mattpocock/skills

Review signals: 7 known vulnerability.

OSV reports a known vulnerability in this dependency version. js-yaml 7 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The documented npx installer adds the skills to the project, and they can be listed back: Real input produced the expected result: tdd

  Source: npx skills@latest add mattpocock/skills -a <agent> # cursor, opencode, devin, windsurf, amp, pi; omit -a to choose

  Input: skills list in the project where skills add ran

  Expected: installed skill list includes tdd

  Command: npx skills@latest list

  Observed: tdd  ./.claude/skills/tdd  Agents: Claude Code Source: mattpocock/skills teach  ./.claude/skills/teach  Agents: Claude Code Source: mattpocock/skills to-questionnaire  ./.claude/skills/to-questionnaire  Agents: Claude Code Source: mattpocock/skills to-spec  ./.claude/skill

• The tdd skill is installed and can be slotted into a project: Real input produced the expected result: tdd

  Source: I've built a **[`/tdd`](./skills/engineering/tdd/SKILL.md) skill** you can slot into any project.

  Input: skills list in the project where skills add ran

  Expected: installed skill list includes tdd

  Command: npx skills@latest list

  Observed: tdd  ./.claude/skills/tdd  Agents: Claude Code Source: mattpocock/skills teach  ./.claude/skills/teach  Agents: Claude Code Source: mattpocock/skills to-questionnaire  ./.claude/skills/to-questionnaire  Agents: Claude Code Source: mattpocock/skills to-spec  ./.claude/skill

Examples

• Repo check that the plugin version is in sync with package.json: command completed successfully

  Source: package.json scripts.check-plugin-version

  Input: --check

  Expected: plugin.json version is 1.3.1 (already in sync)

  Command: npm run check-plugin-version

  Observed: > [email protected] check-plugin-version > node scripts/sync-plugin-version.mjs --check plugin.json version is 1.3.1 (already in sync)

• Lists every SKILL.md in the repo (dev-only listing script): command completed successfully

  Source: scripts/list-skills.sh

  Input: no arguments

  Expected: prints skill paths including skills/engineering/tdd/SKILL.md

  Command: bash scripts/list-skills.sh

  Observed: -deep-modules/SKILL.md skills/in-progress/writing-beats/SKILL.md skills/in-progress/writing-fragments/SKILL.md skills/in-progress/writing-shape/SKILL.md skills/misc/git-guardrails-claude-code/SKILL.md skills/misc/migrate-to-shoehorn/SKILL.md skills/misc/scaffold-exercises/SKILL.md skills/misc/setup-pre-commit/SKILL.md skills/productivity/grill-me/SKILL.md skills/productivity/grilling/SKILL.md skills/productivity/handoff/SKILL.md skills/productivity/teach/SKILL.md skills/productivity/to-questionnaire/SKILL.md skills/productivity/wait-what/SKILL.md skills/productivity/writing-for-agents/SKILL.md

Local or hosted: local

Install the skills from mattpocock/skills with the README's npx installer, then list the installed skills (including tdd) and run the repo's documented check scripts.

