$ show zhuyansen/agent-skills-hub
AgentSkillsHub is a production-grade web application that indexes, grades, and surfaces open-source AI agent skills, MCP servers, and Claude/Codex skills. It operates as a full-stack directory with a trust-layer differentiator: each skill receives a deterministic security grade (SAFE/CAUTION/UNSAFE/REJECT) from a rule-based scanner (35 patterns across 11 categories) and a composite quality score (10 signals). The system is architected as a FastAPI monolith (backend) with a React SPA frontend pre-rendered for SEO via 13+ build-time generators, backed by Supabase (PostgreSQL) and triggered by GitHub Actions every 8 hours. It ingests data from the GitHUB Search API through a 6-phase pipeline (search → metadata → README fetch → scoring → classification → composability), then serves the catalog via static HTML pages, REST API endpoints, an MCP server, and a CLI tool. Monetization includes a Pro tier with paid deep search, a $49 deep-audit per skill, and enterprise subscriptions. The codebase also produces original research: a published dataset of 130k+ graded skills, an arXiv paper on security distributions, a 12-chapter Blue Book, and extensive SEO/GEO strategy documents. Despite its hybrid nature (both a software application and a data research project), the dominant character is application because the running web service is primary; the research outputs are byproducts of the operational pipeline.
The LLM identified 4 files worth highlighting for reuse:
Implements a 35-pattern rule-based security scanner for AI agent skills. Includes trust tiers, download-destination-aware pipe-to-shell detection, and a 5-tier grade output (SAFE/CAUTION/UNSAFE/REJECT/UNKNON). The scanner is deterministic, operates without external API dependencies, and can be extracted into any Python project needing to evaluate code execution risk in user-submitted content. The pattern of separating detection rules from the scanner driver is clean and reusable.
Computes compatibility scores between skills using TF-IDF vector similarity and eight supplementary signals (e.g., topic co-ocurence, category overlap, star-tier match). This pattern is directly reusable for any recommender system that needs to score pairwise item similarity from text metadata. The algorithm is self-contained, uses scikit-learn for vectorization, and is parameterized for easy adaptation.
Provides a suite of functions for cleaning and normalizing GitHub metadata: field mapping (e.g., category detection from topics/language), classification (project type detection: library, template, demo, etc.), and deduplication (owner/name case normalization, renamed-repo detection). This module encapsulates recurring data quality patterns that any GitHUB-sourced project would need and exposes them as stateless functions.
A React hok that provides cache-first data fetching with background revalidation. It reads from localStorage cache, returns stale data immediately, and then fetches fresh data in the background, updating both the component and the cache. This pattern is reusable in any React app that wants offline-first performance and eventual consistency without a full state management libray. The hok has no external dependencies beyond React and the API client.