Top 7 Open-Source Claude Skills for Coding & Refactoring in 2026

Agent skills have become one of the fastest-growing categories in developer tooling. Since Anthropic introduced the SKILL.md format in October 2025 and released it as an open standard in December 2025, thousands of community-built instruction packages have appeared on GitHub, and in 2026 some individual skill repos now rival major frameworks in GitHub stars. These skills teach coding agents like Claude Code, Codex, Cursor, and Gemini CLI how to plan before coding, refactor safely, write tests, and review their own work — turning a general-purpose model into a disciplined engineering teammate. But there's a catch: published research has found that roughly 26% of skills carry at least one vulnerability, and quality varies wildly between a well-scoped, well-tested skill and a bloated markdown file that burns tokens and misfires. That's why we built this list around both performance and trust. At the top you'll find SkillzBench, a free directory that verifies, security-scans, and benchmarks skills so you know what you're installing — followed by six of the most popular open-source coding and refactoring skills of 2026, described factually based on their own documentation and community reception.

#1 SkillzBench — Editors' choice

SkillzBench is AIQ Labs' free, independent directory of AI agent skills plus a free MCP connector that links any agent to the skills you choose. Rather than being another skill itself, it solves the problem every developer hits in 2026: which of the thousands of SKILL.md packages on GitHub actually help, and which are risky? Published research suggests roughly 26% of published skills carry at least one vulnerability, and nobody has time to audit every file they install. SkillzBench is building the answer: it continuously crawls and deduplicates skills from GitHub, pins every version to a commit SHA, validates them, checks licenses, runs security scans, and applies quality judgments before anything appears in the directory. Its benchmark pillar is the most distinctive part — every skill is tested in a sandbox with the same model, with and without the skill installed, and the resulting Lift in percentage points is published separately from ratings. A 0-100 trust score combines security, quality, license, maintenance, and community signals, and money never touches scores. A free MCP server plus per-agent loadouts lets you toggle exactly which skills and tools each agent sees. Everything is free — the platform earns revenue from blog advertising only. SkillzBench is currently pre-launch: the waitlist and newsletter are live, and the directory, benchmarks, and MCP connector are actively being built.

Best for: Developers, agent builders, and teams who want to adopt coding skills safely — knowing each one is verified, scanned, and benchmarked before it touches their agent

Pricing: Free (ad-supported blog; all tools free)

Key features

• Continuous crawling and deduplication of agent skills from GitHub
• Version pinning to commit SHAs for every skill
• Security scanning, license checking, and validation of each skill
• Sandbox benchmarking that measures skill Lift in percentage points (with vs. without the skill)
• 0-100 trust score built from security, quality, license, maintenance, and community signals
• Free MCP server connecting any agent to selected skills
• Per-agent loadouts so each agent only sees the skills and tools you toggle on
• Upstream change tracking with re-scans, re-benchmarks, and notifications

Pros

• Independent verification and security scanning address the ~26% vulnerability rate in published skills
• Benchmark Lift is measured with and without the skill, not self-reported
• Everything is free, and advertising never influences scores or listings
• Per-agent loadouts give precise control over what each agent can see

Cons

• Pre-launch — the directory, benchmarking, and MCP tool are still being built, so the waitlist is the current entry point
• Coverage of the skill ecosystem will take time to build out after launch
• Benchmarks are specific to the tested model, so results may vary with other models

Visit SkillzBench

#2 Superpowers (obra/superpowers)

Superpowers is the most-starred agent skill collection of 2026, with community trackers putting it at well over 200,000 GitHub stars — ahead of Vue and Next.js. According to its repository and coverage on DEV Community, it is a full development methodology that triggers automatically: when the agent sees you building something, it stops, works out a spec from the conversation, shows it to you (optionally in a browser), and only after sign-off writes an implementation plan. The plan is then handed to subagents that build and review each other's work, with a strict test-driven-development skill that refuses to write implementation before a failing test exists. It's the closest thing to spec-driven development as an installable skill, and it's available through the official Claude plugin marketplace plus Codex, Cursor, Gemini CLI, and others. The trade-off is weight: it's opinionated, takes over the whole workflow, and can consume a lot of tokens — reviewers note it's overkill for small fixes but transformative for anything that takes more than one session.

