agent-skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited agent-skills (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Open-source agent skills for shipping and operating real infrastructure. Each skill is a self-contained SKILL.md plus the references, scripts, and templates an agent needs to do the job well. They trigger on intent — you describe what you want, the relevant skill fires.
Cross-agent (Claude Code, Cursor, Codex, OpenCode, …) via the npx skills CLI, and installable as a full Claude Code plugin.
| Skill | What it does |
|---|---|
ec2-docker-host | Run many independent apps side-by-side on one AWS EC2 box with Docker — a shared reverse proxy (Caddy + auto-TLS) and shared Postgres/Mongo/Redis, with each app getting its own container, host port, database, and secret namespace. Provision a new host, adopt an existing one, deploy a project (monorepo or polyrepo), and run backups — without disturbing the apps already running there. |
More to come.
ec2-docker-host at a glanceTreats one EC2 instance as a small self-hosting platform. Four modes:
volume, Docker, the shared DB + proxy stack, backups).
a neighbor's workload.
project, own database + role, own secret namespace, an additive proxy vhost, validate-then-reload.
Defaults are lightweight (any OCI registry + host-side env files); an AWS-native path (ECR + SSM + GitHub OIDC) is documented as an opt-in upgrade.
Two install paths — pick what fits.
| Path | What gets installed | Best for |
|---|---|---|
| A. `npx skills` CLI (vercel-labs/skills) | Skills only (SKILL.md + references/scripts/assets) | Fastest install, cross-agent (Claude Code, Cursor, Codex, OpenCode, …) |
B. Claude Code plugin (/plugin or settings.json) | Skills + the plugin manifest | Full experience inside Claude Code |
npx skills add (recommended for quick install)# Install every skill in this repo to ~/.claude/skills/ for Claude Code, globally
npx skills add juncoding/agent-skills -g -a claude-code
# Browse what's in the repo without installing
npx skills add juncoding/agent-skills --list
# Install just one specific skill
npx skills add juncoding/agent-skills --skill ec2-docker-host -g -a claude-codeInside Claude Code, run /plugin and add this source:
github:juncoding/agent-skillsOr edit ~/.claude/settings.json (user-level) / .claude/settings.json (project-level) directly:
{
"plugins": {
"agent-skills": {
"source": "github:juncoding/agent-skills"
}
}
}Restart Claude Code; the skills become available and trigger on intent.
git clone [email protected]:juncoding/agent-skills.git ~/Dev/agent-skillsThen point a plugin source at the local path:
{
"plugins": {
"agent-skills": {
"source": "/Users/you/Dev/agent-skills"
}
}
}ec2-docker-host bundles shell scripts that SSH into a host and run `docker`, `psql`, and `caddy` with `sudo`. They are written to be additive and neighbor-safe (validate-then-reload the proxy, pull images before swapping, scope --remove-orphans per app), but they act on real infrastructure.
trust that flow, and stop if discovery shows something unexpected.
your servers.
.claude-plugin/plugin.json # Claude Code plugin manifest
skills/
ec2-docker-host/
SKILL.md # the skill (router + safety doctrine + isolation invariants)
references/ # per-mode deep dives
scripts/ # idempotent, neighbor-safe ops scripts
assets/ # fill-in templates (compose, vhost, entrypoint, host config)
evals/ # scenario test casesAdd a skill as a new directory under skills/<name>/ with a SKILL.md (a name + a specific, trigger-rich description in the frontmatter) and any references/scripts/assets it needs. Keep skills self-contained and intent-triggered. PRs welcome.
MIT © Bill Zhou
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.