@trendai-crem/claude-skills

One-command Claude Code skill installer for the team. Installs curated AI agent skills and plugins in a single line.

Quick Start

npx @trendai-crem/claude-skills

That's it. The command installs all four source types declared in sources.json:

| Source type | What it installs | How to change | |-------------|-----------------|---------------| | rules-dir | Team-shared rules to ~/.claude/rules/team/ (loaded in every session) | Add/remove rules/<name>.md, bump version, PR | | skills-repo | superpowers — brainstorming, debugging, TDD, and more | Edit sources.json, bump version, PR | | skills-dir | Team skills in this repo's skills/ directory | Add/remove skills/<name>/, bump version, PR | | marketplace | Plugins from ai-skill-marketplace, claude-plugins-official, openai-codex, and everything-claude-code | Edit plugins list in sources.json, bump version, PR |

Re-run to update everything:

npx @trendai-crem/claude-skills@latest

Auto-update runs at session start — you'll be notified when a new version is available and it installs automatically.

Team Rules (rules/)

Rules are .md files installed to ~/.claude/rules/team/ and automatically loaded in every Claude session across all projects. Use rules for team-wide conventions that should always apply.

| Rule | Description | |------|-------------| | confluence-editing | Use atlassian-tools skill for Confluence edits — never use raw MCP update tools |

Team Skills (skills/)

| Skill | Trigger | Description | |-------|---------|-------------| | code-review | "review my code", "code review" | Multi-perspective review — 5 reviewers + Codex baseline, enforces TM RDSec policy and Secure Coding Dojo checkpoints | | reviewing-prs | "review this PR", "review pull request" | Structured PR review with 3 independent sub-agents covering correctness, security, and requirements |

Marketplace Plugins

Installed from ai-skill-marketplace, claude-plugins-official, openai-codex, and everything-claude-code. Configure in sources.json.

| Plugin | Marketplace | Description | |--------|-------------|-------------| | atlassian-tools | ai-skill-marketplace | Confluence wiki and Jira issue management | | google-style-guides | ai-skill-marketplace | Google Style Guide references (Java, Python, Go, TypeScript, and more) | | l2-automation | ai-skill-marketplace | L2 test automation and Robot Framework skills | | service-doc-generator | ai-skill-marketplace | Systematic service documentation generation | | ralph-loop | claude-plugins-official | Ralph Loop autonomous agent plugin | | codex | openai-codex | Official OpenAI Codex plugin — CLI runtime, review commands, rescue agent, GPT prompting guides | | everything-claude-code | everything-claude-code | Battle-tested agents, skills, hooks, and commands — TDD, code review, security, Go/Python/Swift patterns, and more |

Note: The everything-claude-code plugin installs skills, agents, commands, and hooks via the marketplace. Its rules are automatically copied to ~/.claude/rules/ on install (all languages, no-clobber — existing files are never overwritten).

For Maintainers

Adding a team rule

1. Create a branch: git checkout -b feat/add-<rule-name>
2. Add rules/<rule-name>.md (plain markdown, no frontmatter needed)
3. Keep rules short (<50 lines) — they consume context window in every session
4. Bump version: npm version patch
5. Commit, push, open a PR, merge — CI publishes automatically

Rules are always overwritten on install (not no-clobber) to stay in sync with the repo.

Adding a team skill

1. Create a branch: git checkout -b feat/add-<skill-name>
2. Add skills/<skill-name>/SKILL.md:

   ---
   name: skill-name
   description: One-line trigger description for Claude
   ---
   
   # Skill content here

3. Commit, push, open a PR — version bump is required (CI enforces this)
4. Bump version: npm version minor
5. Merge to main — CI publishes automatically

Adding a marketplace plugin

Edit sources.json and add the plugin name to the appropriate marketplace entry:

{
  "type": "marketplace",
  "name": "ai-skill-marketplace",
  "source": "[email protected]:trend-ai-taskforce/ai-skill-marketplace.git",
  "plugins": [
    "existing-plugin",
    "new-plugin-name"
  ]
}

Bump version, PR, merge. All team members get the new plugin on their next session start.

Adding an external skill source

Add a new skills-repo entry to sources.json:

{
  "type": "skills-repo",
  "repo": "org/repo-name",
  "flags": ["--all"],
  "label": "repo-label"
}

Bump version, PR, merge. Removal works the same way — deleting the entry propagates uninstall on next auto-update.

