Skills For Real Engineers is a collection of small, adaptable instructions that help coding agents handle practical software engineering tasks. It is for developers who want composable workflows that work across models and coding agents.
Borrowing it
Nothing to install: this file belongs to mattpocock/skills. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/mattpocock/skills/main/CLAUDE.mdgit clone --depth 1 https://github.com/mattpocock/skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/mattpocock/skills/claude-md)<a href="https://agentmods.dev/instructions/mattpocock/skills/claude-md"><img src="https://agentmods.dev/badge/instructions/mattpocock/skills/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/mattpocock/skills/claude-md"><img src="https://agentmods.dev/badge/instructions/mattpocock/skills/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01039 | $0.01039 |
| Opus 5.5 | $0.00416 | $0.00416 |
| Sonnet 5.5 | $0.00208 | $0.00208 |
| Haiku 4.5 | $0.00104 | $0.00104 |
Grade A, and why
skills CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 34 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skills are organized into bucket folders under skills/:
engineering/: daily code workproductivity/: daily non-code workflow toolsmisc/: kept around but rarely used, not promotedin-progress/: beta: public on purpose, feedback wanted, not shipped in the plugindeprecated/: no longer used
Every skill in engineering/ or productivity/ (the promoted buckets) must have a reference in the top-level README.md and an entry in .claude-plugin/plugin.json's skills array (the Claude Code plugin ships exactly the promoted set). Skills in misc/, in-progress/, and deprecated/ must not appear in either.
Install commands are copied verbatim from .agents/install-block.md. .claude-plugin/marketplace.json is the repo's own marketplace. Every agent except Claude Code installs from it to get automatic updates, and Claude Code uses claude-plugins-official. Run claude plugin validate . --strict after touching either manifest. ADR 0002 records why.
Each skill entry in the top-level README.md must link the skill name to its SKILL.md.
Each bucket folder has a README.md that lists every skill in the bucket with a one-line description, with the skill name linked to its SKILL.md. The promoted buckets' README.mds and the top-level README.md group entries into User-invoked and Model-invoked; non-promoted bucket README.mds (misc/, in-progress/) use a flat list.
Skills in engineering/ and productivity/ also have a human-facing docs page at docs/<bucket>/<skill-name>.md (the docs tree mirrors those two bucket folders under skills/). The published URL is https://aihero.dev/skills-<skill-name> regardless of bucket: the docs path is repo organisation only. When you add, rename, or change the behaviour of a skill in engineering/ or productivity/, create or re-sync its docs page following .agents/writing-docs.md. A finished page carries four sections: What it does, When to reach for it, Common questions, and It's working if. writing-docs.md holds the template, the section order, and where to hunt for the questions. Skills in the non-promoted buckets (misc/, in-progress/, deprecated/) get no docs page. The one exception is a promoted skill removed outright: its page stays, marked archived (see writing-docs.md).
Every SKILL.md is either user-invoked (disable-model-invocation: true plus policy.allow_implicit_invocation: false in agents/openai.yaml, reachable only by the human) or model-invoked (model- or user-reachable). See .agents/invocation.md.
ask-matt is the router that maps every user-reachable skill and how they relate. The same trigger that re-syncs a docs page applies to it: whenever you add, rename, remove, or change how a user-reachable skill fits the flows, re-read ask-matt's SKILL.md and update it so the map stays accurate: a new skill it never mentions, or a stale one it still routes to, is a router that lies.
To (re)link every skill outside deprecated/ and misc/ into the local harness skill directories (~/.claude/skills, ~/.agents/skills), run scripts/link-skills.sh. Each entry is a symlink into this repo, so a git pull keeps installed skills current; re-run the script after adding, removing, or renaming a skill.
No em-dashes anywhere in this repo's prose (SKILL.md files, docs, README.md, CHANGELOG.md, ADRs, changesets, code comments). Where a sentence reaches for one, rewrite it instead with a comma, colon, period, parentheses, or a conjunction, whichever the sentence actually wants; never do a blind character substitution.
Every skill that dispatches a subagent says to start it with a fresh context window. Some harnesses (Codex, for one) fork the parent conversation by default, and a fork inherits the parent's context, which is what the subagent was meant to escape.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +2 lines · +54 tokens per session 49be3ee6ecd6
- 27d ago Changed · -13 tokens per session cd5ad06f3a1f
- 29d ago Changed · +6 lines · +40 tokens per session 77981dcaf49c
- 1mo ago Changed · +25 tokens per session b5158c840874
- 2mo ago Changed · +10 tokens per session f5d151bce841
- 2mo ago First seen · 26 lines · 923 tokens per session scan A fa8a2aaf79ca
skills CLAUDE.md is an instructions file published in the GitHub repository mattpocock/skills (313,341 stars, last pushed yesterday), licensed MIT. It adds 1,039 tokens to every session, about $0.0042 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
deepseek-harness AGENTS.md
AGENTS.md instructions for deepseek-ai/deepseek-harness, covering agents.md, pre-stable apis and released session data, repository layout, commands and host sandbox failures.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).