Skills · last verified 2026-10-19

mattpocock/skills — install for Cursor

github.com/mattpocock/skills · Agent Skills · ~297k stars

What it does

Everyday engineering skills from Matt Pocock for multi-agent setups: workflow skills for the engineering tasks you actually repeat, written for the open Agent Skills standard.

One repo installs across 30+ agents — Cursor, Claude Code, Codex, Copilot, Gemini CLI — through the skills.sh CLI or each agent's plugin path.

Install

Generic Agent Skills (repo README, "Installation (30-second setup)"):

npx skills@latest add mattpocock/skills -a cursor

Omit -a to choose your agent interactively. The skills.sh docs pattern is npx skills add mattpocock/skills — same owner/repo form.

Claude Code: claude plugin install mattpocock-skills@claude-plugins-official

Codex: codex plugin marketplace add mattpocock/skills then codex plugin add mattpocock-skills@mattpocock

Gemini CLI: gemini skills install https://github.com/mattpocock/skills.git --path skills/engineering (and --path skills/productivity for the productivity set)

Verified against github.com/mattpocock/skills (README) and skills.sh/docs (Getting started), 2026-10-19.

Trust score: 6/10

• Skill-file review (2/3): a large collection of skills — each skill's instructions steer the agent, so review the ones you install. Nothing observed beyond the stated engineering-workflow job.
• Install behavior (2/3): the npx path downloads and runs the skills CLI — install executes code, unlike a read-only plugin file install. skills.sh discloses that its audits are routine and tells users to review code themselves.
• Prompt-injection surface (2/4): a wide skill collection means a wide instruction surface; the Agent Skills format is prompt content by design. High star count (297k) means many eyes, but stars measure attention, not review.

How the score works: skill-file review, install behavior, and prompt-injection surface, each scored against what the skill asks for beyond its stated job. This is a public-code review as of 2026-10-19 — a signal, not a certification. Full methodology: skills index.

Also in this series

• obra/superpowers — install for Claude CodeTrust 7/10 · 2026-10-19
• thedotmack/claude-mem — install for Claude CodeTrust 5/10 · 2026-10-19
• Leonxlnx/taste-skill — install for Claude CodeTrust 6/10 · 2026-10-19
• upstash/context7 — install for Claude CodeTrust 5/10 · 2026-10-19