Agent Skills 0.6.4 adds two big pieces, an in-repo skill eval framework and native Codex support, alongside a security-hardening pass, real skill-content additions, and a wave of adoption and contributor docs.
Highlights
- Skill eval framework (#342). A three-tier system that checks the pack actually works: structural validation, a deterministic trigger-and-routing tier that runs in CI (does each skill's description carry the words users say, and do any two skills collide), and an opt-in behavioral tier that grades a real execution trace against per-skill expectations. Neither of the packs we get compared to ships this in-repo.
- Native Codex support (#88). Install as a Codex plugin with
codex plugin marketplace add addyosmani/agent-skills; the rootskills/directory is read directly through.codex-plugin/plugin.json, no duplication. - Fastest install path in the README.
npx skills add addyosmani/agent-skillsnow leads the Quick Start, one command across 70+ agents, with per-skill installs for the headline skills. - Supply-chain hardening (#392). The dependency guidance is now package-manager and version aware, with an install-script gate that blocks unreviewed lifecycle scripts before the first install, the exact hole the recent npm postinstall worms used.
Skills and content
- Dependency-upgrade workflow added to
code-review-and-quality(#346, @HMAKT99). - Database expand/contract schema migrations added to
deprecation-and-migration(#345, @HMAKT99). - Frontend and performance descriptions now carry the vocabulary users actually type; trigger rank-1 rate up to 86% (#358, @ZhiyaoWen999).
- Playwright examples switched to accessibility-first role and label locators (#359, @debs-obrien).
Tooling and fixes
- Harden the eval and command validators for CRLF and Windows line endings, plus a fixture path-traversal guard (#372, @ShiroKSH).
- webperf config note: keep CrUX API keys in environment variables, never hard-coded (#357, @orbisai0security).
- Document the HTTPS git-config workaround for
/plugin installSSH failures on Windows and macOS (#368, @mvanhorn).
Docs
- New adoption guide: greenfield vs brownfield rollout, with a verification-first path for established codebases (#396, @nucliweb).
- New developer-onboarding guide for people working on the repo itself (#397, @nucliweb).
- Cursor setup modernized for native
.cursor/skills(#218, @nguyenducthaonguyen). - comparison.md refreshed and expanded with a fuller "how to decide" section; no-translations policy documented (#375, @nucliweb); AGENTS.md and CLAUDE.md clarified as repo-scoped (#374, @nucliweb); a Team section added to the README.
Thanks
Thanks to everyone who contributed this release: @nucliweb, @federicobartoli, @HMAKT99, @ZhiyaoWen999, @ShiroKSH, @mvanhorn, @nguyenducthaonguyen, @debs-obrien, and @orbisai0security.
Full Changelog: 0.6.3...0.6.4