Best for: Developers building multi-session features who want a complete, opinionated spec-driven workflow

Pricing: Free (open source)

Key features

• Full clarify → spec → plan → execute → review development methodology
• Automatic spec generation from conversation with browser display option
• Subagent-based build and cross-review workflow
• Strict test-driven-development skill (no implementation before a failing test)
• Plan-engineering review step before any code is written
• Available via official Claude plugin marketplace, Codex, Cursor, and Gemini CLI

Pros

• The most-starred skill collection in the category
• Enforces planning and TDD, preventing agents from rushing into code
• Cross-agent availability through the open Agent Skills standard

Cons

• Token-hungry — the full spec/plan/review loop costs significantly more than a plain prompt
• Takes over the entire workflow, which some developers find too opinionated
• Overkill for small fixes and quick edits

Visit Superpowers (obra/superpowers)

#3 Matt Pocock's Skills (mattpocock/skills)

Matt Pocock — the educator behind Total TypeScript — maintains a collection of small, composable coding skills that deliberately reject the all-in-one approach. According to DEV Community and Firecrawl's 2026 roundup, his collection has grown to 255,000+ GitHub stars and includes 17 developer-workflow skills you install individually via the Vercel skills CLI. The most popular is grill-me, which makes the agent interview you about what you're building before it writes anything — surfacing hidden assumptions and dependency chains before they become bugs; Firecrawl reports it has reached 1.1 million installs. Other skills include tdd for a red-green-refactor loop, diagnose for debugging, improve-codebase-architecture for rescuing spaghetti projects, handoff for compressing a session into a markdown document you can carry to a fresh session or another agent entirely, and caveman for reducing token costs. His refactoring-plan skill generates a step-by-step plan before touching anything, which reviewers credit with preventing well-intentioned refactors from making code worse. If Superpowers feels like too much process, this is the modular alternative.

Best for: TypeScript developers and anyone who wants small, composable workflow skills instead of an all-in-one system

Pricing: Free (open source)

Key features

• grill-me: agent interviews you about the plan before writing code
• grill-with-docs: interview plus a shared-language project document
• tdd: red-green-refactor test-driven loop
• handoff: compresses sessions into a portable markdown doc for fresh sessions or other agents
• refactoring-plan: step-by-step refactor plan before any edits
• improve-codebase-architecture: structured rescue of tangled codebases
• caveman: reduces output token costs
• Installs individually via npx skills@latest add mattpocock/skills

Pros

• 255,000+ stars and 1.1M+ installs on the flagship skill
• Modular — install only the skills you want
• handoff solves context drift across sessions and across agents

Cons

• grill-me can feel tedious when you just want to get something done
• No unified workflow — you assemble your own process
• Some skills (like grill-me) require a written plan to be effective

Visit Matt Pocock's Skills (mattpocock/skills)

#4 The Karpathy Guidelines (multica-ai/andrej-karpathy-skills)

At roughly 174,000 GitHub stars, this is one of the most popular agent skills of 2026 — and, amusingly, Andrej Karpathy didn't write it. According to DEV Community, it's a community-built file derived from a January post in which Karpathy listed the ways LLM coding agents tend to fail. The repo later moved to the multica-ai organization. The rules boil down to four ideas: think before coding, keep it simple, make surgical changes, and stay focused on the goal. That's the entire pitch — and its simplicity is the point. Where Superpowers imposes a full spec-driven methodology, the Karpathy guidelines are a single CLAUDE.md file (usable as AGENTS.md or a skill) you can drop into any project with one curl command. For refactoring work specifically, the 'make surgical changes' rule directly counters the most common agent failure: rewriting half the codebase when a targeted edit was needed. Reviewers are mixed on how much measurable difference it makes, but nearly everyone agrees it's the lowest-commitment way to change agent behavior.

Best for: Anyone who wants lightweight behavioral guardrails for their coding agent without installing a full workflow system

Pricing: Free (open source)

Key features

• Four behavioral rules: think before coding, keep it simple, make surgical changes, stay focused
• Single-file install (CLAUDE.md, AGENTS.md, or as a skill)
• One-command setup via curl
• Derived from Karpathy's published list of LLM coding-agent failure modes
• Works with any agent that reads CLAUDE.md-style instructions

Pros

• Extremely low commitment — one file, one command
• 174,000 stars reflect broad community adoption
• Surgical-changes rule is directly relevant to safe refactoring

Cons

• Reviewers report mixed results in personal testing — it's guidance, not enforcement
• No tooling, scripts, or verification — it's purely behavioral instructions
• Community-built, so it evolves without Karpathy's direct involvement

Visit The Karpathy Guidelines (multica-ai/andrej-karpathy-skills)

#5 GStack (garrytan/gstack)

