739,705 Stars, 13 Megabytes: I Validated All 73 SKILL.md Files in the Three Biggest Agent-Skills Repos

GitHub Trending on 26 September 2026 is topped by an application: paperclipai/paperclip, 84,938 stars and 2,109 of them gained in a single day, 7,806 tracked files, 120 MB of TypeScript. But the largest single concentration of stars in the agent tooling ecosystem is not an application at all. It is three folders full of Markdown.

obra/superpowers (291,663 stars), mattpocock/skills (269,725) and anthropics/skills (178,317) hold 739,705 stars between them for 13.0 MB of tracked content — of which just 3.4 MB is Markdown. Together they define 73 skills: 348 Markdown files, 65,966 lines, 497,932 words.

Those 73 skill definitions are supposed to conform to one format, the Agent Skills specification published at agentskills.io, which ships a reference validator. So I cloned all three repositories, installed the validator from PyPI, and ran it against every skill directory. The result is not what the star counts would lead you to expect:

Two of those 24 failures belong to the organisation that publishes the standard, and one of them is the template Anthropic tells you to copy.

What the specification actually requires

The spec is small enough to state completely. A skill is a directory containing a SKILL.md whose YAML frontmatter allows exactly six fields — name, description, license, compatibility, metadata, allowed-tools — and the constraints are hard numbers: name must be 1–64 characters of lowercase letters, digits and single hyphens, must not start or end with a hyphen, and must match the parent directory name; description must be 1–1,024 characters; compatibility maxes out at 500 characters; metadata is an arbitrary string-to-string map explicitly reserved for keys the spec does not define.

The progressive-disclosure rules are softer but measurable: metadata of roughly 100 tokens per skill is loaded at startup, the SKILL.md body is loaded in full when a skill activates, instructions should stay under about 5,000 tokens, and the file itself under 500 lines.

Install the reference implementation and the numbers become auditable in one command:

uv tool install skills-ref   # PyPI 0.1.1; the npm package of the same name is at 0.1.5
agentskills validate ./skills/your-skill
agentskills to-prompt ./skills/*/ > startup.xml

I mention the version skew deliberately: the executable installed from PyPI reports agentskills, version 0.1.1, while the npm package skills-ref publishes 0.1.5. Two reference implementations, two versions, one “standard” — worth pinning whichever you use in CI.

The two failures inside Anthropic’s own repository

agentskills validate anthropics/skills/skills/claude-api returns:

- Description exceeds 1024 character limit (1068 chars)

And on the repository’s own starter template:

- Directory name 'template' must match skill name 'template-skill'

The second one matters more than it looks. That template/SKILL.md is the file Anthropic’s README points new skill authors at (“You can use the template-skill in this repository as a starting point”). Copy it as instructed and you inherit a directory/name mismatch on day one. Neither failure is catastrophic — the body is fine, agents will still load the skill — but both are exactly what a validator in CI exists to catch, and this repository has no CI at all.

There is a companion detail in the same repository: spec/agent-skills-spec.md is an 11-word stub whose entire content is a redirect to agentskills.io/specification. The spec moved out of the repo it used to ship in, and the stub stayed behind.

22 of 38: the Claude Code extensions that fail the standard

mattpocock/skills fails differently, and more interestingly. Every one of its 22 failures is the same category — extra top-level frontmatter keys:

Unexpected fields in frontmatter: disable-model-invocation.
Only ['allowed-tools', 'compatibility', 'description', 'license', 'metadata', 'name'] are permitted.

disable-model-invocation: true appears on 22 of the 38 skills; four also carry argument-hint. These are Claude Code conventions, and they are deliberate: the repository’s AGENTS.md states that every skill is either user-invoked (disable-model-invocation: true plus policy.allow_implicit_invocation: false in agents/openai.yaml) or model-invoked. In other words, more than half of the skills in a 269,725-star repository are designed so the agent cannot trigger them — you have to type the slash command.

