by kharmanskyi
Plain-language agent skills for Claude Code, Codex, Cursor and Gemini CLI: honest session reports, straight verdicts, steps you can follow. MIT.
# Add to your Claude Code skills
git clone https://github.com/kharmanskyi/open-stepsLast scanned: 8/28/2026
{
"issues": [
{
"file": "README.md",
"line": 104,
"type": "dangerous-command",
"message": "Dangerous command (writes to Claude config): \">/dev/null || cat open-steps/docs/routing-block.md >> ~/.claude/\"",
"severity": "medium"
}
],
"status": "PASSED",
"scannedAt": "2026-08-28T15:56:58.286Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how open-steps compares with popular alternatives.
open-steps is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by kharmanskyi. Plain-language agent skills for Claude Code, Codex, Cursor and Gemini CLI: honest session reports, straight verdicts, steps you can follow. MIT. It has 1,282 GitHub stars.
Yes. open-steps passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/kharmanskyi/open-steps" and add it to your Claude Code skills directory (see the Installation section above).
open-steps is primarily written in Shell. It is open-source under kharmanskyi on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh open-steps against similar tools.
No comments yet. Be the first to share your thoughts!
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
English · Español · Français · Русский · Українська · 한국어 · 中文
Plain-language agent skills for Claude Code, Codex, Cursor and Gemini CLI.
They keep development open to the person running it: the sessions, the decisions, the next steps, the whole picture.
I'm not an engineer. I'm a market-led builder: I look for where demand already exists and the infrastructure doesn't, then build the missing piece. Twenty years of building web and software products, always from the product side, and more than 50 developers at my company today.
Apart from the company, I started building a product on my own, just vibecoding. Partly to stay ahead of where all this is going, partly because I think the moment has arrived for people like me: you can now imagine a serious product and build it yourself, with no engineers or very few of them.
Then I ran straight into a wall. The agent does excellent work, then tells me about it in commit hashes and jargon, and I genuinely cannot tell whether we are done. Not because the work is unclear. Because nobody taught the agent to talk to someone who doesn't speak engineering.
So I built this pack. I'm sharing it here for anyone in the same position, and that's the whole idea behind the name: every step of building with an agent, kept open to the person doing the building. Right now it changes what the agent tells you. Where I want to take it next is the work itself, not just the reporting.
The whole idea in one screen. Work ends, you ask "are we done?".
Without the pack:
Hotfix deployed: session TTL misconfig in auth middleware caused 401 cascades after key rotation; patched the refresh path, invalidated stale JWTs, redeployed api+web. p95 back to 180ms. Root cause: env drift after the 09-14 rollout. Two flaky e2e specs quarantined (known, tracked)…
With it you get this:
People can sign in again. A bug was logging people out because their sessions expired far too early. The fix is live for everyone.
✅ Response times are back to normal ⚠️ Until this shipped, people were being logged out over and over.
Fully done? Yes Anything needed from you? No New debt? Two small ones, written down Safe to close? Yes
Same facts. One screen. The bad news gets its own row instead of hiding in
the middle of a paragraph. A second, longer example from a real session lives
in this repository, with notes on what the rewrite changed:
skills/os-done-or-not/references/01-prod-promote.md.
| Skill | What it does | When it fires |
|---|---|---|
os-done-or-not |
A one-screen report with a verdict: done or not, anything needed from you, any new debt, safe to close | Work wraps up, or you ask how it went |
os-step-by-step |
Numbered steps a non-technical person can follow. The agent must first try everything itself and ask only for what truly needs you | The agent needs you to run, paste, click, approve or test something |
os-ask-simple |
The question in plain words, what it costs later, and one marked recommendation | The agent has a question or options for you |
os-what-could-go-wrong |
Assumes the decision already failed and works backwards to find out why, in a fresh agent that had no hand in it. Ends on one verdict | Something hard to undo is about to be agreed: a contract, a purchase, a migration, a launch |
os-whats-next |
Merges what is verified and ready, then recommends the next task and says why in plain words | You ask what is left or what to do next |
os-check-work |
Does not trust another session's report. Checks every claim against what actually happened, then says what to do about it | Another session says it is done |
os-say-simple |
Rewrites any text in plain words without losing facts or bad news. Give it a number and you get exactly that many points | Any text reads like engineering: a report, a comment, an error, the agent's own answer |
os-big-picture |
Keeps one BIG-PICTURE.md: what the product is, every feature with how far it got, which parts nobody uses any more, and what is queued. It offers to open the queue as tickets in a tracker you already use |
You ask where the project stands, or a session report was just written |
They work as a loop: os-whats-next picks the work, os-step-by-step walks
you through your part, os-done-or-not reports the result, os-check-work
accepts what other sessions did, os-ask-simple handles the questions on the
way, os-what-could-go-wrong attacks anything hard to undo before it is
agreed, and os-say-simple rescues any text that still reads like
engineering. os-big-picture keeps the standing file whose queue
os-whats-next reads as its backlog.