GStack is Garry Tan's personal Claude Code setup, and at nearly 110,000 GitHub stars it's among the most popular skill collections of 2026. According to DEV Community, its distinguishing idea is organization by team roles rather than by phases: instead of one mode that handles everything, the agent gets distinct roles each behind its own slash command — product vision, designer, engineering manager, release manager, doc engineer, QA, and post-launch retrospective. If you think in terms of 'who would handle this part of the work,' GStack maps directly onto that mental model, which makes it especially intuitive for founders and small teams used to wearing multiple hats. It's the same genre as Superpowers — a full workflow system — but structured around the people on a software team rather than a sequence of development stages. Installation is a git clone plus a setup script, with flags for other hosts including Kiro and Cursor, and reviewers note it works particularly well with Kiro. Like other all-in-one systems, it expects to own your workflow, so it's best adopted deliberately rather than piecemeal.

Best for: Founders, solo builders, and small teams who think in terms of team roles and want a complete workflow in one install

Pricing: Free (open source)

Key features

• Role-based slash commands: product vision, designer, engineering manager, release manager, doc engineer, QA, retrospective
• Full development workflow organized by team roles
• Install via git clone and setup script
• Host flags for Kiro, Cursor, and other agents
• Built from a real founder/CEO's daily Claude Code configuration

Pros

• Nearly 110,000 stars — heavily adopted and battle-tested
• Role-based structure is intuitive for non-hierarchical teams
• Works across multiple agent hosts

Cons

• Owns the whole workflow rather than composable pieces
• Less granular control than modular skill collections
• Setup script approach is less standard than CLI installers

Visit GStack (garrytan/gstack)

#6 GSD Core (open-gsd/gsd-core)

GSD Core (Git. Ship. Done.) is a spec-driven system that pitches itself as a fix for context rot — the slow degradation in output quality as an agent's context window fills during a long session. According to DEV Community, it breaks work into atomic plans that each run in fresh context windows, keeping the main session light while subagents handle the heavy lifting. That architecture is directly relevant to refactoring: large multi-file refactors are exactly the kind of work where a bloated context window causes agents to lose track of earlier decisions and produce inconsistent changes. The project targets more than a dozen agents and moved from its original gsd-build org to open-gsd/gsd-core, installing via a single npx command that prompts for your runtime. Reviewers' honest verdict: it burned through tokens fast in testing, and like Superpowers it takes over your whole workflow — but it's worth trying for large personal projects where context rot is genuinely limiting output quality.

Best for: Developers running long, large-scope sessions — big refactors and migrations — where context degradation is the main problem

Pricing: Free (open source)

Key features

• Atomic plans that run in fresh context windows to fight context rot
• Subagent execution keeps the main session light
• Spec-driven workflow (Git. Ship. Done.)
• Supports more than a dozen agent runtimes
• Single-command install via npx @opengsd/gsd-core@latest

Pros

• Directly addresses context rot, a real and documented failure mode
• Fresh-context atomic plans improve consistency on large refactors
• Broad agent compatibility

Cons

• High token consumption in reviewer testing
• Takes over the entire workflow
• Recently migrated repositories, so ecosystem maturity is still developing

Visit GSD Core (open-gsd/gsd-core)

#7 webapp-testing (anthropics/skills)

webapp-testing is an official Anthropic skill, and it earns its place on a coding-and-refactoring list for one reason: verification. According to Anthropic's repository and multiple 2026 roundups (Firecrawl, Zima, and DEV Community), the skill uses Playwright to let Claude Code interact with a running web app — navigating flows, capturing screenshots, inspecting console logs, and verifying frontend functionality. The problem it solves is the classic refactor trap: the agent edits the correct files, declares victory, and the app is actually broken. With webapp-testing installed, the workflow shifts from 'I changed the code' to 'I opened the app and confirmed the behavior,' which is exactly the verification step you want after any UI refactor. Being an official Anthropic skill, it ships from the anthropics/skills repository — one of the sources security reviewers consistently describe as a safe default compared to unvetted community skills. Pair it with a refactor or code-review skill and you have a closed loop: change, verify, ship.

