Agent Skills Are the New Dotfiles

Five of the top eight repos on GitHub Trending right now are agent infrastructure. obra/superpowers sits at 252,000 stars. mattpocock/skills crossed 165,000 — gaining 10,800 per week — and addyosmani/agent-skills holds at 77,000. Combined, just these three repos account for nearly half a million stars. The Cambrian explosion of agent skills is the biggest open-source trend of 2026, and it shows no sign of slowing.

📖 Read the full version with charts and embedded sources on AgentConn →

But here is the thesis nobody with a trending repo wants to say out loud: star velocity is measuring enthusiasm, not maturity. The real question is not which skills directory to install. It is whether the ecosystem converges on a portable standard — or fragments into another generation of vendor-locked config files that each need their own find-and-replace when you switch tools.

The Dotfiles Analogy Is Precise (And That Should Worry You)

Dotfiles — .bashrc, .vimrc, .gitconfig — are the original "configuration as competitive advantage." Senior engineers have maintained them for decades, and the pattern is remarkably similar to what is happening with agent skills today. You find a configuration that makes you productive. You version-control it. You share it on GitHub. Others fork it. Opinionated collections accumulate stars.

And here is the part the analogy's boosters skip: dotfiles never standardized. There is no RFC for .bashrc structure. No committee blessed a canonical .vimrc layout. The ecosystem thrived anyway, but switching costs remained real, and every new tool that arrived (zsh, fish, neovim) required translation work. Skills are following the same arc — fast, organic, decentralized — and they may land in the same place.

The blog post "Dotfiles: Taming Your Dev Environment (and Your AI Coding Agents)" makes the connection explicit: "The developers who get the most out of Claude Code in 2026 are the ones who treat their skill folder like a dotfiles repo: small, opinionated, version-controlled, and always shrinking back toward the things that actually earn their keep."

That is good advice. But it assumes a stable target. Right now, the target is moving.

The Three Repos: Philosophy, Not Just Star Count

The star counts are easy to report. The differences in philosophy are what actually matter for practitioners choosing where to invest.

obra/superpowers — The Methodology (252K Stars)

Jesse Vincent's Superpowers is not a skills collection. It is an opinionated software development methodology that happens to be packaged as skills. Superpowers enforces a specific workflow: Socratic design refinement before coding, red-green-refactor test-driven cycles, subagent-driven development with two-stage review, and systematic debugging over ad-hoc approaches.

The skills activate based on context — design phase, implementation, review — creating a mandatory workflow rather than optional tools. This is the most prescriptive option: you get Superpowers' engineering philosophy or you get nothing. It works for teams that want guardrails. It frustrates teams that want a la carte.

Superpowers installs as a plugin across 10+ coding agents (Claude Code, Codex, Cursor, Copilot CLI, and more), which is the strongest portability story of the three.

mattpocock/skills — The Curated Toolkit (165K Stars)

Matt Pocock's Skills for Real Engineers (165K stars, v1.1.0 released July 8) takes the opposite approach. Seventeen skills, organized into Engineering (10) and Productivity (7), drawn from Pocock's own .claude directory. The repo is explicit about its design philosophy: small, composable tools rather than an opinionated framework.

The growth trajectory tells a story. The repo went from 29,400 stars on April 27 to 165,000 in ten weeks — a +6,175-star day at its peak, holding the number-two spot on GitHub Trending for six consecutive days. That velocity is partly Pocock's existing audience (he is already well-known in the TypeScript community), but it also reflects genuine demand for curated, practical skill collections over sprawling directories.

The limitation: these skills are drawn from one engineer's workflow. They reflect TypeScript-heavy, test-driven, refactor-focused development. If your stack is Python ML pipelines or Go infrastructure, the value proposition is thinner.

addyosmani/agent-skills — The Production Guardrails (77K Stars)

Addy Osmani's agent-skills (77K stars) positions itself around a specific problem: AI agents default to the shortest path, bypassing specs, tests, and security reviews. The 24 skills encode workflows, quality gates, and best practices with three differentiators:

1. Verification-first: Every skill mandates evidence — tests passing, build output, runtime data — rejecting outcomes that merely "seem right."
2. Anti-rationalization tables: Each skill documents common excuses agents use to skip steps ("I'll add tests later") alongside documented counter-arguments.
3. Process over prose: Skills function as actionable workflows with steps, checkpoints, and exit criteria rather than reference documentation.