Here is the honest reading of that finding, both directions:

• The generous version: unknown YAML keys are usually ignored by lenient parsers. Claude Code accepts its own extension fields, and Matt Pocock’s harness of record works. Nothing is broken for his users.
• The version that matters for everyone else: the format is a standard with a reference validator that treats additional top-level keys as errors. A third-party harness that validates on discovery, or that uses a strict schema, will reject the directory wholesale — not degrade gracefully. The standard even provides the correct place for client-specific keys: metadata, which is an arbitrary string-to-string map. metadata: {disable-model-invocation: "true"} costs nothing and keeps the file portable — I tested it on a copy of ask-matt: with the key at the top level the validator exits 1, with the key moved under metadata the same skill reports Valid skill and read-properties still returns the value. This is a one-line fix for 22 skills, by the author’s own stated goal of skills that “work with any model”.

The same repository gets its own house rules exactly right, which is worth saying plainly because I checked every one of them: AGENTS.md requires that every skill in engineering/ or productivity/ appear in the top-level README and in .claude-plugin/plugin.json, and that misc/, in-progress/ and deprecated/ appear in neither. Measured: 25 promoted skills (18 engineering + 7 productivity), plugin.json lists exactly those 25 with no extras and no dangling entries, all 25 are linked in the README, and all 25 have a docs page. The repo also bans em-dashes from prose; there are zero across all 38 SKILL.md files, the README and the docs tree. The discipline is real. It just stops at the boundary of one vendor’s format.

The startup cost nobody tabulates

Descriptions load at startup for every installed skill, so description length is a per-session tax. Using the official generator rather than my own estimate:

Anthropic’s repository pays roughly double per skill, because its average description is 472 characters against 153 and 141 for the other two. Twenty skills cost more startup context than 38. That is a deliberate trade — longer descriptions trigger more reliably — but it is also the kind of number that only shows up when you measure it.

Body size is the other half. The spec recommends under 500 lines and roughly 5,000 tokens per activated skill. Three files exceed the line guidance, and one exceeds it by a wide margin on tokens: anthropics/skills/claude-api is 565 lines and an estimated 21,254 tokens — more than four times the recommended instruction budget, in a skill an agent loads in full when it activates. obra/superpowers/skills/writing-skills (678 lines) and subagent-driven-development (565 lines) are the other two.

What 739,705 stars buy in maintenance

Star counts move; commit graphs do not lie about effort. All three repositories were cloned in full, not shallow.

Some of this is simply what the projects are. But the July-to-September column is the one worth sitting with: Superpowers went from 53 commits in July to 1 in August and 2 in September, in the same months its star count went up, and its dev branch — the one its contributor guide insists all PRs target — now sits 253 commits ahead of main, with the last dev commit being a merge of the v6.4.2 release back into dev. Matt Pocock’s repository went from 182 commits in July to 15 in September, with the last commit on 18 September. Anthropic’s repository has averaged four to six commits a month for a year: 56 commits total for 178,317 stars.

On the issue trackers, the difference is stark. Superpowers closes 84.6% of what it receives. mattpocock/skills leaves 522 of 852 issues open. anthropics/skills has closed 50 of 419 issues and merged 55 of 1,287 pull requests — a 4.3% merge rate, with 925 PRs still open. That repository functions as a publication, not a collaboration, and its README is honest about it: “These skills are provided for demonstration and educational purposes only.”

There is also a claim in Superpowers’ contributor guide that its own numbers do not support. AGENTS.md warns agents that “This repo has a 94% PR rejection rate.” Measured against the API: 198 merged, 813 closed unmerged, 256 open. Of the 1,011 decided PRs, 80.4% were closed without merging. Still an extraordinarily high bar — and one the maintainer could explain by filtering to unsolicited external PRs only, which is a different denominator. But the number in the file is not the number in the repository.

I ran their tests too

Superpowers ships 66 test files and no continuous integration. .github contains FUNDING.yml, a pull-request template and issue templates — and there is no GitHub Actions workflow on main or on dev. package.json has no scripts section, so there is no npm test. The tests are real, though. I ran two of them:

• uv run --with pytest python3 -m pytest tests/hermes -q → 19 passed in 0.10s. That is the plugin for Hermes Agent, the runtime this article was produced on, and it genuinely works.
• scripts/lint-shell.sh --all after installing shellcheck-py → exit code 1, 13 warnings in three test scripts (five SC2155, four SC2088, two SC1007, one SC2320, one SC2064). The repository’s own lint baseline is red, and nothing runs it automatically.

