Agentic Skills Frameworks

Executive Summary

The useful distinction in this market is what a tool adds to an existing coding agent: a development method, reusable expertise, or a way to distribute and govern that expertise. A skill format does not by itself supply an agent runtime, a security boundary, or a guarantee that the agent follows the process. The Agent Skills specification explicitly leaves script support and experimental tool permissions to implementations.^[1]

Review dates: This comparison includes 15 tools in the three matrices below. The September 15 review added gstack, updated planning and review flows, and separated adjacent runtimes and standards from direct alternatives. The September 16 addition evaluates Grok's plugin marketplace; the other entries retain their September 15 baseline. OpenAI's earlier skills catalog is now explicitly deprecated; its replacement is discussed separately.^[2]

Research limit: This is a documentation and source review, supplemented by dated first-hand reports. It is not a controlled benchmark or a fresh installation test of every framework. Recommendations below are editorial judgments about fit.

Scope and Selection

Included tools offer a publicly available development methodology, reusable skill catalog, or skill/plugin distribution and management service. They must provide something a team can inspect or use beyond a directory of links. Catalogs and registries are compared within their role, rather than ranked against development methods by stars or installation counts.

A compatible SKILL.md file has metadata and instructions, with optional scripts, references, and assets. Progressive disclosure loads descriptions before full bodies and supporting resources. That reduces initial instruction loading; it does not make a large installed catalog cost-free or make scripts portable across every environment.^[1]

Development Methods

These methods are choices about process and artifacts. They do not establish a universal minimum team size or a rule that one framework is only for greenfield development. Spec Kit now has explicit guidance for bounded changes in existing projects, while OpenSpec organizes changes around evolving proposals and specs.^[10][6]

Skill Catalogs

Choose a catalog for a concrete capability gap. The presence of a skill in an official or popular collection does not establish its quality on your codebase. A short task-specific package may be more useful than installing an entire catalog.

Distribution and Management

skills.sh's audit page presents results from Gen, Socket, and Snyk, including pending results and differing risk judgments. Read the actual result and its scope; a directory listing alone is not an audit result.^[22] Tech Leads Club's security policy also distinguishes release scanning from fork-PR scanning: fork checks need the documented merge-queue configuration to block merging until the scan passes.^[18]

Grok: Inspect the Package and the Host

Grok belongs in distribution because its official catalog supplies source locations, pinned revisions, and an index of skills, commands, agents, hooks, MCP servers, and LSP servers. At inspected commit 6b781e0, the catalog contains 27 entries: 25 remote sources and two locally vendored third-party packages. That is an inventory snapshot, not an adoption or quality ranking. Remote entries require full commit pins; the component index records which revision it describes. Each plugin retains its own license and terms, so the catalog is not one uniformly permissive package.^[23][20]

Portability still depends on the client. Grok Build accepts allowed-tools without granting or restricting tool access, and accepts model, effort, license, and compatibility without applying them. Its user-invocable: false setting hides a skill from both the user and the model. Reading the same skill folder therefore does not establish identical invocation or permission behavior across hosts.^[21]

Hook semantics are another practical test. Grok requires trust for project hooks; that trust also covers project MCP and LSP servers. Only PreToolUse can block a tool call. Crashes, timeouts, and malformed responses fail open, allowing execution to continue. A team relying on a hook for mandatory policy enforcement must test that failure path instead of treating hook presence as a security guarantee.^[24]

The broader Grok skills profile separates this CLI catalog from reusable skills in the Grok web/mobile app and from Grok Bot's learned skills and scheduled routines. These are different operating surfaces, not three interchangeable framework entries or evidence of synchronized installation.^[25][26] For an evaluation, inspect one package's components and license, run a bounded task in the intended host, and verify which instructions, hooks, and tool permissions actually take effect.