The npx skills add addyosmani/agent-skills installation path via the open skills CLI makes this the easiest of the three to adopt incrementally — install one skill at a time, not the whole philosophy.

The Standards Landscape: Four Formats, One Problem

The fragmentation problem is real and already well-documented. For most of 2024 and 2025, every AI coding tool invented its own configuration format.

Format	Path	Owner	Supported By
AGENTS.md	Repo root	Linux Foundation / AAIF	20+ agents (Codex, Cursor, Copilot, Gemini CLI, Aider, Windsurf, Zed)
CLAUDE.md	Root + ~/.claude/	Anthropic	Claude Code
SKILL.md	~/.claude/skills/<name>/	Anthropic	Claude Code, Codex CLI, Gemini CLI, Copilot
.cursor/rules/*.mdc	.cursor/rules/	Cursor	Cursor only

AGENTS.md has the broadest adoption — 60,000+ public repos as of May 2026 — after OpenAI proposed it in August 2025 and donated it to the Linux Foundation's Agentic AI Foundation in December 2025. SKILL.md has the richest feature set: frontmatter metadata, progressive disclosure (description loaded first, full instructions on demand), and support for helper scripts and assets. Cursor's MDC rules have the most sophisticated activation logic (glob-scoped, conditional). CLAUDE.md has the deepest platform integration (three-layer memory model with auto-memory).

The practical advice from every comparison article converges: start with AGENTS.md for project-wide conventions, add SKILL.md for task-specific capabilities, and only add vendor-specific formats if you have a real need. But "start with AGENTS.md" is cold comfort when the skill you want to install was written for CLAUDE.md and references Anthropic-specific features.

A separate HN thread on evaluating AGENTS.md digs into whether these config files actually help — the answer is "it depends on who wrote them," which is the kind of unsatisfying truth that a 250K-star ecosystem does not want to hear.

What the Community Is Actually Saying

The 544-point Hacker News thread on Agent Skills (260 comments) captures the tension perfectly.

The skeptics invoke the bitter lesson. User iainmerrick argues: "All you need to do is provide the LLM with good clear documentation." The implication is that SKILL.md's folder structures and frontmatter requirements are bikeshedding — well-written prose already works.

The pragmatists counter with resource constraints. smithkl42 points out the context-window problem: "If we were to put them all in CLAUDE.md, we wouldn't have any context left for coding." Skills solve a real engineering problem — modular, on-demand loading that does not consume your entire context budget on boot.

The most revealing comment comes from postalcoder, who cites empirical evidence: "Codex + skills finetunes Qwen3-0.6B to +6 on HumanEval." But then notes that Vercel reportedly found AGENTS.md outperforms skills in their evaluations. The data does not agree with itself yet. That should tell you something about the maturity of this space.

And rvz delivers the punchline the entire thread is building toward: "There are 14 competing standards." The xkcd reference is evergreen because the pattern is evergreen.

⚠️ The Contrarian Take: Maybe fragmentation is fine. Dotfiles never converged and the ecosystem thrived. Skills are just markdown files — the switching cost is a find-and-replace, not a database migration. The "we need a standard" crowd may be solving a problem that does not exist yet. The real risk is not fragmentation but premature standardization that locks in the wrong abstractions before the ecosystem figures out what skills actually need to contain.

Star Velocity Does Not Equal Maturity

Here is a number that should give pause: an ETH Zurich study found that LLM-generated context files lowered task success by approximately 3% versus baseline while raising inference cost by 20%+. Human-authored files showed a modest 4% improvement.

