Tech Leads Club's Agent Skills registry: 84 workflows, one CLI, a real security caveat (2026)

Install tech-leads-club/agent-skills if you want a cross-agent way to discover, install, update, and audit reusable workflows without copying random SKILL.md files into every project. The repository is a good fit for Claude Code, Cursor, Cline, Codex, Gemini CLI, Copilot, Windsurf, OpenCode, and other tools that support the Agent Skills format. 1

My short verdict: pilot it with one skill, especially tlc-spec-driven, if you want more disciplined feature work across agents. Do not treat the registry as a blanket safety guarantee. Read the selected skill and its references before giving it access to a production repository.

Why this is this week's pick

The timing is unusually clear. The repository released skills-catalog-v0.17.0 on July 18, adding a pr-review skill for adaptive multi-agent pull-request review and tightening the execution contract around subagent orchestration. 2 The GitHub page currently shows about 4.9k stars, 447 forks, 66 releases, and 1,089 commits. 1

The project's own catalog page lists 84 available skills across 15 categories and reports 3,754 downloads in the last 30 days. 3 I could not verify a clean seven-day star delta from the public pages, so I am not presenting an invented weekly-growth number. Release activity, catalog downloads, and fresh issue traffic are the better-supported momentum signals here.

This is a registry and installer, not one giant prompt. You choose the workflows you want, copy or symlink them into the agent directories you use, and keep a local record of what was installed.

What you get

The catalog covers development, cloud, browser automation, design, security, and go-to-market work. The featured list includes tlc-spec-driven, aws-advisor, playwright-skill, figma, and security-best-practices. 1

The most useful first experiment is tlc-spec-driven. The official catalog describes a four-phase workflow: Specify, Design, Tasks, and Execute. It creates atomic tasks, verification criteria, and persistent project memory, and it is described as stack-agnostic and zero-config. 3 That makes it more practical for a mixed Claude Code, Cursor, and Codex team than a framework-specific coding skill.

The registry also has a security story, although it should be read as a set of engineering controls rather than a safety certification. The project says its CLI uses input sanitization, path containment, symlink checks, lockfile validation, SHA-256 content hashes, and an append-only audit log. It says the catalog is scanned with Snyk Agent Scan before publishing. 4

Install one skill first

The official site gives this direct install command for tlc-spec-driven: 3

npx @tech-leads-club/agent-skills install --skill tlc-spec-driven

The repository README documents the interactive wizard and shorter CLI flags as well:

# Browse the catalog interactively
npx @tech-leads-club/agent-skills

# Install a skill for selected agents
npx @tech-leads-club/agent-skills install -s tlc-spec-driven -a cursor claude-code

# Install globally, rather than only in the current project
npx @tech-leads-club/agent-skills install -s tlc-spec-driven -g

The wizard lets you choose the skill, target agents, copy or symlink installation, and local or global scope. The README lists Claude Code, Cursor, Cline, Codex, Gemini CLI, Copilot, Windsurf, OpenCode, Antigravity, and other agent environments as supported targets. 1

Check the runtime before installing. The npm package README advertises Node.js 22 or newer. Its latest published CLI package is 1.4.7, while the separate catalog release is 0.17.0 on GitHub. 5 That version split is easy to miss, so pin or record both pieces if you are standardizing this in a team setup.

Two useful first tests

Do not start by installing the whole catalog. Give one skill a small task in a disposable branch and see whether its required artifacts help or merely add ceremony.

Plan a medium-sized feature

After installing tlc-spec-driven, try:

Use tlc-spec-driven for this task. Treat it as a medium-sized feature, not a quick fix.

We need to add CSV export to the admin orders view. Before editing code:
1. inspect the existing data flow and test setup;
2. state the requirements and unresolved decisions;
3. propose the smallest implementation plan;
4. split the work into atomic tasks with verification criteria.

Do not change files until the plan is explicit. At the end of each task, show the evidence that the task passed its gate.

The point is not the wording of this prompt. It is whether the skill leaves behind a usable specification, task breakdown, and verification trail instead of a large unreviewable patch.

