sshlg-skills

Six agent skills, one command, every agent.

npx sshlg-skills install    # install the whole family
npx sshlg-skills update     # update everything already installed

Works with Claude Code (as plugins) plus Cursor, OpenCode, Codex, Kilo, Kimi, Hermes, OpenClaw, Gemini CLI, Windsurf, Zed and the rest of the 70+ agents the vercel skills CLI supports.

Why

A coding agent is good at writing code and bad at almost everything around it. It builds an interface with no idea who uses it. It calls a task done without checking what was actually asked for. It ships a page that looks generated, on a site no search engine or answer engine can read. And the moment you want it to remember how you work, you are writing a skill — and packaging one correctly is its own afternoon.

Each of these six takes one of those gaps and gives the agent a contract it has to follow. They are documentation, validators and small standard-library scripts. No services, no telemetry, no API keys.

| Skill | Version | What it does | |---|---|---| | super-ux | 0.30.2 | Scenario-driven UI development. A versioned design chain in docs/ux/ — personas and jobs → user flows → a screens-and-states map with Figma frames → traced scenarios → evidence-backed audits → fix plans. One /ux entry point, plus a linter that fails when the docs drift from the code. | | task-pipeline | 1.16.1 | Full-cycle delivery orchestrator. An intake grill interrogates the request into a complete brief, then ten gated stages carry it — docs, brainstorm and decompose, spec, plan, build, tests, deploy, post-deploy, wiki, acceptance — refusing to advance until each gate passes. Documentation is a deliverable with its own portable gate, and the retrospective it leaves behind is traceable to the commit that earned each lesson. | | agent-sync | 1.4.3 | Several agents, one repository, no collisions. Leases with a TTL so two agents cannot claim the same work, race-free id reservation, a run journal and a generated board — over a pluggable knowledge cloud. The answer to "two sessions just committed over each other". | | make-skill | 0.9.1 | A skill that builds skills. Create, retrofit, audit and publish agent skills and Claude Code plugins: conformance to the Agent Skills open standard, Anthropic's platform rules (per-surface runtime limits, the Skills API, evals) and the Claude Code plugin reference, marketplace layout, version sync, validator + CI, every distribution channel, the review checklist for third-party skills, MCP and A2A rules. | | sheleg-design | 1.7.0 | The taste layer. Cinematic scroll-driven landing pages — one scroll clock, motion that degrades to calm, WebGL particle formations — plus product-UI style packs each shipping a ready token layer, and the Figma border: tokens as variables, design to code without hand-copied values. | | seo-aeo-audit | 0.11.2 | Evidence-first website audit for search and answer engines. Ten tracks from crawl access to AI citation mechanics; every finding carries an observation, every recommendation an evidence tier, and the output is a prioritized change plan plus a link-building brief — not a score. |

They compose. task-pipeline hands user-facing work to super-ux and takes its leases from agent-sync; make-skill encodes the repo layout the others are built on; everything installs through the one launcher in this repo.

Install

From npm — nothing to clone:

npx sshlg-skills install

From GitHub — always tracks main:

npx github:ssheleg/sshlg-skills install

Clone with submodules if you want the pinned snapshots and an offline copy:

git clone --recursive https://github.com/ssheleg/sshlg-skills
cd sshlg-skills && ./install.sh

Flags: --agent a,b picks agents, --all covers every agent the CLI supports, --no-claude skips the plugin step, --claude-only does nothing else.

What install actually does

• Claude Code → each skill as a plugin (claude plugin marketplace add + claude plugin install), never as a plain ~/.claude/skills/ copy.
• Every other agent → the vercel skills CLI, installed globally into ~/.agents/skills/, with the agent list passed as repeated --agent flags.
• Then it prunes the plain Claude copies the skills CLI recreates on its own. That duplicate shadows your plugin and silently serves a stale skill — the one failure mode worth automating away.

Just one skill?

Every skill installs standalone; see its own README. For example:

npx skills add ssheleg/seo-aeo-audit

claude plugin marketplace add ssheleg/seo-aeo-audit && claude plugin install seo-aeo-audit@seo-aeo-audit

Update

npx sshlg-skills install              # nothing installed yet — the whole family, any agent
npx sshlg-skills update               # installed but behind — updates everything
npx --yes sshlg-skills@latest list    # what the current release of each member is

The three commands are the whole interface: install when nothing is there, update when it is there and behind, list to see what the current release of each member is. A member updated on its own leaves the bundle in a combination nobody tested, which is why update takes no member argument.

Updates every skills-CLI install and every Claude Code plugin, and materializes the pinned submodules in a checkout without moving the pins. Restart Claude Code afterwards.

Flags: --no-claude, --claude-only, and --bump-pins — off by default so a checkout stays reproducible; pass it when you deliberately want the submodules fast-forwarded to their upstream tips. update targets whatever is already installed, so it takes no --agent.

