claude-skills

claude-skills

Portable Claude Code user-scope skills, version-controlled so the same skills are available on every machine you use. Each skill encodes a multi-phase runbook plus the gotchas learned from running it end-to-end on real hosts.

What's in here

Skill	What it does
skills/internal-ca	Bootstrap a 2-tier internal Certificate Authority on a Linux host: Root CA → Intermediate CA → service certs, plus HashiCorp Vault PKI engine, OCSP responder, CRL HTTP server, Ansible deploy playbook, and a 3-mode revocation script. Designed for demo/lab use; surfaces production-hardening pointers without auto-executing them.
skills/mtls	Add mutual TLS (server-trusts-client) on top of an existing internal CA + NGINX HTTPS setup. Issues clientAuth certs, bundles as PKCS#12 for endpoint install, enforces ssl_verify_client with a Root+Intermediate trust bundle, and wires CRL-based revocation.
skills/lxd-claude-setup	Provision Claude Code on a headless LXD / Linux server (Proxmox or bare): SSH fingerprint reset, password auth, passwordless key copy, Node.js install, Claude Code install pinned to a working version, OAuth login via SSH port-forward for Max subscriptions, and the TUI onboarding-loop fix.

internal-ca and mtls cross-reference each other: internal-ca hands off to mtls when client cert work comes up; mtls assumes internal-ca outputs are in place.

Scope: what this repo does not manage

This repo is the source of truth for user-scope skills (~/.claude/skills/<name>). It intentionally does not mirror skills delivered by plugins (under ~/.claude/plugins/) — e.g. the superpowers:*, astronomer-data:*, ui-ux-pro-max:*, skill-creator, frontend-design, claude-api, and the various Anthropic agent-skills marketplace entries. Those are owned and updated by their plugin marketplaces; copying them in here would diverge and rot. Install/update them through the plugin system, not this repo.

Install (new machine bootstrap)

This repo can be consumed two ways. Pick whichever fits the machine.

Option A — As a Claude Code plugin (recommended)

The repo ships a .claude-plugin/ manifest, so it can be registered as a marketplace and installed through Claude Code's plugin system. Inside Claude Code:

/plugin marketplace add 14f3v/claude-skills
/plugin install claude-skills@claude-skills

That installs all bundled skills (internal-ca, mtls, lxd-claude-setup) under ~/.claude/plugins/, with updates managed by /plugin (no git pull needed). Confirm with /plugin — claude-skills should appear in the installed list.

Option B — As a user-scope skill collection (clone + symlink)

For machines where you prefer the user-scope skill layout (~/.claude/skills/<name>), or where you want to edit skills in-place and have the changes reflect live:

git clone https://github.com/14f3v/claude-skills.git ~/claude-skills
cd ~/claude-skills
./install.sh

install.sh symlinks every skills/<name>/ directory in this repo into ~/.claude/skills/<name>. That means: clone once, then any future git pull is picked up live — no re-install needed. Restart Claude Code after the first install so the slash commands register.

The two options are mutually exclusive on a given machine — pick one. Mixing them would register the same skills twice under different paths.

Verify the install

After restarting Claude Code, confirm the skills are linked and visible:

ls -l ~/.claude/skills/                      # entries should be symlinks into ~/claude-skills/skills/

Inside Claude Code, the skills should appear in the available-skills list under their bare names (internal-ca, mtls, lxd-claude-setup, …) and respond to their slash commands.

Install modes

Command	Effect
./install.sh	symlink (default) — edits in this repo immediately reflect in Claude Code
./install.sh --copy	snapshot copy — repo and live skills diverge after install
./install.sh --dry-run	preview without changing anything
./install.sh --uninstall	remove the symlinks/copies (only those we own)

If a real (non-symlink) skill with the same name already exists in ~/.claude/skills/, the installer backs it up to <name>.bak-<timestamp> rather than overwriting silently. Re-running ./install.sh on a machine that's already linked is a safe no-op for already-linked entries.

Usage

After install + Claude Code restart, the skills are available two ways:

1. Auto-trigger — describe the work, no slash:

"set up an internal CA on this VM"           → internal-ca activates
"add mutual TLS to platform.acme.internal"   → mtls activates

2. Explicit slash command:

/internal-ca
/mtls
/mtls iphone.branch.acme.internal     ← with hint

Updating across machines