This means that the most popular skills — the ones accumulating thousands of stars per day — may actually be making agents worse if they are poorly authored. Star count measures discoverability and social proof, not quality. A skill with 50,000 stars and vague instructions can actively degrade agent performance compared to no skill at all.

The Snyk ToxicSkills research adds a security dimension: 36% of agent skills on the ClawHub marketplace contain exploitable security flaws, with 1,467 malicious payloads identified. We covered this in depth in Config Files That Run Code: The Agent Skill Supply Chain — the TL;DR is that skills execute on load, and the ecosystem has no equivalent of npm audit for skill directories.

ℹ️ The Signal in the Noise: The repos that matter are the ones where the maintainer ships fewer skills, not more. Pocock's 17 skills at 165K stars versus collections with 345+ skills tells you that curation is winning over comprehensiveness. The best skill directories look more like a senior engineer's dotfiles — 10-20 opinionated, battle-tested configs — than a package registry.

The .claude/ Folder as the New .config/

The discussion around the anatomy of the .claude/ folder on HN reveals how quickly the configuration surface area has grown. What started as a single CLAUDE.md file now spans skills directories, MCP server manifests, hooks, plugins, and memory files — a complexity budget that looks suspiciously like the .config/ sprawl that dotfiles managers were invented to tame.

Meanwhile, a Show HN post curating 1,000 skills from 60,000+ GitHub skill repos demonstrates both the scale of the ecosystem and the discovery problem it creates. When there are 60,000 skill repos on GitHub, curation is no longer a convenience — it is infrastructure.

What a Good Skills Directory Actually Contains

If you are starting from scratch or auditing your current setup, here is what the teams shipping real software with agent skills have converged on:

1. A project-level AGENTS.md that describes your codebase conventions, architecture, and constraints. This is the file every agent reads first. Keep it under 2,000 tokens — the ETH Zurich data says more context is not better context.

2. Five to ten task-specific SKILL.md files covering your actual workflows: test-driven development, code review, deployment, debugging, and domain-specific tasks. Each should be a workflow with steps and exit criteria, not a reference document. Osmani's anti-rationalization tables are a good pattern — they anticipate and block the shortcuts agents will try to take.

3. Version control and code review for skills. Your skills directory should live in your repo under .agents/skills/ or .claude/skills/, not in a personal dotfiles repo that only you maintain. When skills travel with the codebase, every new contributor gets the project's conventions automatically.

4. A security audit step. Before installing any third-party skill, read the SKILL.md and every script it references. Check for postinstall hooks, shell commands, or network calls. The 36% malicious-payload rate is not an abstract risk — it is the current state of the ecosystem.

5. A kill switch. Skills that are not earning their keep should be deleted, not accumulated. The developers in the HN thread who reported the best results were the ones who described their skills folder as "always shrinking back toward the things that actually earn their keep."

What This Means for You

If you are building with coding agents today, three things are true simultaneously:

The skills ecosystem is real and valuable. The gap between an unconfigured agent and a well-skilled one is significant enough that teams are investing serious engineering time in their skill directories. This is not hype — it is the same pattern that made dotfiles, linters, and CI/CD configurations worth maintaining.

The standards question is unresolved. AGENTS.md has the broadest support. SKILL.md has the richest features. Neither has won. Bet on portability: write skills as plain markdown with minimal vendor-specific features, and you minimize the translation cost when the landscape shifts.

Star count is a terrible proxy for quality. A trending repo with 100,000 stars and AI-generated skills can make your agent worse. A focused collection of 15 human-authored skills from a senior engineer who uses them daily will make your agent better. Audit before you install. Delete what does not work. Treat your skills directory like the production infrastructure it is.

The dotfiles analogy is precise. And like dotfiles, the engineers who win are not the ones with the most configuration — they are the ones whose configuration is the most intentional.

---

For more on agent infrastructure security, see Config Files That Run Code: The Agent Skill Supply Chain. For how skills fit into multi-agent orchestration, see The Agent-of-Agents Problem. And for the memory side of agent configuration, see AI Agent Memory in 2026.

Originally published at AgentConn