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat /etc/os-release | head -2; ls /inputs 2>&1; ls <guest-path> 2>&1
cd <guest-path> && find . -maxdepth 2 -not -path './.git/*' | head -100; echo ---; cat README.md 2>/dev/null | head -200
cd <guest-path> && sed -n 200,400p README.md; echo ---PKG; cat package.json; echo ---SCRIPTS; ls scripts; cat scripts/list-skills.sh | head -40; echo; ls .coldpass
cd <guest-path> && ls -la .coldpass; grep -n -i "script\|npm\|npx\|test\|link-skills\|list-skills\|cron\|webhook\|--once" README.md | head -60; echo ---; cat scripts/link-skills.sh | head -60; echo ---; wc -l <guest-path>; head -60 <guest-path>
cd <guest-path> && (git init -q 2>&1; git remote add origin https://github.com/mattpocock/skills 2>&1; git fetch --depth 1 origin 5beb35b040e3de97e54fa9e386d7e42d15c295c2 2>&1; git reset --mixed FETCH_HEAD 2>&1; git log --oneline -1 2>&1; git status --short | head -5); echo ---; which node npm npx git curl; node --version 2>&1; npm --version 2>&1; echo "proxy=$HTTPS_PROXY $HTTP_PROXY"
sudo -n true && echo SUDO_OK; apt-cache policy nodejs 2>/dev/null | head -3; curl -sI https://registry.npmjs.org/ 2>&1 | head -1; curl -sI https://github.com 2>&1 | head -1
(sudo -n apt-get update -qq 2>&1 | tail -3; sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nodejs npm 2>&1 | tail -5); node --version; npm --version
cd /tmp && export NODE_USE_ENV_PROXY=1 && timeout 240 npx --yes skills@latest --help 2>&1 | tail -60; echo EXIT=$?
cd /tmp && export NODE_USE_ENV_PROXY=1 && curl -fsSL https://nodejs.org/dist/latest-v22.x/SHASUMS256.txt -o /tmp/shasums.txt && NODEF=$(grep -o 'node-v22\.[0-9.]*-linux-x64\.tar\.xz' /tmp/shasums.txt | sort -V | tail -1) && echo $NODEF && curl -fsSL https://nodejs.org/dist/latest-v22.x/$NODEF -o /tmp/$NODEF && mkdir -p /tmp/node22 && tar -xJf /tmp/$NODEF -C /tmp/node22 --strip-components=1 && /tmp/node22/bin/node --version && /tmp/node22/bin/npm --version
export PATH=/tmp/node22/bin:$PATH NODE_USE_ENV_PROXY=1 && cd /tmp && node --version && timeout 240 npx --yes skills@latest --help 2>&1 | tail -60; echo EXIT=$?
export PATH=/tmp/node22/bin:$PATH NODE_USE_ENV_PROXY=1 DISABLE_TELEMETRY=1 DO_NOT_TRACK=1 && mkdir -p /tmp/skills-trial && cd /tmp/skills-trial && timeout 280 npx --yes skills@latest add mattpocock/skills -a claude-code -y 2>&1 | sed 's/\x1b\[[0-9;]*m//g' | tail -60; echo EXIT=${PIPESTATUS[0]}
export PATH=/tmp/node22/bin:$PATH NODE_USE_ENV_PROXY=1 DISABLE_TELEMETRY=1 DO_NOT_TRACK=1 && cd /tmp/skills-trial && timeout 200 npx --yes skills@latest list 2>&1 | sed 's/\x1b\[[0-9;]*m//g' | head -30; echo; ls .claude/skills | wc -l; ls .claude/skills | head -50; echo; cat .claude/skills/tdd/SKILL.md | head -12
cd <guest-path> && sudo -n ln -sf /tmp/node22/bin/node /usr/local/bin/node && sudo -n ln -sf /tmp/node22/bin/npm /usr/local/bin/npm && sudo -n ln -sf /tmp/node22/bin/npx /usr/local/bin/npx && which node npm npx && node --version; echo ---; grep -n -i "npm\|node\|check-plugin\|scripts/\|test" CLAUDE.md .github/workflows/* | head -30; echo ---; grep -rn -i "cron\|schedule\|webhook\|--once\|setInterval" --include=*.md --include=*.sh --include=*.mjs --include=*.json . 2>/dev/null | grep -v node_modules | grep -v CHANGELOG | head -15
cd <guest-path> && cat .gitignore; echo ---; timeout 280 npm ci 2>&1 | tail -5; echo EXIT=$?; timeout 120 npm run check-plugin-version 2>&1 | tail -8; echo EXIT=${PIPESTATUS[0]}
cd <guest-path> && grep -n -F "npx skills@latest add mattpocock/skills -a <agent>  # cursor, opencode, devin, windsurf, amp, pi; omit -a to choose" README.md; grep -n -F "you can slot into any project." README.md; grep -n -F "Use it as soon as" README.md | head -1; mkdir -p .coldpass && ls -la .coldpass
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"cli","argv":["npx","skills@latest","list"],"cwd":"/tmp/skills-trial","env":{"NODE_USE_ENV_PROXY":"1","DISABLE_TELEMETRY":"1","DO_NOT_TRACK":"1"},"expected_text":"tdd"}
EOF
cat > claims.json <<'EOF'
[
 {"kind":"claim","claim":"The documented npx installer adds the skills to the project, and they can be listed back","source":"npx skills@latest add mattpocock/skills -a <agent>  # cursor, opencode, devin, windsurf, amp, pi; omit -a to choose","input":"skills list in the project where skills add ran","expected":"installed skill list includes tdd","probe_kind":"cli","argv":["npx","skills@latest","list"],"cwd":"/tmp/skills-trial","env":{"NODE_USE_ENV_PROXY":"1","DISABLE_TELEMETRY":"1","DO_NOT_TRACK":"1"},"expected_text":"tdd"},
