Agent Skills Standard

Make your AI write code like your best engineer. One command. Every AI agent. Every project.

npx agent-skills-standard@2.1.1 init
npx agent-skills-standard@2.1.1 sync
# Done. Your AI now follows your team's engineering standards.

Every team has coding standards. But AI agents don't know them.

You end up repeating the same instructions: "Use OnPush change detection", "Always wrap errors with context", "No business logic in handlers". And every time, you face the same trade-off:

• Too many rules = AI forgets them, wastes tokens, gets confused
• Too few rules = AI writes generic code that doesn't match your standards
• Copy-paste .cursorrules = out of date in a week, doesn't scale to teams

Agent Skills Standard turns your engineering rules into modular, version-controlled skills that any AI agent can load on demand.

You run: npx agent-skills-standard sync

What your AI gets:

1. AGENTS.md (router ~20 lines)
   "Editing *.ts? Check typescript/_INDEX.md"

2. typescript/_INDEX.md (trigger table)
   File Match:  typescript-language  *.ts, *.tsx, tsconfig.json
   Keyword:     typescript-security  validate, sanitize, auth

3. typescript-language/SKILL.md (loaded on demand)
   The actual rules — only when needed.

The AI loads only the skills that match the file being edited and the task at hand. No wasted tokens. No forgotten rules.

Detects your tech stack and creates a .skillsrc config:

npx agent-skills-standard@latest init

Downloads skills into your AI agent's folders and generates the index:

npx agent-skills-standard@latest sync

Your AI agent now reads AGENTS.md automatically. Skills activate based on what file you're editing and what you ask for.

Works instantly with Cursor, Claude Code, GitHub Copilot, Gemini CLI, Windsurf, Trae, Kiro, and Roo. No plugin or extension needed — the CLI generates each agent's native format.

Every skill is audited for token efficiency (averaging ~500 tokens) and tested with automated evals.

Full skill list with token metrics: Skills Directory | Benchmark Report

The .skillsrc file controls what gets synced:

registry: https://github.com/HoangNguyen0403/agent-skills-standard
agents: [cursor, copilot, claude, gemini]
# Standard registry skills
skills:
  flutter:
    ref: flutter-v1.6.3
    exclude: ['getx-navigation'] # Don't use GetX? Exclude it.
    custom_overrides: ['bloc-state'] # Protect your local modifications.
  react:
    ref: react-v1.3.3
  golang:
    ref: golang-v1.3.2
  common:
    ref: common-v2.0.3

# Local custom standalone skills
custom_skills:
  - path: './.skills/my-custom-rule.md'
    triggers: ['*.ts', 'keyword']

Skills are package-aware: if your Flutter project uses BLoC but not GetX, just exclude the GetX skills. The AI only sees what's relevant to your stack. The custom_skills feature allows you to index your own .md files directly into AGENTS.md and _INDEX.md, ensuring your project-specific rules are always visible to the AI.

Every AI agent follows the same hierarchical lookup — no agent-specific setup needed:

AGENTS.md (compact router, ~20 lines)
   |
   |  "Editing *.go? Read golang/_INDEX.md"
   v
_INDEX.md (per-category trigger table)
   |
   |  File Match:  golang-database     internal/adapter/repository/**
   |  Keyword:     golang-security     encrypt, auth, validate
   v
SKILL.md (loaded on demand, ~500 tokens)
   |
   |  The actual engineering rules
   v
Your AI writes code that follows your standards.

File Match = auto-checked when you edit a matching file. Keyword Match = checked only when your prompt mentions the concept.

This means editing a .ts file loads 6 relevant skills instead of 27 — no confusion, no token waste.

Skills are text files, not code. They cannot execute commands, access your filesystem, or make network requests. Here's the full picture:

• Pure Markdown/JSON — no binaries, no scripts, no executable code
• Sandboxed — skills run inside the AI's context window, not as OS processes
• Open source — every skill is auditable on GitHub before you use it

• Downloads text only — fetches Markdown and JSON from the public registry
• No telemetry — zero data collection, no analytics, no background daemons
• No code or project data leaves your machine — feedback is only sent if you explicitly run ags feedback

• Prompt injection scanning — every skill description is sanitized against known injection patterns (e.g., "ignore previous instructions") at index-generation time
• Automated eval testing — most skills include evals.json datasets that verify AI adherence to constraints via regression tests
• Zero-Trust protocol — the generated AGENTS.md enforces a mandatory audit: the AI must declare which skills it loaded before writing code, preventing silent rule-skipping
• Continuous benchmarking — skills are periodically tested against adversarial prompts to identify logic gaps and instruction drift

1. Propose: Open an issue with your skill idea.
2. Build: Fork the repo, add your skill to skills/<category>/, include evals.json.
3. PR: CI validates format, token count, and injection safety before merge.

See ARCHITECTURE.md for design details and CLI Architecture for service internals.

• License: MIT
• Author: Hoang Nguyen