npx skills check doesn't check

THE SIGNAL / 01

Nearly every agent skill installs with one line: npx skills add. We read the CLI’s source to see what that line actually does. Three things surprised us.

• 1. check installs updates.In version 1.7.0, npx skills check is another name for update, not a dry run, and neither the help text nor the README mentions it. If you run it to see what is out of date, you get the new versions installed. A new version of a skill is new instructions for your agent. Read what changed before you update anything you rely on.
• 2. The part after @ is not the folder name.It has to match the name: line inside the SKILL.md. Vercel’s React skill lives in a folder called react-best-practices, but it is named vercel-react-best-practices, so the folder name fails with “No matching skills found”. --list won’t catch it either: it lists the repo’s skills even when the name you gave matches nothing.
• 3. The safety badges depend on telemetry.Before installing from a public GitHub repo, the CLI shows a risk rating for each skill, from Safe up to Critical. That lookup is skipped when you turn telemetry off. Opting out of one opts you out of the other, and nothing tells you so.

Also: the CLI never runs anything from the skill when it installs. It doesn’t show you the SKILL.md either. Its last line says to “review skills before use”; that part is up to you.

We wrote the whole thing up: every command, where the files land for Claude Code and Cursor, and the errors people hit most.

• npx skills, every command, explained →

NEW & VETTED / 02

Two of this week’s additions, both MCP servers from their own makers.

• Inspoan archive of more than 2,300 pages from 800 real websites, each traced into its palette, fonts and a design write-up. Give it a brief and it returns a moodboard of shipped work. Your agent then starts from real references rather than the page it builds every time: centered hero, three cards, purple gradient. It is free, read-only and needs no key. The screenshots are of other people’s sites, so use them as reference, not assets.
• VirusTotalVirusTotal’s own server, released in September. Your agent can look up a file, URL, domain or IP before it opens or runs it, and sign-in is OAuth to a free account, so no API key changes hands. One thing to know: looking up a report uploads nothing, but anything it submits is shared with the security community, and the submit tools don’t ask first. Limit them in your client’s permissions. A URL lookup also sends the whole URL, query string included.

Both pass the three checks from Issue 005: published by the people who make them, nothing piped into a shell, and a purpose they state plainly.

THE PICK / 03

Animate — Emil Kowalski

S-RANK · 43,000+ STARS · 3 CONTRIBUTORS · UPDATED SEPTEMBER 15, 2026 BY EMIL KOWALSKI

Most animation advice starts with the curve. This skill starts with whether anything should move at all, and it is willing to say no.

It builds animations in a fixed order: should this animate, what is it for, which tool, which properties, which curve and duration, how it is interrupted, how it exits. The first two steps are gates. Something you trigger a hundred times a day, like a command palette or a keyboard shortcut, gets no animation. The skill points to Raycast, whose launcher doesn’t animate open or shut. If the agent can’t name a purpose, such as feedback, where something came from, or a state change, it doesn’t build the animation. Its own words on producing no code: “That’s a success, not a dodge.”

When it does build, the values come from tables rather than taste. It uses ease-out for entrances and never ease-in on interface elements, keeps interface motion under 300ms, never starts from scale(0), and animates only transform and opacity. Reduced-motion handling ships with the animation, not afterward. It ends with a “never ship” list that reads like a code review you would want to have had.

The caveat: it is opinionated on purpose, and the opinions are one designer’s. If your product has its own motion system, the skill is told to extend your tokens rather than replace them. Give it your tokens file and see whether it reuses them.

$ npx skills add emilkowalski/skills@animate

• View skill & platform support →

DIDN’T PASS / 04

Install commands that stopped working, two of them ours, and 79 servers on their way out.

• Callstack’s React Native skills moved into three plugins.In August, Callstack regrouped its skills into three bundles: building, testing and migrating to React Native. The old one-skill plugin names stopped resolving. Our pages kept showing the old names until this week. If /plugin install react-native-best-practices@callstack-agent-skills failed for you, the plugin is now building-react-native-apps, and the correct line is on each skill’s page.
• Our own homepage showed a command that doesn’t work.The example in the hero read npx skills add vercel-labs/find-skills, and no repository exists at that address. The skill lives at vercel-labs/skills@find-skills. That’s fixed, along with three bare-word examples on our workflows page that the CLI reads as repository names.
• 79 MCP servers leave the directory on October 14.In Issue 004 we said servers that publish no repository and no website would come out on that date if nothing appeared. Nothing has, for 79 of them. That’s 40% of our MCP listings, including the only entries we had for Slack, Gmail and every social network. Several of those products now have official servers from their own makers. Those come back as new entries, with a source we can link to, as we verify them. Removing a listing doesn’t touch anything you’ve installed: your config points at the server, not at us.

WORKFLOW / 05

Distinctive UI Without a Mockup — Inspo finds real references, Taste Skill reads the brief and picks a design direction, Emil Design Engineering reviews the polish, and Animate adds motion that earns its place. Beginner.

This is new this week, built from 02 and 03. Design-to-Code covers you when there is a Figma file. This one is for when there is only a brief, which is when an agent falls back on the page it always builds. The order matters: references first, then a stated direction before any code, then Emil Kowalski’s design-engineering review of what was built. Animate goes last, so motion gets decided after the page exists, and the skill is allowed to say no.

• Distinctive UI Without a Mockup →
• Design-to-Code →

WHAT CHANGED / 06

38 skills you may have installed were updated this week.

“Updated” means the skill’s own directory got a commit since September 28 — not a judgment about what the commit did. Before you run update (or check, see 01), read the commit. Seven of the 38 are Corey Haines’s marketing skills, changed across four commits on October 2 and 3. Top of the rest by stars:

• Claude APISeptember 29
• UI/UX Pro MaxOctober 3
• Agent SkillsOctober 3
• ImpeccableOctober 5
• Last 30 DaysOctober 1
• Scientific SkillsOctober 5
• Emil Kowalski’s Design SkillsOctober 2
• Tailwind Design SystemSeptember 28

…and 23 more. The date is on every skill’s page, under Last commit.