Resume after an interrupted session

The project describes handoffs, lessons, and verification as part of the workflow. Test the failure case deliberately:

Resume the existing tlc-spec-driven workflow for this repository.

First reconcile the current branch, git status, recent commits, the working tree,
and the project handoff. Do not repeat a task only because the narrative handoff
mentions it. If the evidence conflicts, stop and list the conflict before editing.

That prompt is also a useful boundary test. A skill that changes how an agent resumes work should be judged on whether it preserves partial work and respects the current repository state.

What real users are reporting

The strongest positive feedback I found is concrete rather than a star rating. In a July 15 issue, a user said they had applied tlc-spec-driven to a large brownfield refinement program across multiple agent sessions. They wrote that its atomic-task, verification, handoff, and lessons mechanisms "worked well." The same report then identified gaps in real use: resume logic relied too heavily on narrative state, task status could lag behind the commit that proved completion, and approval was not clearly separated from authorization to execute, push, deploy, or make other external changes. 6

That is a healthy kind of feedback for a workflow skill. It says the core loop helped on a real program, while also showing where you should keep human review and repository-level controls.

The security story is less tidy. An open automated scan issue from June reported 0 critical, 6 high, and 13 medium findings across catalog entries. The examples included remote JavaScript and icon-pack loading in mermaid-studio, automatic patching and possible remote pushes in nx-ci-monitor, and uploading a project tarball to a remote deployment endpoint in vercel-deploy. 7

Those findings do not mean the entire registry is unsafe. They do mean the word "verified" should not replace a skill-by-skill review. A registry that scans its contents can still contain skills whose intended behavior is too powerful for your environment, or whose external integrations need an explicit allowlist.

There is also a contribution-process complaint in the open issue list: one report says CONTRIBUTING.md asks people to open a pull request while the repository blocks non-collaborators from doing so. 8 That is not an installation blocker, but it is a useful signal about how much community participation you should expect compared with a mature, open-maintainer project.

License and operating caveats

The repository distinguishes between its software engine and its skill content. The CLI is MIT-licensed. Skills authored by Tech Leads Club are generally CC BY 4.0 unless a file says otherwise, and third-party skills retain their original licenses and attribution requirements. Check the individual skill before redistributing it inside a company image or a public template. 1

The security policy also says normal pull-request workflows from forks do not run the scan because repository secrets are unavailable; the project points to merge-queue checks for blocking merges on those cases. 4 That is a process limitation, not a reason to ignore the scanner. It is a reason to understand where the scanner does and does not run.

For a team rollout, I would keep the following rules:

Install one skill at a time and review its SKILL.md, references, scripts, and network calls.
Prefer project-local installation until the workflow has survived a real task.
Keep the audit log and lockfile under the review process your team already uses.
Treat skills that can deploy, push, run installers, access cloud accounts, or upload files as privileged tools.
Record the catalog release and npm CLI version together, because they do not currently use the same version number.

Quick reference

Repository	tech-leads-club/agent-skills 1
What it is	A registry and CLI for curated Agent Skills, with an optional MCP server. 1
Catalog snapshot	84 skills, 15 categories, and 3,754 downloads in the last 30 days on the official site. 3
Current catalog release	`skills-catalog-v0.17.0`, released July 18, 2026. 2
CLI package	`@tech-leads-club/agent-skills` 1.4.7, MIT, Node.js 22+ advertised. 5
Best first skill	`tlc-spec-driven` for structured feature planning, atomic tasks, verification, and handoffs. 3
Install if	You use more than one coding agent and want a repeatable way to manage selected skills.
Skip or sandbox if	You need a fully audited, risk-free catalog, cannot run Node.js 22+, or your workflow gives agents broad deployment and credential access.

Install tlc-spec-driven in a disposable project, run one medium-sized feature and one interrupted-session test, then inspect the generated artifacts and audit trail. If the workflow makes the agent's decisions easier to review without slowing ordinary work to a crawl, keep it. If it mostly adds documents that nobody reads, remove it before it becomes team-wide ceremony.

Tech Leads Club's Agent Skills registry: 84 workflows, one CLI, a real security caveat