Documentation

Operating model

Know which stage your work is in, which loop and pack help there, and where the agent stops for your decision.

Install skills, packs and loops

Install a role's pack, one skill, a loop or the reviewer subagents with the skilldrop CLI or the Claude Code plugin marketplace.

Install a skill into your IDE

Put a skill where Claude Code, Cursor, Kiro, Codex, Antigravity, GitHub Copilot or another agent reads it, by copying the folder or with one CLI flag, then install its dependencies.

Follow one change through the loops

A single realistic change — API rate limiting — walked from a stakeholder complaint to a closed incident, showing what each stage produces and what each gate actually refuses.

From use-case to deployed agent — the AI engineering workflow

End-to-end AI adoption: triage the use case, assess org readiness, design the loop and agents, threat-model the system, build the evals, measure what shipped.

From complaint to closed incident

A user complaint triggers a full response cycle — discover what's broken, operate to fix it, and close the loop with a postmortem and runbook update. Uses the discover and operate loops.

From a dashboard request to numbers people can defend

About fifteen minutes

Run the measure loop on a real request. The spec cuts the charts that serve no decision, the SQL review catches a join that inflated revenue, and the loop stops for the metric owners instead of picking between two teams' definitions of an active customer.

From story to merged code — the dev-team workflow

A complete dev-team session: split the story, implement with checkpoints, gate with the review panel, document what shipped.

Follow one change through the loops

A single realistic change — API rate limiting — walked from a stakeholder complaint to a closed incident, showing what each stage produces and what each gate actually refuses.

From idea to shipped feature

A product idea moves through all five lifecycle loops — discover, design, build, release, operate — with each gate refusing until its conditions are met.

From a Terraform module to a plan you can safely apply

About twenty minutes

Write a reusable Terraform module with secure defaults, then review a plan that was meant to resize one app tier and would also have replaced a database, opened SSH to the internet and widened an IAM policy, with the infra-as-code pack.

One Markdown draft, every reader's format

About twenty minutes

Take one Markdown report to a Word file for the people who edit it, a spreadsheet for the people who total it, and a slide deck for the meeting, then bring a reply back to Markdown, with the converters pack. Nothing is dropped without being named.

From an unreadable page to a service people can use

About twenty minutes

Rewrite a council permit page from what residents need, write every word on the application form, then blueprint the service behind it and find why two thirds of the calls are "where is my permit", with the experience-design pack.

From an agreed PRD to a tracker that stays honest

About half an hour

Load a PRD into Jira as epics and stories, triage the backlog it joins, write the weekly status from counted numbers, and catch where the tracker and the doc have drifted apart, with the trackers pack on one team's real files.

From signal to signed-off PRD — the product manager workflow

A PM's full discovery-to-requirements session: sharpen the signal into a brief, test the narrative with a PR/FAQ, cascade OKRs, write the PRD, define metrics, critique before sharing.

From a risky change to a risk position its owner signs

About fifteen minutes

Run the comply loop on a payroll vendor move. The DPIA's risks to people join the register, two controls with no evidence lose the credit the ratings gave them, the register's own script decides G8, and the loop stops for the owner's signature.

From brief to committed design — the solution architect workflow

A full design session: capture the brief, draw the system, commit decisions as ADRs, write the design doc, threat-model it, gate with council review.

A why question to an answer the evidence carries

About twenty minutes

Run the research loop on a conversion drop everyone blames on a new onboarding flow. The plan fixes what would change the decision first, the gate refuses to pick between two tied explanations, and one reconciliation shows the drop was a tracking bug.

Write a skill your whole team can install, then review one before you trust it

About twenty minutes

Turn a task you keep re-explaining to your agent into a portable skill folder with evals, then audit a teammate's skill that would have hidden where it saved files and run remote code, with the skill-engineering pack.

Author a new loop

How to add a loop — the closed loop.json contract, the three stage types, gate rules, and the checks that will reject a loop that only looks like governance.

Author a new skill

The short version of the authoring path — what a skill must contain, what gates it, and where the full contributor rules live.

Benchmark skills against the agent without them

Run each acceptance eval twice as an agent session, with the skill and without it, and read the lift, the blind preference from two judges, and the cost.

Contain a skill's reach

Run a project's shell commands in Claude Code's sandbox, limited to the folder and the network hosts its skills declare, without loosening anything you already set

Roll out skilldrop across your org

Bootstrap the hosted marketplace for every machine in one command — covers the public catalogue and private-fork setups for enterprise orgs.

Govern skills across an organisation

Decide which catalogues and skills people may install, see what is installed on every machine, and keep a log of every change that shows if it was edited

Install a skill into your IDE

Put a skill where Claude Code, Cursor, Kiro, Codex, Antigravity, GitHub Copilot or another agent reads it, by copying the folder or with one CLI flag, then install its dependencies.

Install skills, packs and loops

Install a role's pack, one skill, a loop or the reviewer subagents with the skilldrop CLI or the Claude Code plugin marketplace.

Use skilldrop with Figma

Connect Figma files to the architecture and diagram skills — generate diagrams for FigJam, produce Figma-ready specs from a design session, or reverse-engineer decisions from a mockup.