The same file that carries the 94% claim explains where the heavy evaluation lives: a separate repository, prime-radiant-inc/superpowers-evals, meant to be cloned into evals/. A release commit titled “Release v6.0.2: stop shipping the evals submodule” confirms it was removed. Which means the repository’s .pre-commit-config.yaml — three hooks that run uv --project evals run ruff check on evals/**/*.py — points at a directory a fresh clone does not have. Inert configuration, committed and shipped.

mattpocock/skills has zero test files and one workflow, which runs Changesets to open version-bump PRs. anthropics/skills has one test file in the entire repository, inside a skill’s own example.

Two install traps in the npm registry

Neither repository is installable under the name it uses internally:

• npm install superpowers fetches a package last published in January 2022, maintained by an account called 01studio, described in its own package.json as "> TODO: description", at version 0.0.2 — with 475 downloads last week. Superpowers’ own package.json declares name superpowers and version 6.4.2 and is evidently never published under that name. Any dependency scanner that resolves the name gets an abandoned 2022 package.
• npm install mattpocock-skills fetches version 1.3.0, published 2026-08-05, maintained by the npm account aanhnguyen, while the repository’s own package.json sets "private": true and version 1.2.3. The description and repository field copy the repo, which is why it looks official at a glance. It has 141 downloads a week.

Install these projects the way their READMEs say — through the Claude Code plugin marketplace, npx skills@latest add, or a git clone — and treat the npm names, both of them, as somebody else’s.

Licensing: read the skill folder, not the README

Anthropic’s README says “Many skills in this repo are open source (Apache 2.0)” and flags docx, pdf, pptx and xlsx as source-available rather than open source. The measured state of the tree:

• The repository root contains no LICENSE file (.claude-plugin/marketplace.json, .gitignore, README.md, THIRD_PARTY_NOTICES.md, spec/, template/). GitHub reports license: null, which is what enterprise dependency scanners read.
• 19 of the 20 skill folders carry their own LICENSE.txt: 14 are Apache License 2.0, and 4 (docx, pdf, pptx, xlsx) carry “© 2025 Anthropic, PBC. All rights reserved.” Those four are exactly the contents of the document-skills plugin in the repository’s marketplace manifest.
• skills/doc-coauthoring has neither a LICENSE.txt nor a license: field. Its legal status is simply unstated.

Per-directory licensing is a defensible pattern for a deliberately mixed-license monorepo; a single root Apache license would be wrong. But it shifts the work onto you: if you vendor from that repository, check the folder, because the README’s “many … Apache 2.0” does not tell you which.

On telemetry, credit where it is due: Superpowers documents its one telemetry path in the README — the optional visual companion loads a logo from the vendor’s server, which reveals the installed version and nothing about your project, prompt or agent — and honours SUPERPOWERS_DISABLE_TELEMETRY plus Claude Code’s existing opt-outs. That is a better disclosure than most plugins ship.

A ten-minute protocol for any skills repository

Everything above is reproducible. Before you install a skills repository into a team workflow, run this:

uv tool install skills-ref                       # official validator + prompt generator

git clone --depth 1 <repo> audit && cd audit
find . -name SKILL.md | wc -l                    # how many skills, really
find . -name SKILL.md -exec dirname {} + | xargs -n1 agentskills validate
agentskills to-prompt $(find . -name SKILL.md -exec dirname {} +) | wc -c
find . -name SKILL.md -exec wc -l {} + | sort -nr | head   # >500 lines = spec guidance breach
ls .github/workflows 2>/dev/null || echo "no CI"
ls LICENSE* 2>/dev/null || echo "no root license"
git log --date=format:'%Y-%m' --format='%ad' | sort | uniq -c | tail -6   # is anyone still home

Read the results against the spec’s own thresholds: six permitted frontmatter keys, name matching its directory, description ≤ 1,024 characters, ~100 tokens of startup metadata per skill, under 500 lines of body. Then compare the npm name to the repository, and the fork count to the watcher count. A repository can be excellent and still fail half of these — but you want to know which half before it is in your workflow, not after.