 {"kind":"claim","claim":"The tdd skill is installed and can be slotted into a project","source":"I've built a **[`/tdd`](./skills/engineering/tdd/SKILL.md) skill** you can slot into any project.","input":"skills list in the project where skills add ran","expected":"installed skill list includes tdd","probe_kind":"cli","argv":["npx","skills@latest","list"],"cwd":"/tmp/skills-trial","env":{"NODE_USE_ENV_PROXY":"1","DISABLE_TELEMETRY":"1","DO_NOT_TRACK":"1"},"expected_text":"tdd"}
]
EOF
cat > examples.json <<'EOF'
[
 {"kind":"example","claim":"Repo check that the plugin version is in sync with package.json","source":"package.json scripts.check-plugin-version","input":"--check","expected":"plugin.json version is 1.3.1 (already in sync)","argv":["npm","run","check-plugin-version"],"cwd":"<guest-path>","env":{},"expected_text":"already in sync"},
 {"kind":"example","claim":"Lists every SKILL.md in the repo (dev-only listing script)","source":"scripts/list-skills.sh","input":"no arguments","expected":"prints skill paths including skills/engineering/tdd/SKILL.md","argv":["bash","scripts/list-skills.sh"],"cwd":"<guest-path>","env":{},"expected_text":"skills/engineering/tdd/SKILL.md"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: README.md, package.json scripts (check-plugin-version, version), scripts/list-skills.sh, scripts/link-skills.sh, CLAUDE.md, .github/workflows (release.yml/triage-label.yml/needs-info.yml are GitHub CI triggers, not product cycles). The product is a set of Markdown agent skills with no cron, loop, webhook, --once or --now entry point. Schedules appear only as advice to the agent inside skills such as chief-of-staff and loop-me, so there is no product-run cycle to trigger.","checks":[]}
EOF
for f in probe.json claims.json examples.json cycles.json; do python3 -I -m json.tool $f >/dev/null && echo "$f ok"; done
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -80; echo EXIT=${PIPESTATUS[0]}
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install the skills from mattpocock/skills with the README's npx installer, then list the installed skills (including tdd) and run the repo's documented check scripts.","operation_scope":"Linux Ubuntu 24.04 guest, Node.js >= 22.20 (the skills CLI refuses Node 18), network access to GitHub and npm. Installs into a scratch project at /tmp/skills-trial (outside the checkout) for the claude-code agent. Not exercised: the Claude Code plugin install, scripts/link-skills.sh (dev-only, writes to ~/.claude), and any agent actually loading a skill.","steps":["git init; git remote add origin https://github.com/mattpocock/skills; git fetch --depth 1 origin 5beb35b040e3de97e54fa9e386d7e42d15c295c2; git reset --mixed FETCH_HEAD","sudo apt-get install -y nodejs npm (gave Node v18.19.1, too old for the skills CLI)","curl node-v22.23.4-linux-x64.tar.xz from nodejs.org into /tmp/node22; symlinked node/npm/npx into /usr/local/bin","npx --yes skills@latest --help (from /tmp)","npx --yes skills@latest add mattpocock/skills -a claude-code -y (run in /tmp/skills-trial, DISABLE_TELEMETRY=1 DO_NOT_TRACK=1)","npx skills@latest list (in /tmp/skills-trial): 38 skills, including tdd","npm ci (in checkout, per release.yml)","npm run check-plugin-version: plugin.json version is 1.3.1 (already in sync)","bash scripts/list-skills.sh: lists SKILL.md paths including skills/engineering/tdd/SKILL.md","python3 -I <guest-path> --validate --replay: valid, no problems, replay PASS"],"deviations":["Ubuntu's apt nodejs (v18.19.1) is below the skills CLI requirement (node >= 22.20); npx skills failed with a SyntaxError on styleText. Substituted a user-local Node 22.23.4 tarball from nodejs.org and linked it into /usr/local/bin.","The README's installer was run non-interactively with -a claude-code -y (the README's interactive prompt cannot run in this guest).","Replay details report working:false and evidence_strength partly_checked: the replayed operation is a read-back of the installed skill list, not a fresh install or an agent loading a skill. The claims themselves were judged yes.","Telemetry declined via DISABLE_TELEMETRY=1 and DO_NOT_TRACK=1."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for this product. Optional: the skills CLI should document its Node >= 22.20 requirement in the README install section, since the README does not mention it."}
EOF
python3 -I -m json.tool report.json >/dev/null && echo report ok; ls -la; cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json; d=json.loads(sys.stdin.read()); print('valid',d['valid'],'problems',d['problems'],'replay',d['replay']['status'])"