Matt Pocock’s Skills — The npm Moment for AI Agents

TL;DR + the 58k-star claim

• Repo: github.com/mattpocock/skills. MIT, 17 SKILL.md files in three folders, no JavaScript or TypeScript code in the skills themselves — the entire repo is “Shell 100%” per GitHub’s language bar.
• Stars at write time: 58.5k, verified from the GitHub stargazers page on 2026-05-04. byteiota measured 21,900 in the first 24 hours; ShareUHack’s weekly trending report measured +18,218 weekly to a total of 39,382 on 2026-04-29; OSS Insight’s personal-AI-stacks analysis logged 10,360 stars across 52 days as of 2026-03-27.
• What broke through: the “not vibe coding” framing, four named failure modes mapped to named skills, citations of Pragmatic Programmer / Eric Evans / Kent Beck / Ousterhout, and Matt’s 60,000-strong AI Hero newsletter as a launch megaphone.
• The “npm moment” framing: partially accurate. Skills have a unit (SKILL.md), installers (npx skills, apm install), and registries (claudemarketplaces, lobehub, mpak, skillsmp). They lack semver, dependency resolution, security review at scale, and lockfiles — the four things that actually made npm a package manager.

What’s actually in the repo

The directory tree is small and deliberate. Three folders under skills/: engineering/, productivity/, misc/. 17 skills total. Each is a single SKILL.md with YAML frontmatter (name, description) and a prose body. No installation logic in the skills themselves — that lives in the npx skills CLI Matt points to. Here’s the full list, with one-liners pulled verbatim from Matt’s own “Reference” section in the README.

Engineering (9 skills, daily-use)

• diagnose — “Disciplined diagnosis loop for hard bugs and performance regressions: reproduce → minimise → hypothesise → instrument → fix → regression-test.” The skill body itself codifies six phases starting with feedback-loop construction: “Build the right feedback loop, and the bug is 90% fixed.” The model is told to generate 3–5 ranked, falsifiable hypotheses before instrumenting.
• grill-with-docs — “Grilling session that challenges your plan against the existing domain model, sharpens terminology, and updates documentation (CONTEXT.md, ADRs) inline as decisions crystallise.” The frontmatter activation trigger: “Use when user wants to stress-test a plan against their project’s language and documented decisions.” The skill cross-references CONTEXT.md, docs/adr/, and src/.
• triage — “Triage issues through a state machine of triage roles.”
• improve-codebase-architecture — “Find deepening opportunities in a codebase, informed by the domain language in CONTEXT.md and the decisions in docs/adr/.”
• setup-matt-pocock-skills — the per-repo configuration scaffold. Asks for issue tracker (GitHub, Linear, or local files), triage labels, and docs location. Matt explicitly tells you to install this one and run it once per repo before any of the others — it’s the implicit dependency target the rest of the collection consumes.
• tdd — “Test-driven development with a red-green-refactor loop. Builds features or fixes bugs one vertical slice at a time.”
• to-issues — “Break any plan, spec, or PRD into independently-grabbable GitHub issues using vertical slices.”
• to-prd — “Turn the current conversation context into a PRD and submit it as a GitHub issue. No interview — just synthesizes what you’ve already discussed.”
• zoom-out — “Tell the agent to zoom out and give broader context or a higher-level perspective on an unfamiliar section of code.”

Productivity (3 skills, general workflow)

• caveman — the controversial favorite. Matt’s description: “Ultra-compressed communication mode. Cuts token usage ~75% by dropping filler while keeping full technical accuracy.” The body of the skill instructs the model: “Drop: articles (a/an/the), filler (just/really/basically/actually/simply), pleasantries (sure/certainly/of course/happy to), hedging.” A literal example contrast: “Sure! I’d be happy to help you with that. The issue you’re experiencing is likely caused by...” becomes “Bug in auth middleware. Token expiry check use < not <=. Fix:” There’s an explicit auto-clarity exception so the agent drops caveman mode for security warnings and irreversible-action confirmations.
• grill-me — “Get relentlessly interviewed about a plan or design until every branch of the decision tree is resolved.” This is the skill that, when paired with grill-with-docs, became the meme.
• write-a-skill — “Create new skills with proper structure, progressive disclosure, and bundled resources.” The fact that Matt ships a skill for writing skills is meta but practical: it’s how community contributors clone the format.

