feat(claude): add skill installer script - #579
Conversation
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. 📝 WalkthroughSummary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughAdds a new Bash installer at Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
🧹 Recent nitpick comments
📜 Recent review detailsConfiguration used: Organization UI Review profile: CHILL Plan: Pro Disabled knowledge base sources:
📒 Files selected for processing (3)
🧰 Additional context used📓 Path-based instructions (3)**/*.{sh,bash}📄 CodeRabbit inference engine (CLAUDE.md)
Files:
**/*.nix📄 CodeRabbit inference engine (CLAUDE.md)
Files:
**/default.nix📄 CodeRabbit inference engine (CLAUDE.md)
Files:
🧠 Learnings (3)📚 Learning: 2025-11-25T09:34:55.014ZApplied to files:
📚 Learning: 2025-11-25T09:34:55.014ZApplied to files:
📚 Learning: 2025-11-25T09:34:32.423ZApplied to files:
🧬 Code graph analysis (1)spec/install_skills_spec.sh (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (14)
🔇 Additional comments (6)
✏️ Tip: You can disable this entire section by setting Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @shunkakinoki, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a new utility script, Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Mesa DescriptionTL;DRAdds a script to install Claude Code agent skills from external repositories using the What changed?
Description generated by Mesa. Update settings |
Add install-skills.sh to install agent skills from external repositories. Uses npx add-skill CLI (https://agentskills.io) to install: - vercel-react-best-practices: 40+ React/Next.js performance rules - web-design-guidelines: UI/UX best practices Run: ./config/claude/install-skills.sh
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new shell script, install-skills.sh, to install agent skills for Claude Code from external repositories. The script is straightforward and uses npx add-skill to perform the installation. My review focuses on improving the script's robustness, security, and clarity. I've suggested adding a dependency check for npx, pinning the version of the add-skill package to enhance security and ensure reproducible builds, and a minor correction to the final output message for better accuracy. These changes will make the script more reliable and secure.
|
|
||
| # Install Vercel agent-skills (React best practices + Web design guidelines) | ||
| # https://github.com/vercel-labs/agent-skills | ||
| npx add-skill vercel-labs/agent-skills \ |
There was a problem hiding this comment.
For security and reproducibility, it's highly recommended to pin the version of the npm package being executed with npx. Using npx add-skill without a version specifier will always fetch the latest version. This could unexpectedly introduce breaking changes or even security vulnerabilities if the package is compromised (a supply chain attack). Pinning to a specific version ensures that the script's behavior is consistent and secure over time. Please find the current stable version of add-skill and specify it.
| npx add-skill vercel-labs/agent-skills \ | |
| npx add-skill@<version> vercel-labs/agent-skills \ |
|
|
||
| set -euo pipefail | ||
|
|
||
| echo "Installing agent skills..." |
There was a problem hiding this comment.
The script executes npx without first checking if it's available. If npx is not installed or not in the PATH, the script will fail with a generic 'command not found' error. It's better practice to add an explicit check for dependencies at the start of a script to provide a more user-friendly error message.
| echo "Installing agent skills..." | |
| if ! command -v npx &> /dev/null; then | |
| echo "Error: npx could not be found. Please install Node.js." >&2 | |
| exit 1 | |
| fi | |
| echo "Installing agent skills..." |
| --skill web-design-guidelines \ | ||
| --yes | ||
|
|
||
| echo "Done! Skills installed to ~/.claude/skills/" |
There was a problem hiding this comment.
The tilde ~ character is not expanded to the user's home directory when it is inside double quotes. This means the output will literally be Done! Skills installed to ~/.claude/skills/. While users will likely understand this, using the $HOME environment variable is more explicit and guarantees correct expansion by the shell, making the output message more accurate.
| echo "Done! Skills installed to ~/.claude/skills/" | |
| echo "Done! Skills installed to $HOME/.claude/skills/" |
There was a problem hiding this comment.
Pull request overview
This PR adds a bash script to install Claude Code agent skills from the Vercel agent-skills repository using the add-skill CLI tool. The script automates the installation of React best practices and web design guidelines skills to enhance Claude Code's capabilities.
Changes:
- Added
config/claude/install-skills.shscript that usesnpx add-skillto install two skills from vercel-labs/agent-skills repository
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| npx add-skill vercel-labs/agent-skills \ | ||
| --agent claude-code \ | ||
| --skill vercel-react-best-practices \ | ||
| --skill web-design-guidelines \ | ||
| --yes |
There was a problem hiding this comment.
The script should verify that Node.js/npx is available before attempting to use it. Other scripts in this repository check for required commands using 'command -v'. Add a check like 'if ! command -v npx >/dev/null 2>&1; then echo "Error: npx is required but not installed"; exit 1; fi' before the npx command.
| @@ -0,0 +1,18 @@ | |||
| #!/usr/bin/env bash | |||
There was a problem hiding this comment.
This script lacks test coverage. The repository has comprehensive bash script testing using shellspec (see spec/ directory), and all other scripts in config/claude/ have corresponding spec files. Create spec/install_skills_spec.sh following the pattern used in spec/notify_spec.sh, spec/security_spec.sh, etc. Additionally, update spec/coverage_spec.sh to include 'config/claude/install-skills.sh' in the covered_scripts list (around line 96).
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![mesa-dot-dev[bot]](https://avatars.githubusercontent.com/in/1050077?s=60&v=4){kind=small}
There was a problem hiding this comment.
