AgentSkillsHub is a production full-stack web application: a security-graded, quality-scored directory of 117,000+ open-source AI agent skills, MCP servers, and agent tools, served from a React/TypeScript SPA with a Python FastAPI service layer and Supabase/PostgreSQL backend. Every 8 hours a GitHub Actions sync pipeline searches GitHub, enriches repo metadata, fetches READMEs, cleans and deduplicates, applies an 8-9 dimension quality score, and grades security into safe/caution/unsafe/reject/unknown tiers via a heavily-tuned rule-based scanner with an optional LLM pass. The frontend exposes search, filtering, compare, favorites, i18n (zh/en), static pre-rendered SEO pages, an admin panel, monetized Pro search, enterprise audit lead capture, and a verified newsletter flow. The public API (FastAPI plus Supabase RPCs) backs the SPA, using request deduplication, aggressive column minimization, and materialized cache tables to survive the load. The repo is application-dominant but genuinely hybrid with data research. An ops/ engine room runs controlled benchmark harnesses (PPT, video, guard-hooks, code review, anti-slop, Obsidian, skill managers) that execute third-party skills in Docker sandboxes, capture transcripts, judge outputs with LLM models under majority voting against ground-truth fixtures, and publish public evidence pages. A radar subsystem monitors X, Hugging Face, the App Store, and social memes to discover emerging tool terms with cost-budgeted API calls. The security scanner rule history and adjudication datasets (reported Jev-judge AUC 0.916 against labeled flag instances) read like an ML calibration project, and the SEO research folder contains extensive keyword, SERP, and competitor studies. Reusable high points: the log-normalized scoring engine, the README security scanner with citation-vs-issue disambiguation, the keyset-paginated batch-commit ETL pattern, the paced idempotent backfill queue, the request-collapsing SPA data layer, and an OpenAI-compatible sandbox image proxy for benchmarking agent skills without leaking API keys. The core pipeline is professionally tested (20+ unit test files, mostly pure-logic tests that run without a database). Caveats: it is effectively a single-maintainer operation with hardcoded personal paths, an admin token seeded in a committed migration, duplicate backend/migrations and supabase/migrations that can drift, many one-off ops scripts with duplicated env-reading code, and future-dated 2026 content plus hardcoded fallback data that can confuse. Despite the sprawl, the engineering discipline around the scanner, batch processing, rate-limit resilience, and RLS-based database security is well above typical directory-site quality.