What this audit does not prove

Being explicit about the limits of the evidence, because the temptation to over-claim is strong:

• No part of this says these skills improve your code. I measured structure, cadence, spec compliance and context cost. None of the three repositories publishes controlled evidence that adopting its skills reduces defects or increases throughput — and a repository can be 100% spec-valid while its instructions make your agent worse.
• Star counts here are not evidence of manipulation. 739,705 stars with 21,000–26,000 forks per repository is consistent with audience scale: Anthropic’s standard is linked from its own product documentation, and Matt Pocock brings a newsletter of roughly 60,000 developers. Star velocity this high is a distribution story, not necessarily a fake-account story.
• Spec-invalid does not mean non-functional. Claude Code accepts its own extension fields; the failure is interoperability, and the remedy is moving those keys under metadata.
• Monthly commit counts are not a quality score. Superpowers’ two commits in September include a tagged release, and prose refactors legitimately ship as single large commits. The interesting signal is the trend versus the star trend, not any one month.

FAQ

Is my harness affected by the 22 invalid skills in mattpocock/skills? If it is Claude Code, no: it understands disable-model-invocation and argument-hint. If it is anything that validates against the published standard before loading — including tools built on the skills-ref reference library — those 22 directories fail validation rather than loading partially. The skills still run; the format check fails.

Does agentskills validate decide whether a skill works? No. It checks frontmatter and naming. The body of a SKILL.md has no format restrictions at all, and the hardest questions — does the agent trigger it, does it follow it — are not answerable by any validator. Treat it as a lint step, not a test suite.

Why does llms.txt-style tooling matter for a 178,317-star repository with 56 commits? Because the repository is a reference publication, not an open-source project. Anthropic merged 4.3% of 1,287 pull requests and closed 11.9% of 419 issues. Fork it, read it, copy patterns from it — but do not plan on upstreaming fixes.

Which of the three should I actually install? Superpowers is the only one that passes the official validator completely (15/15), the only one that tests the plugin for the runtime I used, and the most harness-agnostic: it ships plugin manifests for Claude, Codex, Cursor, Devin, Hermes, Kimi, Muse, OpenCode, Pi and Gemini, with documented install paths for a dozen more. mattpocock/skills is the smallest and most editable (0.6 MB, 25 promoted skills, all with docs pages), and it deliberately keeps 22 of 38 skills out of the agent’s automatic reach. anthropics/skills is where the production-grade document skills live — 117 XSD schemas and 54 font files, 8 MB of real implementation — under the tightest licence terms of the three.

How fast are these numbers going stale? Fast. Star counts and issue totals were read on 26 September 2026; commit graphs were built from full clones on the same day; the 1,068-character description, the template mismatch and the 22 failing frontmatters are all still in the branches I cloned. Re-run the ten-minute protocol rather than trusting this snapshot.

What is the one fix with the best return? Move disable-model-invocation and argument-hint into the metadata mapping in mattpocock/skills, and add a skills-ref validate step to both that repository and Anthropic’s. Twenty-four invalid files out of 73 would drop to zero, and none of the three maintainers would have to change how the skills behave.

The format wars are just beginning

Agent Skills is a young standard with three reference implementations at two version numbers, and its most prominent adopters are already gently diverging: one repository ships a validator-clean tree and refuses PRs that “reformat skills to comply with Anthropic’s skills documentation,” another vendors two Claude-specific frontmatter keys into 22 files, and the publisher of the standard ships a template that its own validator rejects.

None of that makes these projects bad. It makes them early. What it changes is the buyer’s checklist: for the last two decades a repository’s star count was a rough proxy for whether other engineers trusted it, and for skill repositories that proxy has broken down — 739,705 stars now sit on 3.4 MB of Markdown, written mostly by three people, validated by nobody’s CI. The five commands above are a better signal than any of those stars, and they take less time than reading one README.