Performed full review of b699cf0...8008ef8
Analysis
-
The
install-skills.shscript bypasses the repository's core Nix/home-manager architecture, introducing an inconsistent, manual installation pathway that breaks reproducibility and automated workflows. -
Security concerns arise from using unpinned
npxexecutions to fetch and run arbitrary code from the network without integrity verification, outside of Nix's sandbox protections. -
The script lacks idempotency checks, version pinning, and proper dependency management, making it impossible to guarantee consistent environments across installations.
-
There's no integration with existing patterns (home-manager activation or wrapper scripts with auto-install), creating maintenance confusion and diverging from established repository practices.
-
The implementation offers no configuration layer, update mechanism, or clear documentation about its lifecycle and intended usage pattern.
Tip
Help
Slash Commands:
/review- Request a full code review/review latest- Review only changes since the last review/describe- Generate PR description. This will update the PR body or issue comment depending on your configuration/help- Get help with Mesa commands and configuration options
0 files reviewed | 4 comments | Edit Agent Settings • Read Docs
|
|
||
| # Install Vercel agent-skills (React best practices + Web design guidelines) | ||
| # https://github.com/vercel-labs/agent-skills | ||
| npx add-skill vercel-labs/agent-skills \ |
There was a problem hiding this comment.
No version or commit hash specified for vercel-labs/agent-skills. This means the script will always pull the latest version, which could introduce breaking changes or inconsistencies across machines. For reproducibility, consider:
- Pinning to a specific commit:
vercel-labs/agent-skills@abc1234 - Pinning to a release tag:
vercel-labs/agent-skills@v1.0.0 - Or document that skills should be manually reviewed/updated
Agent: 🏛 Architecture •
Prompt for Agent
Task: Address review feedback left on GitHub.
Repository: shunkakinoki/dotfiles#579
File: config/claude/install-skills.sh#L12
Action: Open this file location in your editor, inspect the highlighted code, and resolve the issue described below.
Feedback:
No version or commit hash specified for `vercel-labs/agent-skills`. This means the script will always pull the latest version, which could introduce breaking changes or inconsistencies across machines. For reproducibility, consider:
1. Pinning to a specific commit: `vercel-labs/agent-skills@abc1234`
2. Pinning to a release tag: `vercel-labs/agent-skills@v1.0.0`
3. Or document that skills should be manually reviewed/updated
|
|
||
| # Install Vercel agent-skills (React best practices + Web design guidelines) | ||
| # https://github.com/vercel-labs/agent-skills | ||
| npx add-skill vercel-labs/agent-skills \ |
There was a problem hiding this comment.
No version pinning for the add-skill package. Each time this script runs, it could pull a different version of add-skill, potentially with breaking changes. Consider pinning to a specific version: npx add-skill@1.2.3 (replace with current stable version).
Agent: 🏛 Architecture •
Prompt for Agent
Task: Address review feedback left on GitHub.
Repository: shunkakinoki/dotfiles#579
File: config/claude/install-skills.sh#L12
Action: Open this file location in your editor, inspect the highlighted code, and resolve the issue described below.
Feedback:
No version pinning for the `add-skill` package. Each time this script runs, it could pull a different version of `add-skill`, potentially with breaking changes. Consider pinning to a specific version: `npx add-skill@1.2.3` (replace with current stable version).
|
|
||
| # Install Vercel agent-skills (React best practices + Web design guidelines) | ||
| # https://github.com/vercel-labs/agent-skills | ||
| npx add-skill vercel-labs/agent-skills \ |
There was a problem hiding this comment.
Using npx without a Nix-managed path creates a dependency on the system's Node.js installation. In this Nix-based repository, other scripts use path substitution (e.g., ${pkgs.nodejs}/bin/npx) to ensure reproducibility. Consider either:
- Adding this script to
config/claude/default.nixwithpkgs.replaceVarsto inject the Nix store path - Converting this to a home-manager activation script like
npm-globalsdoes
See home-manager/modules/npm-globals/install-npm-globals.sh for a similar pattern.
Agent: 🏛 Architecture •
Prompt for Agent
Task: Address review feedback left on GitHub.
Repository: shunkakinoki/dotfiles#579
File: config/claude/install-skills.sh#L12
Action: Open this file location in your editor, inspect the highlighted code, and resolve the issue described below.
Feedback:
Using `npx` without a Nix-managed path creates a dependency on the system's Node.js installation. In this Nix-based repository, other scripts use path substitution (e.g., `${pkgs.nodejs}/bin/npx`) to ensure reproducibility. Consider either:
1. Adding this script to `config/claude/default.nix` with `pkgs.replaceVars` to inject the Nix store path
2. Converting this to a home-manager activation script like `npm-globals` does
See `home-manager/modules/npm-globals/install-npm-globals.sh` for a similar pattern.
- Add spec/install_skills_spec.sh with 9 test cases - Update coverage_spec.sh to include new script - Add install-skills.sh to nix config (default.nix) All shell tests pass (326 examples, 0 failures)
Remove indentation to match repo style (treefmt)
Add `install-skills.sh` to install agent skills from external repositories using `add-skill` CLI.
Usage
```bash
./config/claude/install-skills.sh
```
Skills installed
From vercel-labs/agent-skills:
Skills are installed to `~/.claude/skills/` and automatically available to Claude Code.
Summary by cubic
Adds a script to install Claude Code agent skills from external repositories using the add-skill CLI. Installs React best practices and web design guidelines to ~/.claude/skills and makes them available in Claude Code.
Written for commit d82e7bd. Summary will update on new commits.