Adding a new marketplace

Add a new marketplace entry to sources.json:

{
  "type": "marketplace",
  "name": "another-marketplace",
  "source": "anthropics/claude-plugins-official",
  "plugins": ["plugin-name"]
}

The source can be a GitHub shorthand (org/repo) or a full git URL.

Removing a team skill

1. Delete the skills/<skill-name>/ directory
2. Bump version, open a PR, merge
3. All team members have the skill removed on their next session start (auto-update reconciles the manifest)

Removing a marketplace plugin

Remove the plugin name from sources.json:

{
  "type": "marketplace",
  "name": "ai-skill-marketplace",
  "plugins": [
    "wiki-tools"
    // remove "atlassian-tools" by deleting that line
  ]
}

Bump version, PR, merge. The plugin is uninstalled for all team members on next auto-update.

Removing an entire marketplace or skill source

Delete the entire entry from sources.json:

{
  "sources": [
    // remove the entire { "type": "marketplace", "name": "..." } block
  ]
}

All plugins/skills from that source are uninstalled for all team members on next auto-update.

How removal propagation works: The installer tracks what it manages in ~/.claude/claude-skills-manifest.json. When an entry is missing from sources.json, the next run detects the discrepancy and uninstalls the affected items before writing the updated manifest.

Version bumping

A version bump is required whenever any of these change: cli.js, lib/, sources.json, skills/, package.json. CI will fail the PR if you forget.

npm version patch   # bug fixes / content updates
npm version minor   # new skills or plugins added
npm version major   # breaking changes (e.g. manifest format)

Uninstalling

bash uninstall.sh        # remove everything
bash uninstall.sh --dry  # preview what would be removed

Architecture

All sources are declared in sources.json. Adding any source type requires only a config change — no code changes needed.

sources.json
    ↓
cli.js (thin orchestrator)
    ↓
lib/handlers/{rules-dir, skills-dir, skills-repo, marketplace}.js
    ↓
~/.claude/claude-skills-manifest.json  (tracks what's installed)
    ↓
~/.claude/rules/team/     ← rules-dir handler
~/.claude/skills/         ← skills-dir, skills-repo handlers
~/.claude/plugins/        ← marketplace handler

Removals propagate automatically: remove an entry from sources.json, bump version, and the next auto-update uninstalls it for all team members.

Auto-Update Mechanism

When cli.js runs, it registers two shell hook scripts into ~/.claude/settings.json after installation:

cli.js  ──  setupAutoUpdate()
               │
               ├─► ~/.claude/hooks/claude-skills-install-update.sh
               │       Hook type: SessionStart
               │       Throttle:  24 hours
               │       Action:    npm install + run cli.js silently
               │       Output:    systemMessage "claude-skills updated: X → Y"
               │
               └─► ~/.claude/hooks/auto-update-claude-skills.sh
                       Hook type: UserPromptSubmit
                       Throttle:  2 hours
                       Action:    npm view (version check only, no install)
                       Output:    systemMessage "update available: X → Y"

How it works:

1. SessionStart hook — runs once per 24 hours at session startup. Compares the installed version against npm registry. If a newer version exists, downloads and runs it in a temp directory. The new cli.js re-installs all sources from the updated sources.json, effectively propagating any added/removed skills or plugins. Emits a systemMessage to notify the user.

2. UserPromptSubmit hook — runs once per 2 hours when the user submits a prompt. Only checks for a newer version on npm (no install). If found, emits a systemMessage with the update command.

3. Throttle files — stored in ~/.cache/claude-skills-install-check.json and ~/.cache/claude-skills-version-check.json. Each contains a ts field (Unix epoch) to prevent redundant checks within the throttle window.

4. Version pinning — both scripts are generated with the currently installed version baked in as a constant. When a new version is installed, the scripts are regenerated with the new version, resetting the baseline for future comparisons.

Propagation flow (maintainer publishes → team member receives):

Maintainer: edit sources.json → bump version → merge PR → CI publishes to npm
                                                                  ↓
Team member: starts Claude Code session
                                                                  ↓
SessionStart hook fires → detects new version on npm → installs in temp dir
                                                                  ↓
New cli.js runs → reads updated sources.json → installs/uninstalls diff
                                                                  ↓
Manifest updated → hooks regenerated with new version → done

Requirements

• Node.js >= 20
• npm / npx
• Claude Code CLI