Open agent skills, tested on real targets
Plain-markdown skills for Claude Code, Codex, Cursor and any agent that reads a SKILL.md. Each does one concrete job and shows its evidence.
Installs the router: describe an outcome and it picks the skills. Or browse every skill.
/web-preflight skillsmith.tech reading SKILL.md · 4 checks http → https 301 HSTS, CSP present X-Frame, nosniff present probing 19 sensitive paths .env .git maps admin 404 × 19 catch-all routing none verdict PASS
60 skills and 7 mods · 12 workflows · 9 categories · 0 API keys
ScrollEach one earned its place with a real run you can open. The rest are on the skills page, every one with its version, last update and known limits.
release · v1.0.0
Checks a site you own before you ship it, without pretending a status code is a finding. A 200 on /.env that matches the app shell is catch-all routing, a blanket 403 is an unanswered question, and a check that never ran becomes INCONCLUSIVE — never a pass.
Shown working, 24 Oct 2026, on skills.caffeinity.com. Probed 19 sensitive paths; nothing exposed and every security header in place: PASS. See the run
seo · v1.0.0
Crawls a site you own and returns deterministic, evidence-backed technical SEO findings, with blocked or unrun checks reported INCONCLUSIVE rather than a pass.
Shown working, 24 Oct 2026, on skills.caffeinity.com. Found one broken internal link across 24 pages; the re-crawl after the fix came back clean. See the run
authoring · v1.0.0
Audits and fine-tunes a skill that already exists: the description that never fires, overlap with installed siblings, stale names and counts, handoff contracts that do not hand off. Ships check_skill.py, a deterministic validator over frontmatter, folder and heading agreement, description length and reference paths that do not exist. Not for creating one from scratch; that is draft-skill.
Shown working, 24 Oct 2026, on the 42 skills in this catalogue. Caught one skill that strict installers could not load; fixed in that skill and in tune-skill. See the run
Seven real runs from 23 and 24 October 2026: what each skill found, and what changed because of it. Nothing here is a mock-up; where a fix is still waiting on a decision, the tab says so.
seo-crawl · skills.caffeinity.com
pages 24 of 24 fetched checks 5 complete findings 1 error · 12 info
Cloudflare rewrote a sample address on the red-team page into a link that 404s. The address is now excluded from obfuscation and the 12 long titles and descriptions were shortened.
Before → after
23 Oct · error broken-internal-link /cdn-cgi/l/email-protection → 404
24 Oct · new build, 25 pages fetched errors 0 warnings 25 canonical → skills.caffeinity.com (expected on the preview host)
fixed; re-crawled 24 October
web-preflight · skills.caffeinity.com
http → https 301 HSTS, CSP present X-Frame, nosniff present
All 19 high-value paths return a real 404 rather than the homepage, so a missing file cannot pass for a present one.
Before → after
sensitive paths probed 19 .env, .git, source maps, admin, debug
404 × 19 catch-all none
verdict: PASS
tune-skill · check_skill.py × 42 skills
SKILL.md files 42 pass 41 WARN 16 · NOTE 2
tune-skill's own fallback parser had let the error through without PyYAML; it now fails it too.
Before → after
FAIL crash-test invalid YAML unquoted ": " in description
crash-test description in a YAML block check_skill.py: 0 fail
fixed in crash-test and tune-skill
tune-skill · regress.py × 44 skills
skills checked 44 regressions 0 improvements 23 new skills 3
regress.py runs the validator on every skill, then the checks one file cannot show: handoffs to skills that do not exist, and two skills claiming the same trigger. The nightly health job runs it; W10 fixes what it finds.
Before → after
dangling study-system → module-learning-path-generator collision release-gate-chair & -ledger "should we deploy"
study-system → course-builder (new) release-gate variants: one owner 0 regressions · 23 improvements
24 October, after the W10 fixes
findable · arm-pz/tune-skill
baseline queries 0 of 5 found same name hburaktasyurek/tune-skill skills.sh 2 of 42 listed
The discovery kit (About text, topics, README opening, re-check date) is drafted; nothing public changes without a go-ahead.
Before → after
About (none that names the job) found 0 of 5 target queries
About Agent skill that audits an existing
SKILL.md: why it does not trigger,
where it overlaps a sibling skill…
check_listing.py OK (250/350)drafted; owner's call on the name
upstream-check · listing drift
site index.json 25 homepage 22 (read as 27)
The drift check counted section anchors as skills and hid the difference; both bugs are fixed upstream.
Before → after
index-only upstream-check
release-gate
publish-release-gatehub, pages, sitemap and indexes generated from one site/skills.json
fixed in upstream-check and this site
draft-skill · caffeinity-routing
skills citing it 5 (W3, W4) trigger cases 10 + 4 pairs
Five skills pointed at workflows in a routing skill that did not exist. draft-skill wrote it and tune-skill's validator checked it.
Before → after
W3, W4 cited by 5 skills router (did not exist)
caffeinity-routing 11 brews check_skill.py 0 fail · 0 warn
new; now eleven brews
One plugin carries every skill on this site plus twelve agents, one per workflow. Or take a single skill into any agent that reads a SKILL.md.
Every skill, plus the twelve agents: skill-builder, release-gatekeeper, seo-lead and the rest.
The same plugin from the Codex marketplace in the repo; then install caffeinity from the Plugins directory. caffeinity-routing picks the brew.
Cursor, Qoder, Gemini CLI and others: one skill at a time with the skills installer. Swap wordsmith for any skill; every skill page has its exact command.
Agents can also read /llms.txt and the discovery index.
We build custom skills and workflows, tested on your real tasks, for the agents your team already uses.