What Changed in the Methods

Planning Is Becoming More Selective

Superpowers' current brainstorming instructions choose between a spike, a bounded change, and architectural work while retaining approval. BMAD's Build guide similarly investigates before deciding whether a light spec is enough. These are more useful distinctions than the old claim that a fixed number of personas makes one tool suitable only for a particular team size.^[3][4]

Spec Kit remains artifact-oriented, but its current quickstart includes convergence after implementation and its existing-project guide emphasizes preserving architecture and defining a bounded change. OpenSpec keeps its change artifacts editable throughout the work. Evaluate these approaches on how easily your team revises a decision and recovers context, not on a greenfield/brownfield binary.^[5][10][6]

Review Labels Need Evidence Behind Them

Superpowers' current subagent workflow combines specification and code-quality review for each task, records progress in a plan-scoped ledger, and adds branch-level review. Its repair rounds have escalation and stopping rules; the workflow is not an unlimited promise of zero findings.^[27]

gstack's September 15 changelog ties review freshness to content captured before and after the review. It also explicitly says completion remains reviewer-reported, not proof that the model read every relevant file.^[28] These mechanisms make recorded progress more inspectable, but the acceptance criteria and reviewer judgment still matter.

Compound Engineering makes a different artifact central: reusable findings in docs/solutions/, which later planning reads. Its experimental Compound Packs extend this toward shared rules across repositories. That is a useful option when recurring mistakes and lost team knowledge are the main problem.^[7]

Personas, Independent Workers, and Enforcement

A named role is not necessarily a separate agent. BMAD's Party Mode defaults to one model voicing several personas. Its subagent mode uses independent agents, and persistent agent-team discussion is Claude Code-specific. The documentation explicitly distinguishes a debate from verified, ranked code-review findings.^[29] Superpowers' implementation workflow instead assigns work and review through the host's subagent facilities; the actual host remains part of the system being evaluated.^[27]

Unattended execution also has a scope. BMAD's bmad-build-auto owns one session-sized implementation unit, requires subagents, and records a result. It does not select the next story or coordinate the backlog; the optional bmad-loop scheduler or another orchestrator supplies that policy. The worker commits without pushing.^[30] That distinction matters when choosing between a development method and a team execution platform.

Finally, an instruction, a hook, and an operating-system boundary provide different controls. For example, gstack's freeze hook blocks out-of-scope Edit and Write tool calls, but its documentation says Bash can still modify those files. This is useful protection against accidental scope expansion, not a sandbox.^[31] Evaluate the specific mechanism behind claims that a methodology “enforces” its workflow.

A Concrete Workflow to Compare

Consider an existing application that needs an account export feature. The following is an illustrative evaluation design, not a test performed for this report. Give each candidate the same requirements: preserve authorization and filters, define behavior for an empty result, validate the exported content, and leave evidence another developer can review.

The workflow artifacts above follow the documented methods; the acceptance questions are this report's suggested test criteria.^{[27][4][5][6][8][7][9]} Compare the result against the same task performed with the team's existing process. More documents or reviewer turns are useful only when they improve the evidence or outcome.

Do Skills Improve Agent Performance?

Published results support testing the trigger and the content separately. In Vercel's January 27, 2026 Next.js 16 evaluation, an 8 KB documentation index in AGENTS.md reached a reported 100% pass rate, compared with 79% for explicitly triggered skills and 53% for both the default skill and no-documentation baseline. The skill was never invoked in 56% of the default cases. This is a vendor-run framework-knowledge evaluation, not a benchmark ranking the development methods in this report.^[32]

A February 12, 2026 ETH Zurich/LogicStar paper studied generated context on SWE-bench Lite and developer-written context on AGENTbench: 138 tasks across 12 Python repositories, not 138 repositories. Generated context tended to reduce task success and increase cost; human-written context modestly improved results overall, with variation by agent. These were repository instruction files, not evaluations of the current framework releases.^[33]

The practical inference is narrower than “skills win” or “instructions hurt”: measure whether the agent loads the relevant guidance, follows it correctly, and produces a better result for its cost. Vercel's separate product-design write-up provides a concrete operating pattern: repository guidance selects a focused skill, references hold detailed rules and examples, and clear mechanical rules move into lint checks. Its copywriting evaluation is explicitly narrower than the full product-design workflow.^[34]

Costs, Licensing, and Portability

The file format does not grant rights to the content. Anthropic's document skills carry different terms from its Apache-licensed examples; OpenAI's legacy catalog points to individual skill licenses; Tech Leads Club distinguishes its MIT software engine, CC-BY-4.0 maintainer-authored skills, and retained third-party licenses.^{[11][12][2][17]} Check the particular package before redistributing it internally or commercially.