Misc (4 skills, occasional)

• git-guardrails-claude-code — sets up Claude Code hooks to block dangerous git commands (push, reset --hard, clean) before they execute. This pairs thematically with the OWASP-style harm-reduction work in our MCP Security 2026 deep dive.
• migrate-to-shoehorn — migrates test files from as type assertions to @total-typescript/shoehorn. A direct dogfood of Matt’s own Total TypeScript ecosystem.
• scaffold-exercises — creates exercise directory structures with sections, problems, solutions, and explainers. This is course-author scaffolding — useful if you teach, irrelevant if you don’t.
• setup-pre-commit — Husky pre-commit hooks with lint-staged, Prettier, type checking, and tests.

Install (verbatim from the README):

npx skills@latest add mattpocock/skills

The interactive installer asks which skills to add and which of your installed agents (Claude Code, Codex CLI, Cursor, OpenCode, Gemini CLI, Cline, and 50+ others) to install them on. Matt strongly recommends checking /setup-matt-pocock-skills during install and running it once per repo — the engineering skills consume the configuration it produces.

The 36K-star Claude Code folder Matt Pocock just open-sourced

Indie Hacker News · click to play

Why it broke through

Plenty of skill repos shipped in the same window. Most got hundreds of stars. mattpocock/skills got 22,000 in 24 hours. The ingredients are unusually identifiable.

Credentialing. Matt is the founder of Total TypeScript, runs the AI Hero newsletter at ~60,000 subscribers per the README’s own claim, and is one of a handful of educators trusted by the senior-engineer cohort that hangs out on TypeScript Twitter. When that audience saw a repo titled “Skills For Real Engineers” with the dryline “Straight from my .claude directory,” they signed off in a single tab-and-star.

Timing. The repo landed about a month into the post-Anthropic-skills-launch window when the developer conversation had pivoted from “what is a skill” to “whose skills should I install.” Our own deep dive, Claude Skills vs MCP vs Subagents vs CLI: 2026 Decision Matrix, captures that shift — the demand cluster was already primed for a curated, trusted collection.

The framing was sharp. Four named failure modes (misalignment, verbosity, broken code, ball of mud), each with a cited authority (David Thomas / Andrew Hunt; Eric Evans; Kent Beck; John Ousterhout) and a named skill that fixes it. The README reads like a chapter from The Pragmatic Programmer, not a tooling pitch:

The taste signal. Caveman, grill-me, and grill-with-docs are skills with personality. They feel hand-written, not LLM-generated. byteiota called out the same: “Most of Matt’s skills aren’t about generating code faster, but about thinking through problems more thoroughly before writing code — how senior engineers use AI.”

Design choices that worked

Read the SKILL.md files side by side and a deliberate house style emerges. Each choice is small. Together they explain why the skills feel coherent in a way most community collections don’t.

Verb-first names. diagnose, triage, tdd, grill-me, zoom-out, to-prd, to-issues, write-a-skill, migrate-to-shoehorn. These read as agent imperatives, not topics. Compare with brainstorming from Jesse Vincent (obra), or using-superpowers — the same convention. It’s the de facto standard for the post-Anthropic-launch crop.

One job per skill. Matt resists the urge to bundle. tdd doesn’t also do code review. diagnose doesn’t also write tests. The explicit composition path is “run multiple skills in sequence,” not “one mega-skill.” This is the same design principle Anthropic published in their Claude Skills primer: narrow scope, progressive disclosure, model picks the right one based on the description.

The description is the activation rule. Skills don’t fire because you typed a magic word; they fire because the agent reads the YAML description field and decides this is the right tool for the request. So Matt’s descriptions are unusually long and unusually specific:

description: Disciplined diagnosis loop for hard bugs and
  performance regressions. Reproduce → minimise → hypothesise →
  instrument → fix → regression-test. Use when user says
  "diagnose this" / "debug this", reports a bug, says something
  is broken/throwing/failing, or describes a performance regression.

The trailing “Use when user says...” pattern is doing real work. It seeds the agent with literal trigger phrases. This is the same activation engineering Anthropic themselves recommend — we covered the trickier failure modes in Why your Claude skill isn’t activating.

