Engineering best practices that AI coding agents actually apply — 40+ skills, from secure coding and cloud to compliance and UX writing. BUILD + AUDIT modes. Measured: best-practice coverage 59% → 98% vs. the same model unguided.
# Add to your Claude Code skills
git clone https://github.com/martinholovsky/SOTA-skillsSOTA-skills is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by martinholovsky. Engineering best practices that AI coding agents actually apply — 40+ skills, from secure coding and cloud to compliance and UX writing. BUILD + AUDIT modes. Measured: best-practice coverage 59% → 98% vs. the same model unguided. It has 18 GitHub stars.
SOTA-skills's catalog security scan is still queued. You can run an instant dependency and prompt-injection check now with the "Scan for vulnerabilities" button above.
Clone the repository with "git clone https://github.com/martinholovsky/SOTA-skills" and add it to your Claude Code skills directory (see the Installation section above).
SOTA-skills is primarily written in Python. It is open-source under martinholovsky on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh SOTA-skills against similar tools.
No comments yet. Be the first to share your thoughts!
Unlocks once the catalog security scan passes (runs nightly).
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
The deep catalog scan for this skill is still queued. Run an instant dependency check now instead.
Make your AI coding assistant build and audit like your most senior engineer.
Your assistant is brilliant — it just doesn't know your standards, and it forgets the ones it does know as the task grows long. SOTA-skills fixes both, and the fix is measured: from a bare "build X" prompt, best-practice coverage climbs from ~59% to ~98% (+0.39) — the model stops silently dropping tests, rate limiting, structured logging, and TLS (see every number →).
It works by being a loop, not a prompt dump: route in only the rules a task needs,
re-state them every turn, and re-check them last before shipping — so the guidance
survives a long context instead of fading into it. That's why it beats a bigger prompt
instead of becoming one. Native on Claude Code; works with Gemini CLI, Codex, and any
agent that reads AGENTS.md.
Under the hood: 41 skills (302 files, ~65k lines) of state-of-the-art 2026
practice, each instruction file under 500 lines so only the matching rules load —
the cap applies to skills/** alone, never to README/CHANGELOG/docs/ — every fast-moving
claim web-verified against a primary source.
Two commands to install:
/plugin marketplace add martinholovsky/SOTA-skills
/plugin install sota-skills@sota-skills
Or clone + link (best if you want a local checkout to read, hack on, or pin).
Skills are discovered from .claude/skills/ (per project) or ~/.claude/skills/
(personal, all projects). Clone the repo, then run the installer — it symlinks
every skill (and your profile, if you have one):
git clone https://github.com/martinholovsky/SOTA-skills && cd SOTA-skills
./scripts/install.sh # personal: ~/.claude/skills (all projects)
./scripts/install.sh --project DIR # one project: DIR/.claude/skills
./scripts/install.sh --copy # copy instead of symlink (pin a snapshot)
The installer colour-codes what it did (✓ done · ↻ changed or act on this ·
· no-op) and drops to plain ASCII when the output is not a terminal, on a
non-UTF-8 locale, on TERM=dumb, or with NO_COLOR set — --color=always|never|auto
(or --no-color) overrides the detection either way.
Then describe the task in plain language — routing loads the right skills; the stack comes from your profile or the skills' defaults (naming one is optional):
Design a multi-tenant invoicing service.
Run a full audit of this repo — severity, effort, and fix on every finding.
More install options: Installation · more prompts: Using it.
Deeper docs: Find it fast (docs index) · Does it work? (measured results) · Why it works · Keeping rules applied as context fills · Roadmap
Findings name the control they violate — not just "this looks wrong":
Named standards are the floor. Most of the library is the practice layer no regulation writes down: cancellation & backpressure, retries with jitter, circuit breakers, outbox/saga, double-entry ledgers and the reconciliation that proves an integration is complete rather than merely correct, zero-downtime migrations, measure-first performance, API evolvability, per-language idioms, SLOs, test-suite health.
Measured, not asserted — library vs. an unguided model (same model, no library); clean, blind-judged, stable across samples (results & method →). Every number below names the model it was measured on, because a lift can be overtaken by model progress and then reads as current when it is historical — that happened to the defect-avoidance row on 2026-08-21 and is stated there rather than quietly left standing:
claude-sonnet-5: 0.62 → 1.00, +0.38 — unchanged. From a bare "build X" prompt, best-practice coverage goes ~59% → ~98% (7 tasks): the model stops silently dropping tests, rate limiting, structured logging, and TLS. Web search likely can't recover this (an agent won't search "should I add rate limiting"). Not model-specific, and not stale: a different-family model (openai/gpt-5.1) shows +0.44 on the same tasks (cross-model →), and claude-sonnet-5 — four months newer than the model this was established on — still shows +0.38 (2026-08-21 →). Why this one lasted while defect-avoidance did not: newer models stopped writing known-bad patterns, but sonnet-5 unguided still omits tests in 7 of 7 tasks, transport in 5, rate limiting in 5. Knowledge gaps close with model progress; salience gaps do not.claude-sonnet-4.6, where an unguided model is confidently wrong. Re-measured 2026-08-25 on claude-sonnet-5: 0.69 → 0.99, +0.30. The pre-registered prediction was that a training cutoff is a gap model progress cannot close — refuted: the newer model answers 8 of these facts unaided that its predecessor could not, because its cutoff advanced into a fixed case set. Ten of 32 remain outside it, and that is the surviving lift. So freshness is a third shape — neither expired like defect-avoidance nor flat like completeness. And the same day we proved the cause was the instrument, not the library: a fresh 10-case freshness set built from recent facts, each verified against its primary source and chosen by a rule fixed before any model ran, reads 0.33 → 1.00, +0.67 on the same model an hour later — higher than the original +0.53. The guidance did not improve between two runs; the questions got newer. A freshness lift is therefore quoted with the date its questions were written, the way every other number here is quoted with its model (2026-08-25 →).