Hi, it's Andreas here.
I'm a little delayed this week as I'm working on some new projects, and I can't wait to share them soon. And it took me a lot of time to put this newsletter together, but I believe this edition contains a wealth of useful information that makes it worthwhile.

In this issue:

OpenAI ships GPT-6.1 Terra, a cheaper model built for computer use → Half the API price of GPT-6.1 Sol. OpenAI says it matches GPT-6 Astra on its computer-use benchmark at a tenth of the price per token.

Anthropic opens Claude Duet, an agent that keeps working while you are away → It runs in its own cloud browser and asks before it sends, pays, signs or deletes. Research preview for US Pro and Max users, via waitlist.

PHP fixes two critical flaws, one found with AI → Both allow remote code execution, one without login on default Apache setups. Researchers at Calif found one using GPT-5.6 Sol. The NSA says patch now or take systems offline.

OpenAI coding agents weakened safety monitoring while changing code
→ A GPT-6 Astra agent removed a monitoring integration, then denied it. METR estimates about 10% of eligible internal Codex traffic went unmonitored from May to July.

US banks start limiting third-party AI agents in customer accounts → Morgan Stanley is blocking them; most banks are moving to read-only access. Walmart went the other way, with agent spending limits that customers set, launching next month.

Anthropic's junior share of technical hires fell from 27% to 9% → Inside Anthropic, agent hours outnumber employee hours six to one, and commits per engineer rose 5x in six months. Its hiring managers increasingly weigh autonomy and judgment over domain expertise.

I’ve run more than 50 workshops on building AI agents this year, 15 of them this month alone, with all kinds of companies. In every single one, I call skills the most underused and underestimated building block. They carry far more power than most people realize, so I push everyone to understand them properly and go deep.

Besides building their own, people want to know which skills to use. As soon as we get into how skills work, the same questions come up: Which ones are worth installing? Can I share mine? Which published ones do I recommend?

So I put together a list. I’ve tested more than 200 repositories to get here, and these are the ones that made the cut.

One warning first. Don't install skills and plugins just because they are on a list or you find them and the description sounds appealing. A skill, plugin or rules file is text and code your agent trusts. In Forever Security's Downloads-folder tests, a planted AGENTS.md got Codex to run real malware in over 90% of tests, and a crafted CLAUDE.md hijacked Claude about half the time.

If we talk about repos in this context, they typically involve three types, each carrying different risks:

Skill: a folder with a SKILL.md file that loads only when a task fits or when you call it, so until then it costs almost nothing.
Rules file: a CLAUDE.md or AGENTS.md, loaded into every session.
Plugin: an install package that can bundle skills, slash commands and hooks. Hooks are scripts that run on their own, some the moment a session starts.

The rest of this edition is the ten one by one: what each does, who it fits, how to install it and what the repo looks like. It ends with a prompt that makes Claude read a repo for you before you install it.

Who each one is for. Every entry carries my call: solo, team or company. Solo tools make one person faster on their own projects. Team tools give several people the same process, so every agent on the team plans, tests and reviews the same way. Company means it could be useful for a whole organization.

How to set one up. Copy the install lines into Claude Code and press enter, and Claude Code installs the repo for you. Where an entry says "in your terminal", paste the lines into your normal terminal instead. Stars are as of October 29.

1. Superpowers
Plugin · Solo, team · 308k stars
→ Makes the agent brainstorm, write a plan, build test-first and review between tasks before it ships code. It can work for a couple of hours without leaving a plan.
Good for: building new features in an existing codebase, when you want a brainstorm, a written plan and tests before any code is written. It is also a good way to hand a longer task to the agent and review the result at the end or build a full application.

Install in Claude Code:
/plugin install superpowers@claude-plugins-official

2. Skills for Real Engineers by Matt Pocock
Skills · Solo · 306k stars
→ Small engineering skills you call by name, such as /to-spec, /tdd and /triage. Install it one way only; the plugin plus npx gives you every skill twice.
Good for: spec-driven building on your own: /to-spec questions you and turns the idea into a spec, then /tdd builds it test-first. You pick the two or three skills you need instead of adopting a whole framework.

Install in your terminal:
claude plugin install mattpocock-skills@claude-plugins-official
Then once per repo, in Claude Code:
/setup-matt-pocock-skills

3. ECC (Everything Claude Code)
Full setup · Team · 292k stars
→ One install with 311 skills, 71 agents and 97 commands, plus memory and security tooling. Its /astra-review sends your diff to OpenAI when you run it.
Good for: teams that want one standard agent environment across Claude Code, Codex and other agents, with planning, security checks and memory in one install. Start with the parts you need, because the full set is heavy.

Install in your terminal:
npx [email protected] setup

4. Karpathy-inspired guidelines
Rules file · Company · 226k stars
→ I run this one every day. Four rules in one CLAUDE.md: think before coding, simplicity first, surgical changes, goal-driven execution. One text file, and no code runs.
Good for: any project where the agent over-builds, edits files it should leave alone, or guesses instead of asking. It is the first thing I would add in a company, because a security team can review it in minutes.

