Every Claude Code skill I maintain, in one repository

Muhammad Basit Ali — Tue, 13 Oct 2026 04:03:00 +0000

Most of what I ask Claude Code to do at work is the same few jobs: check an AWS account, review a Conditional Access setup, threat model an agent, build an evidence pack for an auditor, tidy a repository. Over the year each of those became a skill, and the skills grew into eleven repositories. This article is about the one repository that now holds all of them, and about where it stops.

Why one repository

Each source repository is its own plugin marketplace. Getting everything meant eleven /plugin marketplace add commands and sixteen /plugin install commands. People asked for one clone.

claude-skills is that clone: 125 skills in 16 plugins, copied from the eleven sources and kept in step with them. The catalog site has one page per skill, so you can read what a skill does before you install anything. The source repositories are still where skills are written, tested and fixed.

What is in it

Agent security (9 skills): agent-threat-model, prompt-injection-review, mcp-server-review and agent-session-log-review for teams building LLM agents.
Agent identity governance (8 skills): an inventory of the non-human identities your agents run as, recertification, credential expiry, and a runbook to switch one off fast.
AWS security (10 skills): aws-account-audit evaluates read-only inventory offline, scp-guardrails builds and lints SCPs, aws-agent-session-audit shows what an agent did in an account from CloudTrail.
Microsoft 365 governance (10 skills): graph-permission-preflight, conditional-access-gap-analysis and copilot-oversharing-readiness, from read-only Graph exports.
Compliance evidence (7 skills): evidence-pack-builder, security-questionnaire-drafter and essential-eight-evidence-map for ISO 27001, SOC 2 and Essential Eight work.
Everyday development (42 skills in six plugins: code-quality, data, debugging, devops, docs, security-basics): for example dead-code-finder, flaky-test-hunter, terraform-apply-gate and diff-security-review.
Repository engineering (12 skills): docs-truth-check, cited-codebase-audit, stale-branch-sweep and plan-grill.
Ways of working (12 skills): change requests from a Terraform plan, an action ledger across meeting notes, exception and risk registers, RFC lint and a decision log.
Claude Code setup (8 skills): review a third-party skill before installing it, lint and evaluate skill descriptions, audit the context budget, build least-privilege permissions.
GitHub management (4 skills) and Mac maintenance (3 skills).

How to install

In Claude Code:

/plugin marketplace add basitalisandhu/claude-skills
/plugin install aws-security@claude-skills

Or clone and copy:

git clone https://github.com/basitalisandhu/claude-skills
cd claude-skills
python3 install.py --user

--user copies every skill into ~/.claude/skills, --project uses the current project's .claude/skills, --only <plugin> narrows the copy and --list prints the catalog. The installer is standard-library Python with no dependencies. Other agents that read the Agent Skills format can install with npx skills add basitalisandhu/claude-skills.

How it stays honest

A workflow runs daily, pulls each source repository and opens a pull request when something has changed, so every update arrives as a diff you can read. SOURCES.json records which repository and commit each skill came from. Every skill description is checked on each sync: double-quoted so strict YAML readers accept it, under 600 characters, with a "Use when" and a "Not for" sentence and a Limits section.

The tests live in the source repositories. If you find a bug, open the issue on the source repository named in SOURCES.json; the fix reaches this repository through the next sync.

What it does not do

The skills run offline on saved exports or on your working tree. The bundled scripts are standard-library Python, make no network calls and send no telemetry. Where a skill needs live data, it tells you which read-only commands to run and then works on the saved output.

Every SKILL.md states what the skill does not do. Read it before you rely on a result: a clean report from secrets-hygiene or iam-least-privilege-review is one signal, not a clearance.

The licence is MIT.

Tell me what is wrong

If a skill gives a wrong answer or claims more than it can show, please open an issue or a pull request on its source repository. Several packs have good first issues open for Hacktoberfest. If a whole pack is missing, open an issue on claude-skills and describe the job it should do.