1,400 Agent Skills, One Install Command, 36K Stars: The npm Moment for AI Workflows

The antigravity-awesome-skills repository hit 36,145 GitHub stars with a catalog of 1,400+ installable SKILL.md playbooks that work across Claude Code, Cursor, Codex CLI, Gemini CLI, Kiro, OpenCode, and GitHub Copilot.

One command: npx antigravity-awesome-skills --claude. That's it. Full library installed.

This is the npm moment for agent behavior. Just like npm standardized how JavaScript libraries get distributed, installable skill files are standardizing how coding agents get configured. A single skill definition works across seven different tools without modification. The skills are versioned, composable, and portable. They travel with you, not with the tool.

The catalog includes role-based bundles: planning, coding, debugging, testing, security review, infrastructure. Install the security bundle and your Claude Code sessions automatically run OWASP checks. Install the TDD bundle and the agent writes failing tests before implementation. These aren't suggestions. They're behavioral constraints that shape how the agent works.

I run a similar system for MindPattern. My agents have SKILL.md files that define their research methodology, output format, and quality gates. The difference is I built mine by hand over months. Antigravity gives you 1,400 of them in one command.

The convergence signal is strong. VoltAgent's awesome-agent-skills (1,000+ skills), Pilot Shell's built-in skill library, and Obra's Superpowers framework all landed on the same distribution model in the same month. When three independent projects solve the same problem the same way, you're looking at a standard emerging.

The security implications are real though. OWASP just published an Agentic Skills Top 10 targeting exactly this category. Skill poisoning (malicious SKILL.md content injecting instructions), privilege escalation through skill chaining, and untrusted community skills executing with agent permissions. It's the npm supply chain problem all over again, before the ecosystem has lockfiles or signing.

What to do about it: Install the skills relevant to your workflow today. But audit third-party skills before adding them to production projects. Read the SKILL.md content. Check what commands it tells the agent to run. The convenience is real. So is the attack surface.