125 Claude Code Skills Aggregated into One Repository: One-Stop Installation and Governance

Claude Code's Skills ecosystem is expanding rapidly, but a practical problem has emerged alongside it: once you've accumulated a dozen independent repositories and dozens of plugins, simply remembering which skill lives where and how to install it consumes a significant amount of attention. Developer Basit Ali Sandhu's approach was to consolidate 125 skills scattered across 11 repositories into a single repository, making installation and management simple again.

Why consolidate into one repository

According to the original author's article, the tasks he repeatedly had Claude Code handle in his daily work fell into just a few categories: auditing AWS accounts, checking Conditional Access configurations, threat modeling agents, assembling evidence packs for auditors, and cleaning up code repositories. Each task category gradually crystallized into a skill, each skill grew into its own repository, and eventually they were scattered across 11 locations.

The direct cost of this fragmentation was a fragmented installation experience: users needed to run 11 /plugin marketplace add commands and 16 /plugin install commands to get all capabilities installed. The community repeatedly asked for a "one clone is enough" solution, and the claude-skills repository is the response to that demand. It syncs content from 11 source repositories, includes 16 plugins and 125 skills, and comes with a catalog site — one page per skill so you can understand what it does before installing.

It should be noted that the source repositories remain where skills are authored, tested, and fixed. The aggregation repository serves as a distribution entry point, not the primary development venue.

Claude Code's Skill and Plugin Marketplace Mechanism

Claude Code is a command-line coding assistant from Anthropic that uses a mechanism called "Skill" to package reusable operational workflows, checklists, and scripts into capability units that the model can invoke on demand. Each Skill typically centers on a SKILL.md file with several supporting scripts, and the model determines when to use it by reading its name, trigger conditions, and description. To distribute and version these Skills, Claude Code introduced the concept of a "plugin marketplace": a repository or a path within a repository can serve as a marketplace source, and users register the marketplace via /plugin marketplace add <repo> and then install specific plugins from it via /plugin install <plugin>@<marketplace>. A marketplace can contain multiple plugins, and a plugin can bundle multiple Skills. It is precisely this three-tier "marketplace-plugin-Skill" structure that causes capabilities to be scattered across multiple independent repositories, forcing users to register marketplaces and install plugins one by one — installation costs grow linearly with the number of repositories. This is the core pain point the aggregation solution in this article aims to solve.

What's in the repository

The repository organizes plugins clearly around security and governance scenarios, making it particularly valuable as a reference for teams working on enterprise-grade AI deployment:

Agent Security (9 skills): Aimed at teams building LLM agents, including agent-threat-model, prompt-injection-review, mcp-server-review, and agent-session-log-review, covering prompt injection review and MCP server security assessment.

Agent Identity Governance (8 skills): Inventory, re-certification, and credential expiration management for non-human identities that agents depend on at runtime, plus a runbook for quickly deactivating an identity.

AWS Security (10 skills): aws-account-audit evaluates accounts offline based on read-only inventories, scp-guardrails builds and checks SCPs, and aws-agent-session-audit reconstructs from CloudTrail what an agent did in the account.

Microsoft 365 Governance (10 skills): graph-permission-preflight, conditional-access-gap-analysis, and copilot-oversharing-readiness, all working from read-only Graph export data.

Compliance Evidence (7 skills): evidence-pack-builder, security-questionnaire-drafter, and essential-eight-evidence-map, serving ISO 27001, SOC 2, and Essential Eight work.

Daily Development is the largest block, with 42 skills split across six plugins: code-quality, data, debugging, devops, docs, and security-basics. Examples include dead-code-finder, flaky-test-hunter, terraform-apply-gate, and diff-security-review.

There are also plugins for repository engineering (12), ways of working (12), Claude Code's own configuration (8), GitHub management (4), and Mac maintenance (3).

Non-Human Identity (NHI) and Agent Identity Governance

Traditional identity governance centers on human user accounts, but agent systems typically access resources at runtime through service accounts, app registrations, API keys, managed identities, or workload identities. These are collectively known as "Non-Human Identities" (NHIs). NHI risk characteristics differ from human accounts: they are numerous and growing fast, often lack multi-factor authentication, credentials tend not to expire, lifecycles are hard to track manually, and a compromise often won't trigger an anomalous login alert. As a result, the key actions in NHI governance include comprehensive inventory, periodic re-certification, credential rotation and expiration management, and preparing a rapid-deactivation runbook for suspicious identities. The "Agent Identity Governance" plugin pack in this article is designed precisely for this scenario, helping teams answer: what non-human identities do we have, what can they still access, and how do we shut them down in one click?

