agent-skills Production-Grade Engineering Pipeline

addyosmani/agent-skills (75K+ GitHub stars, trending #1 on GitHub July 10-11, 2026) is an open-source library that provides pre-built production-grade engineering skills for AI coding agents. Instead of building code review, test generation, security auditing, refactoring, and documentation agents from scratch, teams install agent-skills and get all five immediately. Each skill is a self-contained module that an AI agent can invoke: the code review skill analyzes PR diffs against maintainability, security, and style standards; the test generation skill produces unit, integration, and e2e tests; the security audit skill scans for OWASP Top 10, secrets exposure, and dependency vulnerabilities; the refactoring skill suggests and applies code improvements; the documentation skill generates and updates API docs, README files, and inline comments. Created by Addy Osmani (Google Chrome engineering team), agent-skills is designed to be framework-agnostic — it works with Claude Code, Codex, Cursor, GitHub Copilot, and any MCP-compatible agent. The skills are distributed as a single npm package with zero external API dependencies (all analysis runs locally via tree-sitter AST parsing).

BUSINESS PROBLEM

Engineering teams adopting AI coding agents quickly discover that a raw LLM is not production-ready. According to GitHub's State of the Octoverse 2025 report, 67% of developers using AI coding assistants reported spending more time reviewing AI-generated code than writing their own. The gap is in production-grade skills: AI agents can generate code, but they lack structured code review, comprehensive test generation, and automated security auditing out of the box. Building these skills from scratch costs 2-4 weeks of engineering time per skill. For a team wanting code review, test gen, security audit, refactoring, and documentation agents, that is 10-20 weeks of custom development. agent-skills collapses this to a single npm install. The library is built on patterns used by Google's internal engineering teams and validated by 75K GitHub stars in under 3 months. For a 50-person engineering team shipping 20 PRs per week, the code review skill alone could save 10-15 engineer-hours per week currently spent on manual review of boilerplate and style issues.

WHO BENEFITS

Platform engineer at a 100-person engineering org responsible for developer tooling who is spending 3 months building custom code review, test, and security agents from scratch and needs production-grade skills immediately. Engineering manager at a mid-market SaaS company who wants every PR to pass automated code review, test coverage validation, and security scanning before human review, without building custom agent infrastructure. DevOps engineer integrating AI agents into CI/CD pipelines who needs pluggable skills that work with existing GitHub Actions, GitLab CI, or Jenkins workflows without framework lock-in.

HOW IT WORKS

Step 1 - Install. Run npm install @addyosmani/agent-skills in the project. Step 2 - Configure. Create agent-skills.config.json with repository settings, linting rules, test framework preferences, and security policies. Step 3 - Run Code Review. The agent invokes code-review skill on a PR diff: skills analyze diff against 40+ maintainability and security patterns. Step 4 - Generate Tests. The agent invokes test-gen skill on changed files: skills produce unit tests (Vitest/Jest/pytest), integration tests, and e2e test skeletons with mocks. Step 5 - Security Scan. The agent invokes security-audit skill: skills scan for secrets (API keys, tokens), OWASP vulnerabilities, dependency risks, and misconfigurations. Step 6 - Apply Refactoring. The agent invokes refactor skill: skills suggest targeted improvements for code quality, performance, and readability with inline diffs. Step 7 - Auto-Document. The agent invokes docs skill: skills update README, API docs, and inline comments to reflect all changes. Step 8 - PR Summary. All skill outputs are compiled into a structured PR comment with severity-labeled findings and action items.

TOOL INTEGRATION

agent-skills (Addy Osmani, July 2026, MIT, 75K+ stars) - Core library of 5 production engineering skills. npm - Package distribution. tree-sitter - AST parsing across 33 languages (on-device, zero API calls). Claude Code - Supported coding agent platform. Codex - Supported coding agent platform. Cursor - Supported coding agent platform. GitHub Copilot - Supported coding agent platform. MCP protocol - Standard agent-tool communication. GitHub Actions - CI/CD integration for automated PR review. agent-skills.config.json - Project-level configuration file.

ROI METRICS

Setup time: from 10-20 weeks custom development to npm install + configure (community estimate). Code review automation: 40+ patterns checked per PR vs manual review coverage. Test generation: unit, integration, and e2e test skeletons for every changed file. Security audit: OWASP Top 10, secret scanning, dependency vuln detection (OWASP, 2025). Refactoring suggestions: targeted improvements with inline diffs, not generic advice. 75K GitHub stars in under 3 months validates community adoption. Zero external API dependencies: all analysis runs locally via tree-sitter. Framework-agnostic: works with any MCP-compatible coding agent or CI/CD pipeline.

CAVEATS

MEDIUM - Skills are pre-built patterns; highly specialized or domain-specific reviews may need custom skill development. MEDIUM - Zero API dependencies means local performance scales with developer machine specs; large monorepos may see slower analysis on underpowered laptops. LOW - Works with all major coding agents but MCP protocol compatibility varies; test with your specific agent before production deployment. MODERATE - 75K stars reflects viral growth; enterprise support, SLAs, and managed deployments are not available.