By kzarzycki
Developer toolkit. Contains audit-third-party-software (safety audit before installing repos/binaries/packages, with SAFE/CAUTION/UNSAFE verdict and file:line citations) and context-extractor (analyze any project and generate a CLAUDE.md from observed conventions).
Audit third-party software (GitHub repos, tarballs, compiled binaries, npm packages, Claude Code plugins) for safety BEFORE install. Checks for telemetry, data exfiltration, prompt injection, supply-chain attacks, closed-source phone-home components, hardcoded credentials, user-hostile defaults, and unauthenticated local services. Produces a structured verdict (SAFE/CAUTION/UNSAFE) with file:line citations, a plain-English description of what the software actually does based on code rather than marketing, and a concrete install recommendation. Use this skill whenever the user wants to clone/install/try/run/use ANY third-party code, package, binary, or tool from the internet — even casually. Trigger on phrases like "is X safe to install", "clone and review", "audit this repo", "check this before I use it", "no telemetry check", "should I install X", "what does this do", "review this tool", or whenever the user shares a GitHub URL, npm package name, tarball, or plugin/skill reference with apparent install intent. Also trigger proactively whenever the user is about to run an install command (`pnpm add`, `npm install`, `brew install`, `curl | sh`, `git clone` followed by build/run) against an unfamiliar source. Skip only when the user explicitly says they've already audited it or it's first-party code they wrote.
Analyze a project and extract conventions, patterns, and context into a CLAUDE.md file. Works for any project type — code repos, presentation collections, research corpora, documentation projects. Trigger on "extract conventions", "analyze project patterns", "generate CLAUDE.md", "what are the conventions", or /conventions.
Krzysztof Zarzycki's plugin marketplace for Claude Code. Four toolkits covering workflow, research, engineering, and presales.
| Plugin | What's inside |
|---|---|
| workflow | flow (.work/ workspace + subagent delegation), orchestrator (restrict main thread to read-only), find-conversation (search past CC sessions). Plus the experimental /promote-learnings command. |
| research | deep-research (multi-source orchestration with Perplexity/Tavily/Exa/Gemini/native search), platform skills for chatgpt-deep-research, claude-ai-deep-research, gemini-deep-research. |
| engineering | audit-third-party-software (safety audit before installing repos/packages), context-extractor (analyze any project, generate CLAUDE.md from observed conventions). |
| content | voice-dna (extract 8-dim writing style from someone's LinkedIn — useful for stakeholder prep, content writing, proposal personalization). |
Add the marketplace, then install plugins by name.
# In Claude Code:
/plugin marketplace add kzarzycki/agent-skills
/plugin install workflow@kzarzycki-agent-skills
/plugin install research@kzarzycki-agent-skills
/plugin install engineering@kzarzycki-agent-skills
/plugin install content@kzarzycki-agent-skills
Pick the plugins you want. Each is independent.
Clone, register the local checkout as a marketplace, and iterate without pushing:
git clone https://github.com/kzarzycki/agent-skills ~/dev/agent-skills
# In Claude Code:
/plugin marketplace add /Users/yourname/dev/agent-skills
To pull in changes from a local edit without pushing first, see .claude/CLAUDE.md for the git remote add local + fast-forward merge pattern.
/flow:init bootstraps a .work/ workspace per project — a Date-prefixed dir per work stream, append-only log.md, idea capture, ITEM.md manifest with research/plan/execute/verify lifecycle. /orchestrator on restricts the main thread to read-only and forces all writes through subagents.
deep-research orchestrates parallel agents across web search providers and produces cited reports with confidence scores. Use chatgpt-deep-research, claude-ai-deep-research, or gemini-deep-research to delegate to those platforms' native research UIs.
audit-third-party-software reads a repo/package/binary and outputs a SAFE/CAUTION/UNSAFE verdict with file:line citations covering telemetry, supply-chain risks, hardcoded credentials, and what the code actually does. context-extractor walks any project and writes a CLAUDE.md capturing observed conventions and patterns.
voice-dna extracts an 8-dimension style profile from a person's LinkedIn posts — vocabulary fingerprint, signature moves, posting modes, and a Prompt Engineering Guide for AI-assisted writing in that voice. Use it to prep before outreach, draft a tailored proposal, or calibrate an AI co-author to a specific style.
<plugin>/.claude-plugin/plugin.json follow semver. Bump on every PR with changes.feat:, fix:, chore:, etc.).Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
MCP bridge for live-editing open PowerPoint presentations on macOS via Office.js
Persistent workspace, agent orchestration, session search, and learning consolidation for Claude Code. Bundles flow (.work/ workspaces with subagent delegation), orchestrator (restrict main thread to read-only), find-conversation (search past CC sessions), and the experimental /promote-learnings command for end-of-session rule consolidation.
Multi-round deep research orchestration with parallel agents and platform knowledge for ChatGPT Deep Research, Claude.ai Research, and Gemini Deep Research. The deep-research skill coordinates Perplexity/Tavily/Exa/Gemini/native-WebSearch agents to produce cited reports; the platform skills handle delegation to each web UI.
Search Cookidoo recipes, inspect official details, translate recipes, and save custom recipes through a local MCP server.
Content preparation toolkit. Currently: voice-dna (extract an 8-dimension writing-style profile from a person's LinkedIn posts — useful for understanding stakeholder communication preferences before outreach, content writing, or proposal personalization).
npx claudepluginhub kzarzycki/agent-skills --plugin engineeringComprehensive skill pack with 66 specialized skills for full-stack developers: 12 language experts (Python, TypeScript, Go, Rust, C++, Swift, Kotlin, C#, PHP, Java, SQL, JavaScript), 10 backend frameworks, 6 frontend/mobile, plus infrastructure, DevOps, security, and testing. Features progressive disclosure architecture for 50% faster loading.
Develop, test, build, and deploy Godot 4.x games with Claude Code. Includes GdUnit4 testing, web/desktop exports, CI/CD pipelines, and deployment to Vercel/GitHub Pages/itch.io.
Comprehensive feature development workflow with specialized agents for codebase exploration, architecture design, and quality review
Design fluency for frontend development. 1 skill with 23 commands (/impeccable polish, /impeccable audit, /impeccable critique, etc.) and curated anti-pattern detection.
UI/UX design intelligence. 67 styles, 161 palettes, 57 font pairings, 25 charts, 15 stacks (React, Next.js, Vue, Svelte, Astro, SwiftUI, React Native, Flutter, Tailwind, shadcn/ui, Nuxt, Jetpack Compose). Actions: plan, build, create, design, implement, review, fix, improve, optimize, enhance, refactor, check UI/UX code. Projects: website, landing page, dashboard, admin panel, e-commerce, SaaS, portfolio, blog, mobile app. Elements: button, modal, navbar, sidebar, card, table, form, chart. Styles: glassmorphism, claymorphism, minimalism, brutalism, neumorphism, bento grid, dark mode, responsive, skeuomorphism, flat design. Topics: color palette, accessibility, animation, layout, typography, font pairing, spacing, hover, shadow, gradient.
Behavioral guidelines to reduce common LLM coding mistakes, derived from Andrej Karpathy's observations on LLM coding pitfalls