Inside T3CHS
Agent Skills by Clickflame
An agent skill is a short guide an AI coding agent reads before it does a job. Clickflame, our sister company, wrote four and shares them for free. Below them are public skills we checked and trust.
In Short
- A skill is a folder with a SKILL.md file. The agent reads it when a task matches.
- Clickflame's four skills cover Supabase, PostgREST, Netlify and AI front desks.
- Each one came from real problems in production, not from theory.
- Every skill we feature has an open source license and a recent update.
Clickflame is our sister company. It wrote these four skills and shares them for free under the MIT license.
What Is an Agent Skill?
An AI coding agent, like Claude Code, is good at general work. It does not know the traps in your stack. A skill fixes that.
A skill is a folder with a SKILL.md file in it. The top of the file says when to use it. The rest is the know how: what to check, what to run, and what good looks like. Some skills also ship a script or a SQL file.
The agent only loads a skill when a task calls for it. So you can install many skills and the agent stays fast.
Skills are plain text you can read. Read one before you install it, the same way you would read a script before you run it.
Clickflame's Four Skills
Each skill came out of a problem that looked fine on the surface and was not. Each post says what the skill is for, how it was made, what it checks and how to install it.
ClickflameMIT
Supabase RLS Audit
Checks whether row level security in a Supabase or Postgres database really protects anything, or only looks like it does.
ClickflameMIT
PostgREST Silent Failures
Finds the bugs in Supabase and PostgREST apps that return success and do nothing.
ClickflameMIT
Netlify Deploy Traps
Finds the Netlify failures where the deploy says Published and the site is still wrong.
ClickflameMIT
AI Front Desk
Helps build a bot that answers texts, calls and chat without embarrassing the business it speaks for.
How to Install a Skill
Most agents that support skills can add one with a single command. This adds all four Clickflame skills:
npx skills add halltony85-source/clickflame-agent-skills -g -yTo add just one, put its name after an @ sign:
npx skills add halltony85-source/clickflame-agent-skills@supabase-rls-audit -g -yYou can also copy a skill folder by hand into your agent's skills folder. Then start a new session so the agent can see it. Each post below has the command for that skill.
Featured Skills We Trust
These public skills come from the companies that make the tools, or from well known maintainers. They fit the work our team does: websites, search, Supabase, Cloudflare, access, speed, security, testing and design. We checked each one on GitHub on September 27, 2026. We did not write them, and nobody paid to be here.
Websites and SEO
Addy OsmaniMIT
seo
Technical SEO checks based on Lighthouse and Google Search guidance. It says not to promise rankings.
Why we trust it: MIT license, published by Addy Osmani. Last change August 24, 2026. No tests or CI in the repo, so we read it by hand.
Addy OsmaniMIT
web-quality-audit
One audit across speed, access, SEO and best practices, backed by live browser checks.
Why we trust it: MIT license, published by Addy Osmani. Last change August 24, 2026. No CI. Its helper script only reads local HTML files and makes no network calls.
Web Accessibility
Addy OsmaniMIT
accessibility
WCAG 2.2 checks with fixes, from color contrast to keyboard use and screen readers.
Why we trust it: MIT license, published by Addy Osmani. Last change August 24, 2026. No tests or CI in the repo, so we read it by hand.
Performance and Core Web Vitals
Addy OsmaniMIT
core-web-vitals
Finds and fixes LCP, INP and CLS problems, using field data first.
Why we trust it: MIT license, published by Addy Osmani. Last change August 24, 2026. No tests or CI in the repo, so we read it by hand.
CloudflareApache 2.0
web-perf
Speed audits that tell the agent to look up current numbers at the source, not from memory.
Why we trust it: Apache 2.0 license, published by Cloudflare. Last change September 5, 2026. CI runs a Semgrep security scan on every change.
Supabase and Postgres
SupabaseMIT
supabase-postgres-best-practices
Postgres rules for schema, indexes, RLS and slow queries, ranked by impact.
Why we trust it: MIT license, published by Supabase. Last change July 30, 2026. CI runs sanity tests that install each skill on every change.
SupabaseMIT
supabase
The general Supabase skill for auth, database, storage, functions and the CLI. It says to check current docs first.
Why we trust it: MIT license, published by Supabase. Last change September 24, 2026. CI runs sanity tests that install each skill on every change.
Cloudflare
CloudflareApache 2.0
workers-best-practices
How to write and review Workers, checked against Cloudflare's own docs.
Why we trust it: Apache 2.0 license, published by Cloudflare. Last change September 5, 2026. CI runs a Semgrep security scan on every change.
CloudflareApache 2.0
wrangler
How to run and fix Wrangler commands for local work, previews and deploys.
Why we trust it: Apache 2.0 license, published by Cloudflare. Last change September 22, 2026. CI runs a Semgrep security scan on every change.
Security Review
SentryApache 2.0
find-bugs
Reviews the changes on a branch for bugs and security holes, one step at a time.
Why we trust it: Apache 2.0 license, published by Sentry. Last change April 19, 2026. The repo ships evals for some of its skills, not this one. No CI.
SentryApache 2.0
skill-scanner
Scans a skill for prompt injection, risky scripts and leaked secrets before you install it.
Why we trust it: Apache 2.0 license, published by Sentry. Last change May 9, 2026. Its scanner is static analysis and runs locally. It needs the uv tool. No CI.
Testing
AnthropicApache 2.0
webapp-testing
Tests local web apps with Playwright scripts, screenshots and browser logs.
Why we trust it: Apache 2.0 license, published by Anthropic. Last change April 20, 2026. No CI in the repo. Its helper script only starts and stops your local servers.
AnthropicApache 2.0
skill-creator
Helps you write a new skill, then test it with evals and benchmarks.
Why we trust it: Apache 2.0 license, published by Anthropic. Last change April 20, 2026. Ships its own eval and benchmark scripts.
Front End Design
AnthropicApache 2.0
frontend-design
Pushes the agent toward a clear design choice for your subject, not a stock template.
Why we trust it: Apache 2.0 license, published by Anthropic. Last change September 3, 2026. No CI in the repo. It is text only, with no scripts.
How We Vet a Skill
Every skill on this page had to pass all of these checks.
- It comes from the company that makes the tool, or from a well known maintainer.
- It has an open source license approved by the OSI, such as MIT or Apache 2.0.
- Its folder changed in the last six months.
- No install script fetches code from the web and runs it.
- Its docs say clearly when to use it and what it does.
- It shows signs of testing, like evals, tests or CI, where we could find them.
We leave out skills that fail any check. One skill we looked at pulls its rules from a web page each time it runs. Another uses reference text under a Creative Commons license, which is not an open source license. Neither made the list. We check again before we add or keep a skill.
Common Questions
What is an agent skill?
A folder with a SKILL.md file that tells an AI coding agent how to do one kind of job well. The agent reads it only when a task matches.
Are Clickflame's skills free?
Yes. They are on GitHub under the MIT license. You can use them, change them and share them.
Who is Clickflame?
Clickflame is our sister company. It builds and runs software for local service businesses. It wrote these skills from what it ran into in production.
Do they replace the official Supabase skills?
No. Clickflame says to install both. The Supabase skills teach you to build well. Clickflame's skills assume something is already live and wrong, and help you find it.
Is it safe to install a skill?
A skill is mostly text, but some ship scripts. Read the SKILL.md and any scripts first, and only use skills from people you trust. Our vetting list shows what we check.
Why are some skills on this page not from Clickflame?
No one skill set covers everything our team builds. So we list public skills from the makers of the tools we use, after we check each one. Nobody paid to be listed.