os-big-picture writes its file in plain words, so you get the whole picture
without reading code. It measures from git how old each part is and whether
anything still uses it, and it dates what it cannot measure. It opens tickets
in your tracker only after you say yes. The file stays out of your commits
unless you add it yourself. It never invents a task and never deletes
anything. The rules and the reasons behind them are in
skills/os-big-picture/.
The pack finishes finished work by itself. If a pull request has green checks and an approved review, the agent verifies it once more and merges it. On Claude Code that happens without a permission prompt. On Codex CLI, Cursor CLI and Gemini CLI the merge command goes through that tool's own permission settings, per their documentation. Whatever unblocks the most goes first.
Two things stop a merge: a claim that fails verification, or a note on the
task saying merges happen on command only. Write that note on the task
wherever another tool or person decides when to merge. To have merges on
command only, put the same note in your standing instructions file:
~/.claude/CLAUDE.md, ~/.codex/AGENTS.md, ~/.gemini/GEMINI.md, or the
project's AGENTS.md on Cursor CLI.
On Claude Code a skill can also pre-approve tools for the turn it runs in,
through its allowed-tools field. This pack keeps that list to what the
skills use:
| Skill | Pre-approved on Claude Code |
|---|---|
| Every skill | Reading its reports folder, ~/.claude/open-steps/ |
os-done-or-not |
Writing its report in that folder, and gh pr view and gh pr checks |
os-whats-next, os-check-work |
gh pr list, gh pr view, gh pr checks and gh pr diff, which read a pull request, and gh pr merge, for the merges above |
os-big-picture |
Editing its own BIG-PICTURE.md, its census script, git rev-parse --git-dir to find the repository folder, gh repo view, gh issue list, and gh issue create, which opens tickets after you say yes |
os-what-could-go-wrong |
Its premortem prompt script |
/open-steps:os-install-check |
doctor.sh |
Other commands, and files outside your project and the reports folder, go
through your own permission settings as usual. Other read-only git commands
need no entry, because Claude Code runs them without asking. Codex CLI, Cursor
CLI and Gemini CLI ignore the field, per their documentation, and
ask the way they normally do. That part has not been tested.
The skills are the same folders on every tool. On Claude Code a plugin installs them and wires both hooks in one command. On Codex CLI, Cursor CLI and Gemini CLI one copy command installs the skills, and each tool takes a few lines of hook settings. What was run on each tool, and what comes from its documentation, is under What was run on each tool.
You need git to download the pack and to update it. Some skills, such as
os-whats-next and os-check-work, also read project state through git and
gh, GitHub's command-line tool. gh is
optional. Without it, more of the output says "not checked".
Clone this repository:
git clone https://github.com/kharmanskyi/open-steps.git
Stay in the folder where you ran that command, the one that now holds
open-steps/. The commands below run from there. Only git pull runs inside
the clone.
On every tool you add one piece by hand: the routing block. The agent decides by itself whether to use a skill. The routing block is a short table that names the moments when it must use one, and which one. It goes in the file your tool reads as standing instructions, and each tool's part below names that file. Why the block matters.
The pack also has two hooks. One starts each session with the routing table and your last report. The other asks for a report when a session ends with real work done. How they work: The hooks.
Install the pack as a plugin. This wires the skills and both hooks:
claude plugin marketplace add ./open-steps && claude plugin install open-steps@open-steps
Check what you got:
claude plugin details open-steps
To check the whole install, not just the plugin, run
/open-steps:os-install-check in Claude Code. It reports what is wired and
wh