crafter skills
A set of skills from real work: npm supply-chain audit, CLI building, Obsidian plugin release and an AGENTS.md hierarchy
- 114 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- `supply-chain-audit` scans files and packages across the whole developer machine and then leads to cleanup steps
- `surface-recon` covers mapping networks, devices and firmware, so run it only against authorized targets
- Skills are copied into the agent directory and run with your permissions
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/crafter-skillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- `supply-chain-audit` scans files and packages across the whole developer machine and then leads to cleanup steps
- `surface-recon` covers mapping networks, devices and firmware, so run it only against authorized targets
- Skills are copied into the agent directory and run with your permissions
This is third-party code. Review the repository files before installing.
What it does
crafter skills is a catalog of skills the Crafter Station team extracted from finished work. The `npx skills add crafter-station/skills` command opens a list to pick from, and one skill installs with the `--skill` flag. It claims to work with Claude Code, Cursor, Copilot and ten more agents. The README lists seven skills. Audit: `supply-chain-audit` checks a developer machine for npm and PyPI package compromise against a versioned indicator pack and returns a PASS or FAIL verdict, changing nothing. Build: `generate-brand-assets` makes 1200 by 630 OG images and favicon formats, `surface-recon` maps authorized targets, `cli-build` designs a CLI for an agent and a human, and `skill-gen` generates skills from documentation. Publish: `obsidian-plugin-release` runs an Obsidian plugin release. Context: `intent-layer` lays an AGENTS.md hierarchy through a repository.
Who it is for. Developers who want skills with a maturity label for dependency audits, Obsidian plugin releases, CLI building and structuring a repository for agents.
Good fit when
- After news of package infections you need to know whether npm and PyPI compromise traces sit on a work machine
- A repository has grown and agents need an AGENTS.md file hierarchy with a single root context
- An Obsidian plugin ships with no skipped steps: version bump, build, signed tag and publish
- A project needs a 1200 by 630 OG image and favicons in brand colors
- A command-line tool is designed so an agent can operate it and a human can see what it does
Not a fit when
- You need a skill for one specific tool: those live in the tools' own repositories, for example `skillkit`, `spoti-cli` and `sismo-cli`
- You want `skill-gen`: the author marked it `deprecated` and does not recommend it
- The recon targets are someone else's systems without the owner's permission: `surface-recon` is meant for authorized targets
Example request
Run the supply-chain-audit on this machine and show a PASS or FAIL verdict with the indicators foundLimitations
Skills differ in maturity: `stable` for `supply-chain-audit`, `generate-brand-assets`, `obsidian-plugin-release` and `intent-layer`, `candidate` for `surface-recon` and `cli-build`, `deprecated` for `skill-gen`. The source of truth is `maturity.json`. A skill version describes the document itself and not the tool behind it. The `skills/` folder is wider than the README table: it also holds `cli-audit`, which the table lacks. Skills tied to a single project install from that project's repository.
How to disable. Delete the folders of the skills you installed from the agent skills directory, for example `~/.claude/skills/` or the project `.claude/skills/`. No global package is involved.
FAQ
How do I install one skill instead of the whole set?
Use `npx skills add crafter-station/skills --skill supply-chain-audit -g`, where the name after `--skill` is the skill you want and `-g` installs it globally. Without flags the command shows a list to pick from.
What does `supply-chain-audit` check?
A developer machine for traces of npm and PyPI package compromise: Shai-Hulud 2.0, Mini Shai-Hulud, TeamPCP and the Axios DPRK attacks. A three-phase scan yields a PASS or FAIL verdict, followed by a 48-hour bake period.
What do the `stable` and `candidate` labels mean?
They describe maturity: `stable` means used on real work and recommended, and `candidate` means it works with thin evidence. There are also `experimental` and `deprecated`; the author keeps the evidence for each label in `maturity.json`.
What is `intent-layer` for?
It lays a hierarchy of AGENTS.md files through a repository so an agent navigates code like a senior engineer. By the skill's rule the project root holds one context file: CLAUDE.md and AGENTS.md do not coexist there.
How does `skill-gen` differ from the other skills?
It generated skills from documentation and is marked `deprecated`: the folder stays for provenance and the install command keeps resolving. The author asks you to read the maturity section before using it.
Discussion
No questions or reviews yet.
Related
SkillsThe author's personal set: shared agent rules and dozens of skills for GitHub, the browser, macOS, messaging and releases, plus a sync script
skills-npm links agent skills shipped in your dependencies in node_modules and listed in the skills field of package.json
Builder Skills
Skills for agents
A set of small skills from Builder.io for agent work habits: visual plans and diff recaps, docs-first checks, cross-agent review and clean status updates
Softaworks Agent Toolkit
Softaworks Agent Skills
A marketplace of skills, subagents and commands for coding agents: development, documentation, planning and workplace communication
Dozens of mizchi's agent skills: frontend audits, AWS, Cloudflare, SQL, Playwright and OpenTelemetry, installed one by one
Over 1,100 ready-made skills for Claude Code, Codex, Gemini CLI and Cursor, plus an MCP server that picks a skill for the task
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| crafter skills (this card) | no | 114 | |
| Agent Skills by Addy Osmani | no | 113,521 | engineering skills along the development cycle: spec, plan, tests and release |
| security-audit | no | 60,708 | a single code-security audit skill from Cloudflare, without checking the machine for infected packages |
README in short
The documentation groups skills by task (audit, build, publish, context), explains the four maturity levels and the rules for promoting a status. Separate sections cover versioning, the flat folder layout and a list of skills that live in the repositories of their own tools.
README badge
Original SKILL.md
--- name: intent-layer version: 1.0.0 description: > Set up hierarchical Intent Layer (AGENTS.md files) for codebases. Use when initializing a new project, adding context infrastructure to an existing repo, user asks to set up AGENTS.md, add intent layer, make agents understand the codebase, or scaffolding AI-friendly project documentation. --- # Intent Layer Hierarchical AGENTS.md infrastructure so agents navigate codebases like senior engineers. ## Core Principle **Only ONE root context file.** CLAUDE.md and AGENTS.md should NOT coexist at project root. Child AGENTS.md in subdirectories are encouraged for complex subsystems. ## Workflow ``` 1. Detect state scripts/detect_state.sh /path/to/project → Returns: none | partial | complete 2. Route none/partial → Initial setup (steps 3-5) complete → Maintenance (step 6) 3. Measure [gate - show table first] scripts/analyze_structure.sh /path/to/project scripts/estimate_tokens.sh /path/to/each/source/dir 4. Decide No root file → Ask: CLAUDE.md or AGENTS.md? Has root file → Add Intent Layer section + child nodes if needed 5. Execute Use references/templates.md for structure Use references/node-examples.md for real-world patterns