Maintainer of this skill?
by wheresryan22
Figures the community made with Anatomy, each rebuilt from source in a locked sandbox. Submit yours through your agent or a Gist.
# Add to your Claude Code skills
git clone https://github.com/wheresryan22/anatomy-communityGuides for using ai agents skills like anatomy-community.
See how anatomy-community compares with popular alternatives.
anatomy-community is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by wheresryan22. Figures the community made with Anatomy, each rebuilt from source in a locked sandbox. Submit yours through your agent or a Gist. It has 50 GitHub stars.
anatomy-community's catalog security scan is still queued. You can run an instant dependency and prompt-injection check now with the "Scan for vulnerabilities" button above.
Clone the repository with "git clone https://github.com/wheresryan22/anatomy-community" and add it to your Claude Code skills directory (see the Installation section above).
anatomy-community is primarily written in JavaScript. It is open-source under wheresryan22 on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh anatomy-community against similar tools.
No comments yet. Be the first to share your thoughts!
Available after the catalog security scan passes.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
The deep catalog scan for this skill is still queued. Run an instant dependency check now instead.
A shared collection of figures made with the Anatomy skill, in any theme and colours. Each figure is stored as its source: the build.mjs the skill wrote, plus a figure.json that says who made it, with what prompt and with which skill version. There are no built pages or images in main.
Because every Anatomy figure rebuilds byte for byte from its source, CI rebuilds each one on every check, in a locked sandbox, and makes the pages and the preview image itself. The previews live on the previews branch, which CI rewrites after every merge. Next to each preview, CI also makes a card: the light page photographed again with its frame, corner text, legend and controls hidden, the drawing fitted to the same 1600×1200 frame on one ground, so every figure sits at the same size in a gallery. The light page itself is kept too, under live/, so a site can let people play with the figure in a sandboxed frame. For sites that show the collection, that branch also has a small index.json (counts, kinds, popular tags), feed/page-N.json (48 figures a page, newest first), feed/search.json (every figure, short form) and feed/figures/<author>/<id>.json (one figure in full), so no file grows past a couple of megabytes however many figures there are. BUILT_FROM records the last main commit it was built from, so each run builds everything merged since, and a full rebuild runs in batches of 30 that start each other.
figures/<author>/<id>/
figure.json title, author, prompt, kind, agent, skill version, license
src/build.mjs the source the skill wrote, plus any helper files it reads
README.md optional: the idea, in a few lines
There are two ways. Neither needs you to fork or use git by hand.
You need the Anatomy skill in a version with scripts/publish.mjs, and the GitHub CLI signed in (gh auth login). Docker is optional, for running the same locked checks before you send.
/anatomy explain how a token bucket rate limiter works, interactive. The gallery takes plain HTML figures (a build.mjs that writes standalone pages), in any theme and colours.Or run the same thing yourself, from a clone of this repository (gh repo clone wheresryan22/anatomy-community -- --single-branch, which leaves out the previews branch and its images):
node <anatomy skill folder>/scripts/publish.mjs <your figure folder> --into . \
--id token-bucket-bench --title "Token bucket air bench" --author <your-github-name> \
--prompt "/anatomy explain how a token bucket rate limiter works, interactive" --submit
It copies only the source into figures/<your-github-name>/token-bucket-bench/, records which skill version made it, checks it builds, saves a quick preview to shots/, then asks before it pushes and opens the pull request. --dry-run shows the plan without doing anything; --force sends an updated version to the same pull request.
To run the CI checks on your machine first:
docker build --platform linux/amd64 -t anatomy-sandbox:local sandbox
node scripts/validate.mjs figures/<your-github-name>/token-bucket-bench
build.mjs, plus any file it reads (live.js, a .css, …). Leave out the built .html pages.The checks run on the pull request (next section). When they finish, a comment shows the preview CI made of your figure. A maintainer reviews and merges, and your figure appears on the previews branch and, while it is among the six newest, at the top of this page.
Your figure's build.mjs is code from someone else, so it is checked before it runs, and it runs where it can't reach anything.
| Check | What it does | |
|---|---|---|
| 1 | Scope | Runs from main, never from your pull request. It reads the list of changed files and fails unless every file is under figures/<your-github-name>/: no deletions, no changes to CI, scripts or other people's figures. |
| 2 | Files | figure.json is complete and matches its folder; only source files (.mjs, .js, .css, .html, .json, .md, .txt, .svg), at most 1 MB each and 2 MB in all; no built pages, no images, no symlinks. |
| 3 | Code analysis | Every source file is parsed and refused if it reaches the network, environment variables, cookies, other windows, eval or Function, by any route however disguised, or imports anything except the skill, its own files, node:fs, node:path, node:url, node:crypto and node:process. |
| 4 | Skill version | The exact Anatomy version that made the figure is found from its kit fingerprint, and that version is used. |
| 5 | Locked build | The build runs twice in a pinned container (Node 22.23.3, Chrome for Testing 155) with no network, a read-only system, no privileges, limited memory, processes and time, and write access only to its own src/. Both runs must write the same .html pages (the ones listed in figure.json, or whatever the build writes if none are listed) and nothing else, byte for byte the same. |
| 6 | Output | The built pages get the same safety scan, so a payload the source hides is still caught. Each page is at most 4 MB. |
| 7 | Browser | Chrome loads every page in the same locked container. The skill's line check must pass, nothing may try to load from outside, and the figure must hold still with reduced motion on. |
| 8 | Preview | The page named in preview (or the light page, or the first one) becomes the poster and the preview posted on your pull request. |
The checker always comes from main, never from the pull request. Figure code only ever runs inside the sandbox, with a read-only token and no secrets, and the jobs that write previews never run figure code. A check takes about 2 minutes for a simple figure and 10–20 for a heavy one with --audit.
The repository tests its own checker, including planted attacks that every check must catch:
node --test scripts/units.test.mjs
node scripts/skill.mjs figures/wheresryan22/dial-indicator
node --test scripts/validate.test.mjs
The second test file uses the Docker sandbox when it's there (build it as in step 4) and runs its sandbox-escape tests only then. The code-analysis tests need acorn on NODE_PATH:
npm install --prefix /tmp/anatomy-tools acorn@8.19.0
NODE_PATH=/tmp/anatomy-tools/node_modules node --test scripts/units.test.mjs
Your own work, in your own folder, under MIT or CC-BY-4.0. A real object built from many small precise parts, not boxes and arrows, and every number it shows is true. Plain HTML, any theme. Deterministic, still under reduced motion, and nothing that talks to the outside. CONTRIBUTING.md has the full rules and every field of figure.json.