrored, installed, updated, or removed by this package. Their reviewed standalone shell commands pin upstream identities, and their licensing and lifecycle stay with their authors.