Everything Claude Code (affaan-m/ECC) is one repo holding 311 skills. The repo carries about 285,000 GitHub stars. The most installed skill inside it, security-review, has 18,189 installs. Both numbers are real. Only one of them changes what you put in ~/.claude/skills.
We run the Skillselion agent skills directory, which ranks skills by installs, so we see this gap on every monorepo kit.
Here is the per-skill picture, pulled from the live catalog this morning, plus what we found reading the repo at commit 90606c8.
What do GitHub stars tell you about which skill to install?
A star is one click on one repo. An install is a developer choosing one folder out of 311. ECC's star count puts it near the top of all of GitHub (about 285,000 stars and about 42,000 forks, GitHub API, October 21, 2026). Its install counts put each skill in a much narrower band. Every row below is a skill inside affaan-m/ECC:
| Skill | Installs | What it covers |
|---|---|---|
| security-review skill (SKILL.md) | 18,189 | A 10-section checklist for auth, input, secrets, payments |
| golang-patterns skill (SKILL.md) | 15,530 | Idiomatic Go: errors, concurrency, interfaces, package layout |
| backend-patterns skill (SKILL.md) | 15,123 | API, database, caching and background jobs on Node and Next.js |
| frontend-patterns skill (SKILL.md) | 14,935 | React and Next.js components, state, forms, accessibility |
| coding-standards skill (SKILL.md) | 14,797 | The shared floor for naming and readability |
| tdd-workflow skill (SKILL.md) | 12,313 | Tests before the code |
| configure-ecc skill (SKILL.md) | 10,512 | Changes scope and hook profile after install |
Install counts: skills.sh registry via the Skillselion catalog, pinned October 21, 2026 at 08:26 UTC. They move during the day, so treat them as a ranking, not a scoreboard.
The number worth sitting with: the top skill in a repo with a quarter of a million stars is out-installed by a same-named skill from a repo with 1,075 stars. The security-review skill from getsentry (repo) is on 20,611 installs, against ECC's 18,189. Stars followed the kit. Installs followed the file.
Why does the repo hold 1,062 SKILL.md files if it ships 311?
Because most of them are copies for other harnesses and translations. We walked the git tree at 90606c8 and counted: 311 SKILL.md files under skills/, which matches the README, and 1,062 in the repo overall. The root has per-harness folders for .codex, .cursor, .gemini, .kiro, .qwen, .zed, .openclaw and a dozen more.
This matters if you clone instead of installing. A grep for SKILL.md in a checkout returns a number three times the advertised one, and the duplicates are not all identical, so you can end up reading the Codex copy while Claude Code loads the canonical one.
What does the most installed ECC skill actually check?
Ten numbered sections, in this order: secrets management, input validation, SQL injection prevention, authentication and authorization, XSS prevention, CSRF protection, rate limiting, sensitive data exposure, blockchain security (Solana), then dependency security. Section 9 is the one nobody expects in a general-purpose kit, and it is there in the file at HEAD.
The skill is prescriptive rather than analytical. It pairs a FAIL block with a PASS block, so the secrets section opens with a hardcoded "sk-proj-xxxxx" and answers it with process.env.OPENAI_API_KEY plus a throw when the variable is missing. Its closing line is blunt:
Remember: Security is not optional. One vulnerability can compromise the entire platform. When in doubt, err on the side of caution.
Source: skills/security-review/SKILL.md at commit 90606c8, closing line.
Two stack assumptions come with it. Section 1 closes with a checkbox for production secrets living in Vercel or Railway, and the pre-deployment checklist carries a row for row level security in Supabase. Useful if that is your stack, noise if it is not. If you want the field compared instead, the best security skills for Claude Code shortlist ranks it against the alternatives.
What do the rules packs cost per session?