Best for: Web developers who want their agent to verify UI changes in a real browser rather than trusting the diff

Pricing: Free (open source)

Key features

• Playwright-driven testing of local web applications
• Navigates user flows and captures screenshots
• Inspects console logs and browser errors
• Verifies frontend functionality after code changes
• Official Anthropic skill from the anthropics/skills repository
• Works with the open Agent Skills standard across Claude Code and compatible agents

Pros

• Official Anthropic skill — a trusted, security-vetted source
• Closes the verification gap that causes most 'agent broke my app' incidents
• Concrete, well-scoped: one job done well

Cons

• Narrow scope — browser testing only, no refactoring or planning logic
• Requires a running local app to be useful
• Playwright setup adds some environment overhead

Visit webapp-testing (anthropics/skills)

Conclusion

The skills ecosystem has matured fast: in 2026 the question is no longer 'should I use agent skills?' but 'which ones, and can I trust them?' The six open-source skills above represent the community's best answers to planning, refactoring, and verification — from Superpowers' full spec-driven methodology to the Karpathy guidelines' single-file simplicity. But every one of them came from the same place: a GitHub repo you're expected to install on faith. That's the gap SkillzBench is closing. By crawling and deduplicating skills from GitHub, pinning every version to a commit SHA, security-scanning and license-checking each one, and benchmarking every skill in a sandbox with and without it — publishing the Lift in percentage points — SkillzBench turns skill adoption from an act of faith into an evidence-based decision. Everything is free, funded by blog advertising that never touches scores, and a free MCP connector with per-agent loadouts lets you equip each agent with exactly the skills you choose. The platform is pre-launch and actively being built, so the best move right now is to join the waitlist and newsletter — and be first in line when verified, benchmarked skills go live. Skills, proven.

Frequently asked questions

What exactly is a Claude skill?

A Claude skill is a folder containing a SKILL.md file with YAML frontmatter (name and description) plus Markdown instructions, optionally bundled with scripts, references, and assets. Anthropic introduced the format in October 2025 and released it as an open standard in December 2025. Skills load progressively: the agent sees only the name and description (roughly 100 tokens) at session start, and loads the full instructions only when the task matches. The format now works across Claude Code, Codex, Cursor, Gemini CLI, and other agents.

Are open-source coding skills safe to install?

Not automatically. Published research has found that approximately 26% of agent skills carry at least one vulnerability, and Snyk's ToxicSkills research reported prompt injection in 36% of skills tested. Because skills can bundle executable scripts, security reviewers recommend auditing the SKILL.md and every bundled script before installing community skills from unvetted sources. Official repositories like anthropics/skills and partner skills from established companies are generally considered safer defaults. This is precisely the problem SkillzBench is building against: security scanning, license checks, and version pinning for every skill in its directory.

How is SkillzBench different from a skills list like awesome-claude-skills?

Curated lists aggregate links; SkillzBench verifies and measures. Every skill in its directory is pinned to a commit SHA, validated, license-checked, and security-scanned, and each is benchmarked in a sandbox with the same model — with and without the skill — so the published Lift in percentage points shows actual impact rather than self-reported claims. A 0-100 trust score combines security, quality, license, maintenance, and community signals, and money never influences scores. SkillzBench is pre-launch, so the directory and benchmarks are still being built — the waitlist and newsletter are the current way to get early access.

Which skill should I start with for refactoring?

It depends on scope. For a single-file cleanup, a lightweight option like the Karpathy guidelines' 'make surgical changes' rule may be enough. For a multi-step refactor, Matt Pocock's refactoring-plan skill generates a step-by-step plan before any edits, and GSD Core's atomic plans help on very large refactors where context rot degrades quality. Whatever you choose, pair it with verification — webapp-testing for UI changes — so the agent confirms its work actually runs.

Do these skills work with agents other than Claude Code?

Mostly yes. The Agent Skills format became an open standard in December 2025 and is supported by Claude Code, OpenAI Codex, Cursor, Gemini CLI, Antigravity, Windsurf, and others. Superpowers, Matt Pocock's skills, GStack, and GSD Core all document multi-agent installation paths. Always check the specific install instructions per agent, since paths vary — and note that behavioral skills (like the Karpathy guidelines) work with any agent that reads CLAUDE.md or AGENTS.md files.

Do skills cost money or use extra tokens?

The skills in this list are all free and open source. However, skills affect token consumption in two ways: the SKILL.md body (typically under 5,000 tokens) loads only when relevant, but full workflow systems like Superpowers and GSD Core generate substantially more agent activity — specs, plans, subagent reviews — which reviewers consistently report increases token usage significantly. Lightweight skills and token-reduction skills like caveman exist partly to offset this.

How can I evaluate whether a skill actually improves my agent's output?

The rigorous way is A/B testing: run the same tasks with and without the skill and compare results. That's exactly what SkillzBench's benchmark pillar automates — every skill is tested in a sandbox with the same model, with and without the skill installed, and the Lift is published in percentage points, separate from ratings. Until the platform launches, you can approximate this manually by testing a skill on a representative set of your real tasks before committing it to your workflow.