Three checks before you install an agent skill

THE SIGNAL / 01

A skill is instructions your agent will follow. Before you install one — from us or from anywhere — three checks take about two minutes.

We made them on every skill and server people sent us in September. Here is what each one caught, and what to look for yourself.

1. Is it still there? npx skills add owner/repo installs whatever sits at that address on the day you run it. Of the 101 skill repositories sent to us in September, 29 no longer exist. Most of that is one account that sent us 24 of them in two days — every one is gone — but five more vanished from ordinary submitters within weeks of being sent. If a skill you added recently now returns a 404, remove it rather than reinstalling from the same address.

2. What does it ask you to run? Six of September’s submissions install by piping a script from the project’s own site straight into a shell — curl … | bash. In one, that line sits inside the SKILL.md itself, which means your agent runs it, not you. Download the script and read it before anything executes it. (Well-known installers such as uv or rustup are a different case: you are trusting a toolchain you already know.)

3. What is it for? Stars measure attention, not intent. The most-starred skill sent to us this month, at nearly 6,000 stars, exists to strip the watermarks that show an image was AI-generated. Popular is not the same as something you want your agent carrying. Read the description, then read the SKILL.md, and ask what it is built to get around.

None of these needs a scanner. They need a minute of reading before the install command, which is the minute agents are best at skipping.

• What we won’t list, and why →

NEW & VETTED / 02

One addition this week, and it is Anthropic’s.

• Anthropic Design Pluginseven design skills in one official plugin: structured critique of usability and hierarchy, WCAG 2.1 AA accessibility audits, design-system audits that catch naming drift and hardcoded values, UX copy for errors and empty states, user research and research synthesis, and developer handoff specs. Each works from a description or a screenshot, and slash commands like /critique and /handoff run them on demand.

It has been public since February, inside a repository built for Cowork, Anthropic’s desktop app — which is why most Claude Code users have never come across it. It works there too, as a plugin: two commands, a marketplace you add once, then the plugin by name. The exact lines are on its page.

It also passes all three checks from 01: Anthropic’s own repository, updated September 21; a standard plugin install with nothing piped into a shell; and a purpose it states plainly.

THE PICK / 03

Systematic Debugging — obra/superpowers

S-RANK · 290,000+ STARS · 3 CONTRIBUTORS · UPDATED SEPTEMBER 19, 2026 BY OBRA

One skill, one rule, stated in capitals at the top: no fixes without root cause investigation first. Then four phases — investigate, find the pattern, form one hypothesis and test it, fix the cause rather than the symptom — and a hard stop most debugging advice leaves out: after three failed fixes, stop fixing and question the architecture.

Most of the skill is not the process. It is a list of the sentences an agent tells itself right before it abandons one — “quick fix for now, investigate later”, “it’s probably X, let me fix that”, “one more fix attempt” — each paired with why it is wrong. It even lists what the human says when things are going badly (“stop guessing”, “we’re stuck?”) and treats those as a signal to go back to phase one.

What makes it the pick is in the folder, not the SKILL.md. It ships three pressure tests: scenarios written to make an agent skip the process — a production outage at $15,000 a minute, a manager saying “FIX IT NOW”, a retry that worked last week. And a creation log explaining which words were chosen to hold up under that pressure. You can read exactly what it was tested against, which is rarer than it should be — and it is check three from 01, answered in the open.

The caveat: it is deliberately rigid. On a one-line typo, four phases is ceremony. It is built for the bug you have already failed to fix twice.

$ npx skills add obra/superpowers@systematic-debugging

• View skill & platform support →

DIDN’T PASS / 04

Two MCP packages worth swapping out, and one we could not replace.

• @modelcontextprotocol/server-github is archived.Issue 003 flagged it; it still turns up in guides everywhere. GitHub’s own server replaces it — github/github-mcp-server, hosted, or run locally through Docker with the same GITHUB_PERSONAL_ACCESS_TOKEN you already have.
• vercel-mcp-server on npm is not Vercel’s.It is a third-party project, and its setup asks for your VERCEL_TOKEN — a key to your Vercel account. Vercel’s official server is hosted at mcp.vercel.com and signs you in with OAuth instead. A package named after a vendor is not the vendor’s until the vendor says so; check who publishes it before you hand it a key.
• The archived Google Drive server has no official successor we can point you to.Rather than guess, we have taken it out of our guides.

Our own workflow guides still carried both until this week — six used the archived GitHub server, two the Vercel lookalike. They are fixed, and every workflow now points at the vendor’s own server.

WORKFLOW / 05

Debug Production Issues — Sentry pulls the error, the agent traces it to the code, GitHub opens the PR with the fix. Intermediate.

It belongs next to 03 because this is where that skill earns its rigidity. A production error arrives with a stack trace and a sense of urgency — exactly the pressure its tests were written for. Sentry’s MCP server supplies the evidence, Systematic Debugging keeps the agent on the root cause instead of the first plausible patch, and GitHub’s own MCP server opens the pull request.

We added Systematic Debugging to this workflow this week, and moved it onto GitHub’s current server.

• Debug Production Issues →

WHAT CHANGED / 06

44 skills you may have installed were updated this week.

“Updated” means the skill’s own directory got a commit since September 21 — not a judgement about what the commit did. Sixteen of the 44 are Microsoft’s Azure and Foundry skills, regenerated from Microsoft’s documentation in a single sync on September 28. Top of the rest by stars:

• Writing PlansSeptember 25
• Claude APISeptember 24
• UI/UX Pro MaxSeptember 27
• Agent SkillsSeptember 26
• ImpeccableSeptember 25
• Last 30 DaysSeptember 23
• HumanizerSeptember 28
• Scientific SkillsSeptember 28

…and 20 more. The date is on every skill’s page, under Last commit.