The rules/ folder holds 22 packs at HEAD: common plus 21 language and framework packs, from angular and arkts through rust, swift, typescript and vue. The README calls rules "always-loaded context", so this is the one folder where copying everything has a running cost.
rules/common alone is 10 files and 19,408 bytes of markdown, so roughly 19 KB: agents.md, code-review.md, coding-style.md, development-workflow.md, git-workflow.md, hooks.md, patterns.md, performance.md, security.md, testing.md. The README gives the reason you have to place them yourself, "Claude Code plugins cannot distribute rules", and then tells you to copy rules/common plus one language pack into ~/.claude/rules/ecc/. It also says to copy the whole language directory rather than the files inside it, so relative references keep working and filenames do not collide. Take that advice literally. Copying all 22 is how a session starts with a few hundred lines of standards for languages your project does not contain.
Can you install one skill instead of the kit?
Yes, and for most people that is the right call. The route the ECC README documents runs from a clone:
./install.sh --target claude --skills security-review
The README's own example passes two names at once, --skills tdd-workflow,security-review, so one name is the same flag with a shorter list. If you would rather not clone, the skills.sh CLI takes a repo URL and a skill name directly:
npx skills add https://github.com/affaan-m/ECC --skill security-review
That second command comes from the skills.sh CLI command reference, which documents both the full GitHub URL source format and -s, --skill. It is not in the ECC README, so do not go looking for it there.
For the whole kit there are two routes. The guided setup:
npx ecc-universal@2.2.3 setup
Or the plugin, from inside Claude Code:
/plugin marketplace add https://github.com/affaan-m/ECC
/plugin install ecc@ecc
2.2.3 is the version in the repo's VERSION file at HEAD, so the pinned command above is current today. Where each skill lands on disk is covered in the guide to installing a Claude skill.
What goes wrong when you install the whole ECC kit?
Stacking two install methods into one harness. The README is specific about the boundary: "Installing ECC twice into the same harness can duplicate skills, commands, hooks, or configuration; installing it once into multiple harnesses does not." So one route per harness, and installing into Claude Code and Codex separately is fine.
Installing the skill named everything-claude-code. It sounds like the installer. It is a conventions skill for people who send PRs to the repo, on 7,002 installs: see the everything-claude-code skill listing. Worth knowing that at HEAD there is no skills/everything-claude-code/ folder in the repo any more. The equivalent file has moved to .agents/skills/ecc-conventions/SKILL.md, and registries now carry it twice, the second time as everything-claude-code-conventions on 7,038 installs. Neither row is the installer.
Pulling from a mirror. The README names the official channels and then says, of the rest, "Third-party re-uploads and unofficial mirrors are not maintained or reviewed by the project and may contain malware." That is a direct quote from the README at 90606c8, and with a repo this forked it is the warning to take seriously.
Reading a count from a changelog. The README carries a v2.0.0 line that says 281 skills, 67 agents and 94 command shims. Those are the old numbers. The current ones, 311, 71 and 97, sit in the overview table near the top of the same file, about 1,700 lines above the changelog entry.
Which ECC skills should you install first?
Start with security-review and the one pattern skill for your stack, plus rules/common and a single language pack. Add tdd-workflow if you want tests written first. Only reach for the full plugin when you want the hooks, the agents and AgentShield as well, and then let configure-ecc set the scope rather than hand-editing.
The full section-by-section read, with the install counts and the install methods side by side, is in our Everything Claude Code skills guide. For kits from other publishers, the best skills for AI agents shortlist ranks them against each other rather than by stars.
If you have taken the whole kit and kept it, I want to hear which hooks earned their place. That is the part install counts cannot show.
Last updated October 21, 2026.
Disclosure: we run Skillselion, an independent directory and not affiliated with Anthropic, OpenAI or Cursor. Install counts come from the live catalog, refreshed daily from skills.sh, GitHub and MCP registries, ranked by real installs. Repo counts, file counts and quotes in this post were read from affaan-m/ECC at commit 90606c8 on October 21, 2026; star and fork counts are from the GitHub API on the same date.
Top comments (0)