A downloadable workflow also does not include the underlying agent's model usage. Tool selection should account for repeated planning, parallel reviewers, browser execution, and operational maintenance. The installation instructions for Superpowers and gstack require a supported host; gstack's outside reviews require the other client and authentication.^[35][36]

For a concrete hosted-service example, Tessl lists a free single-workspace tier with 1,000 monthly credits and Team at $100/month with 5,000 credits, checked September 15, 2026. Publishing and installing skills is free; reviews, evaluations, and agent sessions consume credits, with model choice affecting consumption. Team is monthly pay-as-you-go, while Enterprise uses a quoted platform fee and annual credit terms.^[37] These are usage allowances, not a flat price for unlimited agent work.

Portability has several independent checks: file discovery, invocation, script dependencies, tool names, permissions, hooks, and subagent availability. The specification marks allowed-tools experimental; wshobson's host matrix and Vercel's CLI matrix document different emitted components and runtime support. A successful file installation is only the first check.^[1][14][16]

Security Findings in Context

Snyk's February 5, 2026 ToxicSkills report counted 1,467 skills with at least one security issue, and separately reported 76 confirmed malicious payloads. The larger number is not the count of confirmed malware, nor is it a prompt-injection prevalence estimate. Its introduction describes ClawHub and skills.sh, while the detailed results identify the 3,984-skill corpus as ClawHub and report a separate top-100 skills.sh sample. These results should not become a current probability that any arbitrary marketplace skill is malicious.^[38]

The practical response is to review the package, executable dependencies, permission scope, update provenance, and output on a representative task. Curated distribution, a successful scan, and process instructions answer different questions. None alone demonstrates that the agent's filesystem or network access is isolated.

First-Hand Experience and Its Limits

In a June 11, 2026 Superpowers issue, user sstoehrm described three small applications built with version 5.1.0. Reviews caught concrete problems, including a vacuous test and a deserialization gap, while planning took longer than executing the resulting plan. That supports testing both defect detection and process cost; it is not a benchmark of the current release.^[39]

For gstack, YogiAdhik's September 6 report described cross-project browser interference under version 1.80.0.0. The September 15 changelog records a targeted fix and explicitly limits the other browser cases its tests establish. The lesson is to evaluate the supporting executable tools alongside the Markdown workflow.^[40][28]

Adjacent Tools and Departed Catalogs

These links remain useful context but are not members of the 15-tool comparison:

Where Tembo Fits

Tembo addresses where and how teams run coding agents. Its current platform offers cloud or self-hosted execution, shared/resumable sessions, background work from integrations, and centralized operational visibility. It advertises reuse of existing repository instructions and agent configurations.^[48] Disclosure: Ry Walker is Tembo's CEO and co-founder.

That makes Tembo a relevant complement when a chosen skill method needs to move beyond an individual laptop into repeatable team execution. It is not included in the framework matrices because this page's membership test is a development method, skill catalog, or skill-distribution service. The tradeoff is a separate platform and deployment decision: validate the chosen host, dependencies, permissions, and workflow in that environment. This review did not verify integrations between Tembo and each named framework.

Choosing a Starting Point

• For test-and-review discipline: evaluate Superpowers on one bounded change and one architectural change; compare review findings and process overhead.
• For specification artifacts: compare Spec Kit and OpenSpec on an existing-project change, including how each handles revised requirements.
• For scope-dependent planning: evaluate BMAD's current Build flow rather than assuming its older persona and story workflow is mandatory.
• For product and browser work: include gstack; inspect exactly which commands can fix, push, merge, or deploy.
• For reusable organizational learning: evaluate Compound Engineering's recorded solutions, and Tessl if inventory and skill evaluations are also needed.
• For a targeted capability: start with the relevant catalog entry and its license, rather than installing a whole marketplace.
• For shared execution: assess Tembo alongside the selected methodology, with a representative task demonstrating the complete environment and review path.

These recommendations follow the documented distinctions above. A useful trial records task success, meaningful defects found, human interventions, elapsed time, and total agent usage. Keep the process only where its evidence improves delivery.

---

Research by Ry Walker • methodology