Use skilldrop with GitHub Projects

Pipe GitHub issues and project boards into skilldrop skills — implementation loops, review gates, and release notes that trace back to issues.

Use skilldrop with Jira

Feed Jira tickets and epics into skilldrop skills — bug triage, story splitting, implementation loops, and release notes.

Use skilldrop with Linear

Feed Linear issues, cycles, and projects into skilldrop skills for triage, story splitting, implementation tracking, and release notes.

Measure your loops

Turn on the opt-in, local-only run log, then see which gates pass first time, which keep looping back, and which end in BLOCKED.

Install a profile

Named bundles of packs, agents, and loops — install a complete setup in one command.

Publish your own catalogue

Shape a repo so `skilldrop --from <you>` installs from it, and how the CLI reads agentbundle-shaped catalogues too.

Release a change

Take a merged change to live users with the release loop — a rollout plan with a way back, a readiness check on evidence, release notes, and your go/no-go call.

Run a skill in CI

Use the skilldrop GitHub Action to run a skill on every pull request, such as a document critique or a pre-merge review, post the result to the job summary, and optionally fail the check on a verdict.

Supply credentials to skills

How to provide API keys and tokens to skills that declare env.required — covers local shells, CI environments, and enterprise secret managers.

Upgrade installed skills

Check which installed skills and loops are stale and bring them current, keeping any files you edited and your hook wiring.

Use skills with MCP servers

Pair skilldrop skills and loops with MCP servers so the agent fetches tickets, designs, PRs, incidents, query results and cost data itself, add a server in each supported tool, and do it without handing an attacker your data.

Verify a release

Check that a skilldrop-cli release came from this repository's release workflow, unchanged, using npm's provenance, the GitHub attestation on the release tarball, and its SBOM.

Wire a skill to an event

Opt-in hooks: how a loop-shaped skill binds to session-start or pre-commit-review, and how the CLI projects that onto each target.

Benchmark options and report

What run_bench.py needs, its flags, how each run is isolated, what it writes, and what each number in the report means.

The skilldrop GitHub Action

Every input and output of the skilldrop GitHub Action, what it sends to Claude and what it never runs, which skills fit CI, and what a run costs.

Install options

Every skilldrop CLI install command and flag, the Claude Code plugin marketplace's plugins and how they are built, the reviewer subagents, and where to go for hooks, catalogues and authoring.

Install targets and dependencies

Where each install target puts skills and subagents, the by-hand steps for Claude Code, Cursor, Kiro and agents without a skills folder, what --local does, and each skill's dependency install.

The loop contract

Every rule a new loop must meet — the closed loop.json fields, the three stage types, gate ids and verdicts, what LOOP.md carries, and how a loop is registered and checked.

The loops, stage by stage

Every loop's stages, skills and gates, with a generated diagram per loop — what each takes, what it produces, and what a mistake costs.

MCP servers and skills

Which MCP servers pair with which skilldrop skills and loops, the config for each supported tool, the security rules, and fixes for common problems.

skilldrop and the OWASP Top 10s

Where skilldrop's controls meet the OWASP Agentic Skills Top 10 and the LLM Top 10 2025, what each control actually does, and the gaps it leaves.

Policy file and audit log

Every field of the organisation policy, where the CLI looks for it, how it fails, and the format of the audit log and the inventory report

Every skill, by category

All the skills grouped by what they produce, one line each, plus the anatomy every skill folder shares.

The skill contract

What a new skill folder must contain — frontmatter, manifest, size, scripts, evals, catalogue entries — and what validate.py checks before it merges.

Skills that ship scripts

Every skill that ships scripts and what each declares it needs — packages, environment variables, hosts, programs and files — and how to invoke a skill from Claude Code or any other IDE.

Updates and the install ledger

What outdated, update, diff and doctor compare and decide — the ledger file, how edited files become .upstream, every update flag, and the edge cases.

Versioning and what stays stable

What skilldrop promises from 1.0.0 — the CLI, skill folders and names, scripts' flags and exit codes, loops, packs, the GitHub Action and plugin names — what each kind of release can change, and how deprecation and retirement work.

Why loops

Why skilldrop sequences skills in a separate primitive instead of letting skills call each other, and why there are five lifecycle loops rather than three.

Operating model

Know which stage your work is in, which loop and pack help there, and where the agent stops for your decision.

skilldrop, reviewed by its own skills

The site's performance and accessibility, checked with the catalogue's own web-performance-review and accessibility-audit skills, the findings, and what was fixed. Pull requests are reviewed by pre-merge-review.

Does the agent invent your resume?

The same 14 resume and cover-letter requests run with the career pack's skills and with plain Claude Code - how often each put something in the document that the person never said, and what kind of thing it was.

What the benchmark showed

Five days of measuring skills against the agent without them - a large gain on the skills' own checks, no blind preference at first, a gain that did not survive new evals, and what the skills that do win have in common.

Contributing

How to add or change a skill, a pack, a loop or a subagent, what an RFC is needed for, and the checks a pull request must pass.