Cross-references between skills. improve-codebase-architecture consumes the domain language grill-with-docs writes into CONTEXT.md. to-prd hands its output to to-issues. setup-matt-pocock-skills is the implicit prerequisite. There’s no formal dependency declaration — the connections live in the prose — but they’re real. This is the same composition pattern writing-plans + executing-plans from obra/superpowers exhibits. Two skills that are useless alone and powerful together.

Allowed-tools defaults are absent. Anthropic Skills support an allowed-tools frontmatter field that limits what the model can do during the skill. Matt ships none. Every skill inherits the agent’s full tool access. This is a deliberate choice that mirrors his “don’t take away your control” framing in the README — he calls out GSD, BMAD, and Spec-Kit as approaches that “own the process” and remove user agency. The trade-off: lighter security default, simpler skill bodies, easier to fork.

The “npm moment” claim — strong vs strained

The framing is too good to leave unchallenged. Three angles where it’s clearly accurate, three where it isn’t yet.

Net assessment: the unit is right, the discovery is right, the installer is right. The supply chain is the unsolved problem. A real npm-for-skills moment requires a SKILLS.lock plus a registry that signs and audits the publish flow. We aren’t there yet.

Compared with adjacent collections

Five other collections you should know about, each with a different bet. Star counts verified at write time on the stargazers pages of each repo.

obra/superpowers (178k stars)

Jesse Vincent’s repo is the largest in the ecosystem by an order of magnitude. The README pitches it as “an agentic skills framework & software development methodology” — closer to a complete development discipline than a skill collection. The headline skills: test-driven-development, verification-before-completion, brainstorming, writing-plans, executing-plans, dispatching-parallel-agents, using-git-worktrees, using-superpowers. The framework principle: “test-driven development, systematic over ad-hoc, complexity reduction, evidence over claims.” If Matt’s repo is the personal cookbook, obra’s is the institutional handbook.

mkdir -p .claude/skills/using-superpowers && curl -L -o skill.zip "https://mcp.directory/api/skills/download/151" && unzip -o skill.zip -d .claude/skills/using-superpowers && rm skill.zip

addyosmani/agent-skills (27.7k stars)

Addy Osmani brings Google’s engineering discipline. Twenty skills organized by lifecycle: Define, Plan, Build, Verify, Review, Simplify, Ship. Verbatim from the README: “Skills encode the workflows, quality gates, and best practices that senior engineers use when building software.” The stated provenance: Software Engineering at Google — Hyrum’s Law, Beyoncé Rule, the test pyramid, Chesterton’s Fence, trunk-based development. Where Matt cites Pragmatic Programmer, Addy cites the Google book. Same shape, different heritage.

vercel-labs/agent-skills (26.1k stars)

The stack-specific bet. Six skills: react-best-practices, web-design-guidelines, react-native-guidelines, react-view-transitions, composition-patterns, and vercel-deploy-claimable. Compact and load-bearing if your stack matches. The repo description: “A collection of skills for AI coding agents. Skills are packaged instructions and scripts that extend agent capabilities.” The related vercel-labs/skills repo (16.9k stars) is a separate thing — that’s the CLI installer (“the CLI for the open agent skills ecosystem”) used by every collection in this list.

mkdir -p .claude/skills/web-design-guidelines && curl -L -o skill.zip "https://mcp.directory/api/skills/download/556" && unzip -o skill.zip -d .claude/skills/web-design-guidelines && rm skill.zip

antfu/skills (4.8k stars)

Anthony Fu’s collection mirrors his open-source portfolio: Vue, Nuxt, Pinia, Vite, VitePress, Vitest, UnoCSS, pnpm, plus vendored skills for Slidev, tsdown, Turborepo, VueUse Functions, and Vue Best Practices. Three categories in his README: hand-maintained (the antfu skill itself), generated from official documentation (the framework set), and vendored from external repos (the ecosystem set). For Vue / Nuxt / Vite teams, this is the highest-signal option in the ecosystem.

mkdir -p .claude/skills/vitest && curl -L -o skill.zip "https://mcp.directory/api/skills/download/1479" && unzip -o skill.zip -d .claude/skills/vitest && rm skill.zip

google/skills + microsoft/skills

The cloud-vendor official bets. google/skills (6.5k stars, Apache 2.0) covers Gemini API, AlloyDB, BigQuery, Cloud Run, Cloud SQL, Firebase, GKE Basics, plus the Google Cloud Well-Architected Framework (Security, Reliability, Cost Optimization). microsoft/skills (2.2k stars) ships 132 skills across five languages: 41 Python, 28 .NET, 25 TypeScript, 25 Java, 7 Rust, plus 9 core. Microsoft pitches a browseable Skill Explorer at microsoft.github.io/skills — closest thing to a vendor-curated marketplace today. Both install via the same npx skills add CLI.