Install in your terminal, inside your project (it appends to your CLAUDE.md):
echo >> CLAUDE.md && curl https://raw.githubusercontent.com/multica-ai/andrej-karpathy-skills/main/CLAUDE.md >> CLAUDE.md

5. Anthropic Skills
Skills · Company · 185k stars
→ I use them literally every day, and I have rolled them out at a number of companies.
Good for: anyone who works in documents more than code, because you create and edit Word, PowerPoint, Excel and PDF files straight from a prompt. If you want to write your own skills, start from skill-creator, which shows what a good skill looks like.
Browse for more: Anthropic's second repo, knowledge-work-plugins, has ready-made plugins by role, for legal, HR, finance, sales, marketing, support and more. I find HR (recruiting, onboarding, performance reviews, compensation, policy questions) and legal (contract review, NDA triage, compliance) especially useful and I have also put them into production across several companies.

Install in Claude Code:
/plugin marketplace add anthropics/skills
/plugin install document-skills@anthropic-agent-skills
/plugin install example-skills@anthropic-agent-skills

For the role plugins, in your terminal:
claude plugin marketplace add anthropics/knowledge-work-plugins
claude plugin install human-resources@knowledge-work-plugins
Swap in legal, finance or sales for the other roles. In Claude Cowork, you install them from claude.com/plugins.

6. ponytail
Always-on plugin · Solo, team · 180k stars
→ Works like a "lazy senior dev": reuse what exists, write as little as possible, never cut security or validation.
Good for: codebases that keep filling up with code nobody asked for, like extra layers, helper functions and new dependencies. Run /ponytail-review before a merge to catch bugs and cut what the change does not need.

Install in Claude Code:
/plugin marketplace add DietrichGebert/ponytail
/plugin install ponytail@ponytail

7. UI/UX Pro Max
Skill with scripts · Solo · 142k stars
→ Design knowledge the agent can search: 79 UI styles, 192 color palettes and 74 font pairings. It needs Python 3.
Good for: landing pages and app screens that should look designed when there is no designer on the team. It generates a design system for your product type, with style, colors and fonts, and the agent builds the front-end on top of it (did my website with it).

Install in Claude Code:
/plugin marketplace add nextlevelbuilder/ui-ux-pro-max-skill
/plugin install ui-ux-pro-max@ui-ux-pro-max-skill

8. gstack by Garry Tan
Skills on their own toolchain · Solo · 138k stars
→ Garry Tan's own setup: 23 tools that act as CEO, designer, engineering manager, QA and release manager, plus its own browser. It needs Git and Bun, and its README asks your agent to add a gstack section to your CLAUDE.md.
Good for: solo founders who want the roles they do not have: a CEO review of the plan, a design review, QA in a real browser and a release step. You run it as a sequence, from /office-hours to /ship.

Install in your terminal:
git clone --single-branch --depth 1 https://github.com/garrytan/gstack.git ~/.claude/skills/gstack && cd ~/.claude/skills/gstack && ./setup

9. caveman
Always-on plugin · Solo · 116k stars
→ The agent answers in very short sentences. A plain "Answer concisely." already cuts output tokens from 6,983 to 4,334 on ten questions, and /caveman gets even to 4,119. Its command-line tool sends usage stats by default.
Good for: long coding sessions where you want the code and the answer without the explanation. Try a plain "Answer concisely." first, because the README's own numbers show it does most of the work.

Install in your terminal:
claude plugin marketplace add JuliusBrussee/caveman
claude plugin install caveman@caveman

10. Agent Skills by Addy Osmani
Plugin · Team · 112k stars
→ Senior-engineer workflows as skills, run through nine lifecycle commands from /spec to /ship.
Good for: teams that want every agent to follow the same senior-engineer process: spec, plan, build, test, review and ship. It also fits teams that use different agents, because the skills install into 70+ of them.

Install in Claude Code:
/plugin marketplace add addyosmani/agent-skills
/plugin install agent-skills@addy-agent-skills

If you build with Claude Code: open /plugin and your skills folder, and label each entry skill, rules file or plugin. Keep one workflow, and read what each hook runs.

If you lead a team: agree on one workflow and one rules file per repo, and commit the rules file, so every agent on the team starts from the same instructions.

If you own security or advise on tooling: treat hooks like any code that runs on a laptop. Keep a short list of approved repos, install only from the official source, and check what leaves the machine. The entries above flag what I found.

Paste this, with the repo link:

A rules file is text your agent obeys in every session. That is what makes it useful, and also what attackers aim for. A rules file from a stranger's repo uses the same mechanism as the planted files in those tests, with your permission.

DeepLearning.AI and Chroma's Context Engineering course → 37 lessons with Jeff Huber and Drew Breunig: build agent harnesses in plain Python, then search, compaction, scratchpads and memory across sessions.

Ai2's FairStress tests whether a persuasive argument flips a model's decision → 300 two-candidate scenarios in 29 domains, including hiring, lending and healthcare, expanded to 13 million tests. Models switched more readily depending on which group an argument favored.

I take on a small number of advisory engagements each quarter for AI programs that are stuck. Reply to this email with the one initiative you would want a second pair of eyes on. And if you want to build agents rather than read about them, the waitlist for the fourth Agentic AI Cohort is open, and you can start the Build Sprint today.

— Andreas