Installation and update mechanism

There are two installation paths. Add the plugin marketplace directly within Claude Code and install the specified plugin:

/plugin marketplace add basitalisandhu/claude-skills
/plugin install aws-security@claude-skills

Or clone and run the installation script:

git clone https://github.com/basitalisandhu/claude-skills
cd claude-skills
python3 install.py --user

--user copies all skills to ~/.claude/skills, --project uses the current project's .claude/skills, --only <plugin> narrows the copy scope, and --list prints the catalog. The installer is pure standard-library Python with no external dependencies. Other agents that support the Agent Skills format can also install via npx skills add basitalisandhu/claude-skills.

As for synchronization, a daily workflow pulls each source repository and opens a PR whenever there's a change, so all updates arrive as readable diffs. SOURCES.json records which repository and commit each skill came from, making it easy to trace provenance and locate bugs. Skill descriptions are validated on every sync: use double quotes for compatibility with strict YAML parsers, stay under 600 characters, and include "Use when" and "Not for" sentences plus a Limits section. Test code stays in the source repository, issues should be filed in the source repository, and fixes flow into the aggregation repository through the next sync.

The Open Agent Skills Format and Cross-Tool Compatibility

SKILL.md is not unique to Claude Code; it is gradually becoming a cross-agent open convention (often called the Agent Skills format). The idea is to describe a capability's metadata (name, description, trigger conditions, limitations) in a Markdown file with YAML front matter, write the operational steps in natural language in the body, and place supporting scripts in the same directory. Any agent that supports the format can read and invoke these Skills, avoiding the need to rewrite capability packs for every tool. The npx skills add basitalisandhu/claude-skills mentioned in this article is one way to install such generic-format Skills via a community CLI. Precisely because it is an open format, the field constraints on SKILL.md (double quotes for strict YAML parser compatibility, description length limits, required Use when / Not for and Limits sections) have real significance — it must be human-readable, reliably parseable by different implementations, and enable the model to accurately judge invocation timing and boundaries.

What it explicitly does not do

The author was quite restrained in defining boundaries: these skills run offline, based on saved export data or your working tree; the built-in scripts are standard-library Python that make no network requests and report no telemetry. If a skill needs live data, it tells you which read-only commands to run, then works from the saved output.

Each SKILL.md declares what that skill does not do. The author specifically notes that a clean report from secrets-hygiene or iam-least-privilege-review is just a signal, not a security clearance. The project is MIT-licensed, and if you encounter wrong answers or overclaims, you can file an issue or PR directly in the source repository. Some plugins also carry beginner-friendly tasks suitable for Hacktoberfest.

Offline-First, Read-Only Evidence, and Context Budget

The design philosophy of this Skill set can be summarized as "offline-first + read-only mode": no active network access, no telemetry. Instead, users are asked to first run specified read-only commands from the repository (such as listing account resources or exporting configurations), then hand the output to the Skill for analysis. The benefits are auditability, reproducibility, and avoiding accidental damage to production environments through automated actions — and it aligns with compliance forensics requirements for a traceable chain of evidence. The companion concept is "context budget": the model can only process a limited number of tokens at a time, and loading all 125 Skill descriptions would eat into reasoning space and dilute relevance. In practice, you should install only the plugins needed for the current task and use the repository's built-in audit tools to assess each Skill's context footprint, striking a balance between capability coverage and invocation efficiency.

Points worth noting

For teams that use Claude Code heavily, the value of this repository goes beyond saving dozens of installation commands. It demonstrates an approach to turning AI capabilities into governable assets: plugin-based categorization, description format constraints, traceable provenance, updates through diff review, and capability boundaries written into SKILL.md. This approach aligns closely with current enterprise concerns around agent security, non-human identity governance, and compliance forensics. Of course, installing 125 skills into your environment also means carefully evaluating permissions and context budget — and conveniently, the repository provides tools for auditing context budget and building least-privilege configurations.

One-line Summary

A developer aggregated 125 Claude Code Skills from 11 repositories into a single installation entry point, complete with governance-grade plugin categorization and a sync mechanism.

Paragraph Summary

Claude Code's Skills ecosystem is expanding rapidly, creating serious management fragmentation. Developer Basit Ali Sandhu consolidated 16 plugins and 125 skills scattered across 11 source repositories into a single aggregation repository, claude-skills. Users can obtain all capabilities with a single clone or a single marketplace registration, completely eliminating the previous tedious process of 11 marketplace adds and 16 installs. The repository organizes plugins around security and governance scenarios, covering agent security, agent identity governance, AWS security, Microsoft 365 governance, compliance evidence, and the largest block — daily development (42 skills). Updates enter the aggregation repository as readable diff PRs via a daily sync workflow, SOURCES.json records provenance, and skill descriptions are subject to mandatory format constraints. All skills run offline on saved export data, scripts are dependency-free standard-library Python that make no network requests or telemetry, and the project uses the MIT license.