Documentation

Getting Started

1ai-skills is a library of 1337 SKILL.md files that force AI agents to follow real workflows. Every skill includes anti-rationalization tables, code examples, and verification checklists.

Quick Install (Claude Code)

/plugin marketplace add oyi77/1ai-skills
/plugin install 1ai-skills@1ai-skills

Quick Install (Cursor)

git clone https://github.com/oyi77/1ai-skills.git
cp -r 1ai-skills/cybersecurity/* .cursor/rules/

Quick Install (Gemini CLI)

gemini skills install https://github.com/oyi77/1ai-skills.git --path skills

How It Works

When your agent loads a skill, it reads the full SKILL.md content and follows the workflow. The anti-rationalization table prevents the agent from cutting corners.

Agent receives task
  ↓
Agent searches SKILLS.json for matching skill
  ↓
Agent loads SKILL.md (frontmatter + body)
  ↓
Agent sees Anti-Rationalization Table
  ↓
Agent follows Workflow steps
  ↓
Agent checks Verification checklist
  ↓
Task complete with proof

Skill Anatomy

Every skill follows this structure:

---
name: detecting-lateral-movement-with-splunk
description: Detect adversary lateral movement using Splunk SPL queries.
domain: cybersecurity
tags:
- threat-hunting
- splunk
- lateral-movement
---

# Detecting Lateral Movement with Splunk

## When to Use
- When hunting for adversary movement between systems
- After detecting credential theft

## When NOT to Use
- When you lack Splunk access
- For network-level detection only

## Overview
Detect adversary lateral movement across networks using
Splunk SPL queries against Windows authentication logs.

## Workflow
1. **Define Scope** — Identify techniques to hunt
2. **Collect Data** — Gather historical logs
3. **Build Queries** — Write SPL detection rules
4. **Execute** — Run queries against data
5. **Triage** — Filter false positives
6. **Document** — Record findings

## Anti-Rationalization
| Rationalization | Reality |
|---|---|
| "We are too small to be targeted" | Automated attacks target everyone |
| "Security slows us down" | A breach slows you down 100x more |

## Verification
- [ ] All queries executed
- [ ] False positives filtered
- [ ] Findings documented

Installation

Claude Code

# Via plugin marketplace
/plugin marketplace add oyi77/1ai-skills
/plugin install 1ai-skills@1ai-skills

# Via local clone
git clone https://github.com/oyi77/1ai-skills.git
claude --plugin-dir /path/to/1ai-skills

Cursor

git clone https://github.com/oyi77/1ai-skills.git
# Copy skills into .cursor/rules/
cp -r 1ai-skills/cybersecurity/* .cursor/rules/
# Or copy specific category
cp -r 1ai-skills/development/* .cursor/rules/

Gemini CLI / Antigravity

gemini skills install https://github.com/oyi77/1ai-skills.git --path skills

Any Agent

git clone https://github.com/oyi77/1ai-skills.git
# Point your agent to the skills/ directory
# Each SKILL.md is self-contained and portable

Slash Commands

Command	Description
/find	Search and activate the right skill for your task
/audit	Run comprehensive quality audit on all skills
/lint	Lint and auto-fix skill content issues
/new-skill	Scaffold a new skill from template

Testing

# Run all tests
python3 scripts/test-skills.py

# Quick mode (skip SDK checks)
python3 scripts/test-skills.py --quick

# JSON output
python3 scripts/test-skills.py --json

# Test single skill
python3 scripts/test-skills.py --skill seo-optimizer

8 Test Dimensions

#	Test	What It Checks
1	Structure	YAML frontmatter, required fields
2	Content	Sections present, no placeholders
3	Code Syntax	Python ast.parse, JS/TS, Bash
4	Internal Links	All /skills/ links resolve
5	Description	50-200 chars, action-oriented
6	Quality	Anti-rationalization, code, verification
7	SDK	Referenced imports are installable
8	Workflow	Has workflow section

Creating Skills

# Scaffold a new skill
python3 scripts/test-skills.py --new-skill my-skill-name --category development

# Or manually:
mkdir -p cybersecurity/my-skill-name
# Create SKILL.md with frontmatter + body
# Run validation
python3 scripts/validate-skills.py
python3 scripts/test-skills.py --skill my-skill-name

FAQ

What is an anti-rationalization table?

A structured argument that prevents your agent from using common excuses. For example:

| Rationalization | Reality |
|---|---|
| "Tests slow me down" | Bugs slow you down 10x more |
| "I will refactor later" | Technical debt compounds |

How is this different from addyosmani/agent-skills?

Complementary. His 24 skills are engineering lifecycle commands (/spec, /build, /test). Our 1337 skills are domain-specific knowledge (cybersecurity, trading, marketing). Use both.

Can I use skills from multiple categories?

Yes. Skills are independent and composable. Load the cybersecurity skill for security tasks, the development skill for coding tasks, etc.