Update through the launcher, not through a bare npx skills update <id>. Without an explicit --agent list the skills CLI auto-detects Claude Code and re-creates ~/.claude/skills/<id> — a plain copy that then shadows your plugin. The launcher passes the agent list explicitly and prunes those copies after every run.

Routing — making the family engage by default

A skill's description influences whether a model reaches for it. It does not oblige. So the pack writes a managed routing block into your global agent instructions (~/.claude/CLAUDE.md, ~/.codex/AGENTS.md), and the rules engage in every project instead of only when someone remembers to ask.

npx sshlg-skills routers              # write it (asks once)
npx sshlg-skills routers --dry-run    # show the diff, change nothing
npx sshlg-skills routers --update     # refresh an existing block, never create one

Eight routers, and they are different axes rather than competing priorities — a landing page passes several, an internal script passes none:

| Router | Answers | When | Needs installed | |---|---|---|---| | super-ux | what the interface must do | there is user-facing behaviour | super-ux | | sheleg-design | how it looks and moves | there is a visual layer | sheleg-design | | copywriting | how it sounds | text a product user will read | super-ux | | seo-llmo | whether a machine will find it | a logged-out reader can see it | — | | evidence-docs | what proves it | something is stated as true | — | | task-pipeline | how the change reaches the repo | the repository changes | task-pipeline | | make-skill | how the skill itself is built | a skill or plugin changes shape | make-skill | | agent-sync | who is holding this file | the project has coordination on | agent-sync |

Two of them need no skill behind them. seo-llmo and evidence-docs are rules, not tools, so they hold whether or not anything is installed.

Your own wording wins. Where you already wrote a rule by hand, migration moves your text in verbatim — asides included — and the packaged default is used only for a router you never wrote.

Consent is asked once, recorded, and never asked again. Declining leaves an SSHLG:ROUTERS:OPTOUT marker, which the block's own header names as the way out and which survives a reinstall and a restored dotfile. Everything outside the sentinels is preserved byte for byte.

Turning routers off

npx sshlg-skills config                                  # what this machine wants
npx sshlg-skills config set routers.seo-llmo off
npx sshlg-skills routers --update                        # apply it

Switching a router off removes its section and drops its table row. Switching it back on restores the exact bytes that were there — including wording of yours that migration had moved in. Settings live in ~/.sshlg-skills/config.json (mode 0600) and store deviations only, so a router added in a later release arrives switched on rather than silently off.

Other commands

npx sshlg-skills list      # the family, versions and descriptions
npx sshlg-skills agents    # supported agent ids

How it works

A thin, zero-dependency Node launcher over the three mechanisms that already reach these agents — the skills CLI (70+ agents), claude plugin (Claude Code), and git submodule (pinned snapshots). It invents no new install path. It curates the family, drives those three, and encodes the rules that are easy to get wrong: one channel per agent, exact agent ids, repeated --agent flags, full <name>@<name> plugin ids, and pruning shadow copies.

skills.json                  registry — repos, plugin ids, skill names, pins
skills/*                     the six skills as pinned git submodules
bin/sshlg-skills.js          the launcher (install / update / routers / config / list / agents)
lib/routers-registry.js      the eight routers — text, table row and required members, in one entry
lib/routers.js               block parsing and rendering; touches no file, by construction
lib/apply.js                 the only module that writes to the instruction files
lib/migrate.js               moves hand-written rules in; never reads inside the block
lib/config.js, lib/store.js  the pack's settings, and the 0600 discipline they share
install.sh                   POSIX fallback (macOS/Linux; use npx on Windows)
test/run.js                  `npm test` — the validator, then every discovered suite
test/validate.py             registry / submodules / version validation
.github/workflows            validation on push and PR + tag-driven release

skills.json is the source of truth — repos, submodule paths, plugin ids, skill names, default agents and each skill's pinned version. The validator keeps it in sync with .gitmodules and with the submodule pointers, so checking out any hub commit installs exactly the skill versions that commit was tested with.

Development

npm test

One entry point: it runs the structural validator, then discovers every test/*_test.js rather than listing them — a list would live in package.json and in the workflow at once, and drift the first time a suite was added to one side. An empty run fails rather than reporting green, and validate.py fails if CI stops calling npm test.

python3 test/check_pins.py

Kept out of npm test on purpose: it queries the npm registry, and the rest must work offline.

Releases are tag-driven: bump skills.json, package.json and the top CHANGELOG.md entry together, tag vX.Y.Z, and the release workflow cuts the GitHub release from the matching changelog section.

Contributions are welcome — see CONTRIBUTING.md. To report a vulnerability, see SECURITY.md.

Author

Built by ssheleg — sshlg.me

• X / Twitter — @sshlg93
• Telegram — @sshlg

License

MIT © 2026 ssheleg.