VoltAgent/awesome-agent-skills (20.2k stars)

Not a skill collection — a curated awesome-list pointing to all the others. The repo’s explicit promise: “real-world Agent Skills created and used by actual engineering teams, not mass AI-generated stuff.” Sourced from Anthropic, Google Labs, Vercel, Stripe, Cloudflare, Netlify, Trail of Bits, Sentry, Expo, Hugging Face, Figma, Microsoft (132), OpenAI, fal.ai, WordPress, plus community. If you want a single bookmark to the whole ecosystem, this is it.

Lessons for skill authors

If you’re writing skills, mattpocock/skills is the best single repo to study. Eight extractable patterns:

1. Verb-first names. diagnose, not debugger. to-prd, not prd-generator. The agent is reading your name as a command.
2. Ship a description that includes literal trigger phrases. “Use when user says ‘diagnose this’ / ‘debug this’...” This seeds activation reliability across models.
3. One job per skill. Resist mega-skills. Compose at runtime through chained invocations.
4. Document cross-references in prose, not code. Tell the model: “the output of grill-with-docs writes to CONTEXT.md which improve-codebase-architecture reads.” The agent stitches the chain.
5. Cite authority, not benchmarks. Pragmatic Programmer, Eric Evans, Kent Beck. This positions the skill in a tradition senior engineers respect.
6. Ship a setup skill. setup-matt-pocock-skills exists because the agent can’t guess your issue tracker. Make the configuration step a first-class skill, not buried in a README.
7. Include a write-a-skill skill. Lower the barrier for community contribution. Document the format you used.
8. Don’t lock down tools by default. Matt explicitly avoids allowed-tools restrictions because they reduce composability. Trust the user to layer security through hooks and guardrails (he ships git-guardrails-claude-code as a separate skill for exactly this).

For more on the activation engineering side — particularly when your description isn’t triggering the skill the way you expect — we wrote a dedicated piece: Why your Claude skill isn’t activating.

Does it work outside Claude Code?

Yes, with caveats. The npx skills installer Matt points to supports 50+ agents: Claude Code, Codex CLI, Cursor, Cline, Continue, GitHub Copilot CLI, Kiro IDE, OpenCode, Gemini CLI, Windsurf, and others. The SKILL.md files themselves are agent-agnostic — no Anthropic-specific tooling, no Claude-only tags.

The caveats live at the integration boundary. The engineering skills assume an issue tracker (GitHub, Linear, or local files). If your agent can’t shell out to gh issue create or hit the Linear API, you fall back to the local-files mode during setup-matt-pocock-skills. git-guardrails-claude-code is the obvious outlier — it specifically configures Claude Code hooks and won’t carry across agents without rewriting.

For everyday code generation work, all 17 skills should activate correctly in any agent that reads SKILL.md frontmatter. Cursor and Cline both treat SKILL.md as a first-class instruction surface in 2026. The portability question is more about which agent your team uses than whether Matt’s skills support it.

Building a REAL feature with Claude Code: every step explained

Matt Pocock · click to play

The actual registry candidates

If a real npm-for-skills moment happens, it happens through one of these. None has won yet. All five claim part of the surface npm covers.

