GitHub release — npm publication is unavailable.
This release contains 2,877 skills, including 5 additions. Use the GitHub source archives or the verified runtime archive attached below. agentic-awesome-skills@20.2.0 is not available on npm; no npm installation or update to this version is claimed.
The attached runtime and site archives are the exact immutable candidate tested on Linux and Windows with Node 22 and 24 (verification run). Release commit: 5cd587241fdaf6d111e4ea00be899b55cc77ff08. The existing tag is unchanged.
Installable catalog update for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and related assistants. Adds 5 reviewed skills, refreshes two existing workflows, and fixes the three canonical dependency alerts before publication; regenerated plugin copies include the same fixes.
Start here
Added
- bifrost-gateway - run and configure Bifrost as a self-hosted OpenAI-compatible gateway, with fallbacks, virtual-key budgets, caching, observability, MCP routing, and explicit credential and public-exposure boundaries.
- comment-to-dm-cta - plan an Instagram comment-to-DM CTA locally, then require explicit confirmation before creating or changing the automation through CommentKeyword.
- landing-page, web-design-system, and web-review - adaptive UXKIN-derived workflows for truthful landing-page copy, a documented design system, and a prioritized rendered-page review. The optional UXKIN MCP path requires a user-selected account and plan.
Changed
- cloudish - synchronize the official 0.1.6 workflow with server-side builds, verified log checks, custom domains, replicas, instance sizing, OIDC sign-in, credit operations, and retained MIT notice.
- datacircle - refresh the GTM API-plan model, cached API coverage, search and SERP rows, pricing semantics, and query examples against the current public skill.
- animated GitHub profile and Satori updates remain on their prior reviewed catalog versions - the proposed updates were not shipped because their exact-head content did not meet current structural, safety, provenance, or license-notice gates.
Security and reliability
- Fix Dependabot's
qsdenial-of-service advisory in the three canonical Loki, Telegram, and WhatsApp boilerplate lockfiles by moving from 6.16.0 to 6.16.1. The protected release snapshot propagates the patched lockfiles into both plugin mirrors. - Add retained MIT notices for imported skill bundles and replace Bifrost's secret-shaped examples with process-environment reads so the trusted SEC009 gate passes without weakening the scanner.
- Encode the two
pentest-toolsXSS reference payload archives as explicit UTF-8 Base64 companions to remove raw test markup from the cloneable Markdown; a fresh Windows Defender clone check remains an explicit acceptance boundary. The Markdown entrypoints retain authorization, data-minimization, and decoding boundaries, and a regression verifies byte-exact round trips. - Complete two protected maintenance cycles: merge #2164 and #2172, and close the remaining batch PRs with exact-head owner rationale where superseded or not admissible. Protected-main CI, CodeQL, required merge gates, and the release-cycle barrier are green on the verified source commit.
Upgrade notes
- The verified runtime archive is attached below as
package.tgz. - Existing projects install only the skills they select. Re-select or refresh a stack to receive catalog changes.
- The optional CommentKeyword, UXKIN, Cloudish, and Bifrost workflows use external services with their own account, credential, data-transfer, cost, and confirmation boundaries.
Thanks
Thanks to @commentkeyword for comment-to-dm-cta, @Swpn0neel for bifrost-gateway, @ronaldmanlupig30-web and UXKIN for the three website-workflow adaptations, @waynehamadi for the Datacircle refresh, and @javierluraschi plus the Cloudish team for the official upstream synchronization. Thanks also to @MetcalfSolutions and @shivamnamdev for their submissions; those updates remain available for a corrected resubmission.