Microsoft APM (apm)

Microsoft’s Agent Package Manager pitches itself as “an open-source, community-driven dependency manager for AI agents.” Mission statement, verbatim: “Portable by manifest. Secure by default. Governed by policy.” One apm.yml declares every primitive your agents need — instructions, skills, prompts, agents, hooks, plugins, MCP servers — and apm install reproduces the exact same setup across every client on every machine. This is the closest analog to package.json + npm install in the ecosystem. 2.2k stars at write time.

mpak (mpak.dev)

Pitch: “the secure registry for MCP servers and skills.” The differentiator is the supply-chain story: “every bundle scanned, every trust score public, open source from day one.” They publish a security framework with 25 controls across 5 domains and an L1–L4 certification ladder. If npm-for-skills is going to happen, somebody has to solve security — and mpak is the clearest attempt today.

mcpm.sh

Path Integral Institute’s mcpm.sh is the MCP-server-focused cousin. Pitch: “CLI MCP package manager & registry for all platforms and all clients.” You install MCP servers globally once and organize them with profiles, then integrate into specific clients (Claude Desktop, Cursor, Windsurf, etc.). 938 stars, active. It’s adjacent to skills rather than a direct competitor — but the install-once-share-everywhere pattern is exactly what Matt’s repo would benefit from.

claudemarketplaces.com

The discovery layer. Tagline: “Find the best plugins, skills, and MCP servers for Claude Code.” Self-described as “the largest directory of Claude Code extensions. Discover tools used by thousands of developers, sorted by installs and GitHub stars.” Counts as of May 2026: 4,200+ skills, 2,500+ marketplaces, 770+ MCP servers. Their FAQ is unusually clear about the term: “GitHub repositories that collect and distribute plugins. Each marketplace acts as a registry you can subscribe to for skills, MCP servers, commands, hooks, and agents.”

skillsmp.com

Pitch: “Agent Skills Marketplace for the open SKILL.md ecosystem.” Their headline metric is volume: 1,240,717 indexed skills. They source from public GitHub repositories with a 2+ stars quality filter and provide programmatic access via REST API. Volume isn’t quality — but volume is also a precondition for the npm analog. claudemarketplaces is curated; skillsmp is comprehensive. Both can be right.

Frequently asked questions

Sources

Primary — mattpocock/skills

• github.com/mattpocock/skills — README, all 17 SKILL.md files, MIT license, Shell 100% language bar, 58.5k stars verified 2026-05-04.
• skills/engineering/diagnose/SKILL.md — the six-phase diagnosis loop body and frontmatter.
• skills/engineering/grill-with-docs/SKILL.md — domain-language interview pattern.
• skills/productivity/caveman/SKILL.md — ultra-compressed communication mode.
• aihero.dev — Claude Code for Real Engineers 2026-04 cohort

Secondary writeups

• dev.to / wonderlab — One Open Source Project a Day No.50 (Apr 28, 2026) — the post that crystallised the “npm moment” framing.
• byteiota — Claude Code Skills Go Viral: 22K Stars in 24 Hours (Apr 26, 2026) — the 21,900-stars-in-24-hours number.
• OSS Insight — 50,000 Stars for One Person’s Config File — the “personal AI stacks” analysis with star-to-fork ratios.
• ShareUHack GitHub Trending Weekly 2026-04-29 — weekly star deltas and ecosystem framing.
• HN — This is why the grill me skill went viral
• HN — Bossie comment on Matt-inspired Linear workflow

Adjacent collections

• obra/superpowers — 178k stars
• addyosmani/agent-skills — 27.7k stars
• vercel-labs/agent-skills — 26.1k stars
• vercel-labs/skills — the npx CLI, 16.9k stars
• VoltAgent/awesome-agent-skills — 20.2k stars, curated awesome-list
• google/skills — 6.5k stars
• antfu/skills — 4.8k stars
• microsoft/skills — 2.2k stars

Registry candidates

• microsoft/apm — Agent Package Manager
• mpak.dev — secure registry with trust scores
• mcpm.sh — MCP package manager and profiles
• claudemarketplaces.com — curated discovery
• skillsmp.com — comprehensive aggregation

Internal links

• /blog/claude-skills-vs-mcp-vs-subagents-vs-cli-2026-decision-matrix
• /blog/what-are-claude-code-skills
• /blog/why-your-claude-skill-isnt-activating-2026-fixes
• /blog/mcp-security-200000-exposed-servers-owasp-mcp-top-10-cves
• /skills/using-superpowers
• /skills/brainstorming
• /skills/test-driven-development
• /skills/writing-plans
• /skills/executing-plans
• /skills/web-design-guidelines
• /skills/vitest
• /skills — browse all