David Ondrej's Open-Source Agent Skills Repo

There's a particular kind of GitHub repo that goes viral not because it's flashy, but because it solves a problem everyone has but nobody named yet. David Ondrej's agent skills repository appears to be one of those. A few weeks after he open-sourced it, the repo blew up on Twitter—Morgan Linton, co-founder of Hermes Agent, was among those who responded publicly—and it quickly became Ondrej's most-starred project.

The premise is deceptively simple: agent skills are markdown files that give AI agents structured context on demand, without bloating your main system prompt. Load them only when relevant. Teach once, reuse forever. If that sounds familiar, it's because the markdown files that teach once pattern has been gaining traction across the agentic tooling space—but Ondrej's repo is notable for the breadth and specificity of what he's actually shipping.

In a 30-minute walkthrough, he covers eight of his favorites. What follows is what I found genuinely interesting about them—and where the approach raises questions worth sitting with.

The safety layer nobody builds first

Ondrej opens with global agent guardrails, and the sequencing is intentional. "If you're running AI agents in Yolo mode and you don't have the global agent guardrails configured," he says flatly, "you are making a big mistake."

"Yolo mode" here means running agents with auto-approval enabled—no human confirmation required for each command. It's the only practical way to run multi-agent systems at any real scale, he argues, but it opens the door to catastrophic mistakes: agents wiping production databases, recursively deleting system directories, piping untrusted content from the internet directly into a shell.

The guardrails skill doesn't just add a warning to the system prompt and hope. It installs a pre-tool-call hook—a shell script that intercepts every command before execution and blocks anything matching a list of dangerous patterns: rm aimed at root, fork bombs, rewrites of remote Git history, destruction of the reflog. The list is specific and battle-tested. You can delete node_modules recursively because that's routine; you cannot delete your entire home directory.

The distinction Ondrej draws is worth underscoring: instructions in a system prompt can be ignored or misinterpreted by an agent. A hook that runs at the shell level cannot be. The enforcement is architectural, not aspirational. The security tradeoffs in Agent Zero's skills feature cover adjacent ground here—what's notable is that Ondrej bakes safety infrastructure into the skills layer rather than treating it as a separate concern.

Parallel agents and the worktree problem

The Git worktree skill addresses something that only becomes a problem once you're running multiple agents simultaneously on the same repository. Which, increasingly, people are.

The issue is simple: two agents editing the same file at the same time produces chaos. Ondrej's worktree skill instructs agents to clone the repo into an isolated directory on a separate Git branch before beginning work. Each agent operates in its own sandbox. Environment files get copied over so the agent has everything it needs to function. When the work is done, the worktree is removed.

None of this is technically new—Git worktrees have existed for years. What's new is encoding the best practice into a skill so agents adopt it automatically rather than requiring a human to remember and specify the setup every single time.

VPS management as orchestration

This is where the walkthrough gets interesting from an infrastructure standpoint. Ondrej runs multiple AI agents on separate VPS instances—different agents for different purposes, each isolated from the others. The VPS management skill lets a local agent (say, Codex running on his laptop) SSH into any of those remote machines to recover a crashed agent, update a model, or check on a running process.

The pitch is that your fleet of agents becomes manageable through a single interface rather than requiring you to log into each machine manually. Whether this is a practical setup for most developers or a power-user configuration that assumes significant existing infrastructure is a real question—it's clearly designed for someone already running several persistent agents, not someone spinning up their first one.

Worth noting: this section includes a sponsored Hostinger integration. The VPS recommendation is genuinely relevant to the workflow being described, but readers should register that Ondrej has a commercial relationship with the provider he recommends.

Goal loops and structured delegation

The goal loop skill is arguably the most broadly useful of the eight. The core insight is that the /goal command in tools like Claude Code and Codex only delivers its full value when given a verifiable end condition—a specific number, a defined output format, a clear terminus. "Build this feature" is a weak prompt for a goal loop. "Find the 50 highest-earning real estate agents in Florida with at least two forms of contact for each" gives the agent a mountain to move and a flag to plant when it reaches the top.

Ondrej demonstrates this live: a two-sentence plain-English instruction gets handed to Claude Code along with the goal loop skill, and the agent returns a structured, detailed prompt—complete with output format, methodology, and stopping conditions—in seconds. "This would take me 5 plus minutes to write," he notes. "But hey, now it's written."

The skill essentially encodes the art of writing good goal prompts so that the agent writes good goal prompts for you. There's something almost recursive about it that I find genuinely clever—and also a little unsettling in the way all good abstractions are, because it moves prompt engineering further from human hands. For more on how the underlying pattern works across different tools, effective agent skill design is worth reading alongside this.

Decisions: reviewing judgment, not code

The decisions skill is the one I keep thinking about. Ondrej credits Victor Talon with the original formulation—ask the model, after a large implementation: "While working on this, which choices did you make that you're not confident of? List all."

The problem with that exact prompt is that frontier models over-report under it. They list everything, including decisions where the answer is already clearly optimal. Ondrej's version adds a constraint: "Do not list out the choices or decisions where we already have the best possible solution. Only list out decisions that we are unsure about."

The framing shift this implies is significant. Ondrej is explicit about it: "Instead of reviewing the code, which really doesn't matter in Q3 of 2026, you need to review the decisions." His argument is that reviewing thousands of lines of generated code is neither practical nor particularly useful—what matters is whether the agent made the right choices at key architectural and implementation junctures. Those choices are what compound over time, for better or worse.

A companion skill, "next decision," presents those flagged choices one at a time with four options each, so the human reviewer can engage substantively rather than being overwhelmed by a list. The whole system is a kind of decision-auditing interface layered on top of code generation. Whether most developers will actually use it consistently is another question—but the underlying observation about where human judgment adds the most value feels right.

Anti-sleep and the ambient computing angle

The anti-sleep skill is genuinely minor in complexity—it wraps macOS's built-in caffeinate command into a reusable script so agents can prevent the machine from sleeping during long-running tasks. But Ondrej uses it as a launching pad for a point worth taking seriously: agents are useful for a much wider range of tasks than their branding suggests.

He demos asking an agent to open the exact macOS settings panel for screen sleep configuration rather than navigating there manually. It works in seconds. "You can use the agents for so much more, guys. It's not just coding." Converting files, navigating Finder, copying SQL to the clipboard during a migration, opening settings—these are small frictions that add up, and agents can absorb them.

The proprietary skill problem

The eighth skill is a notable outlier. The Deep API skill is built around Ondrej's own product—a unified API key that gives agents web scraping, deep research, email, image generation, and more through a single interface. The skill itself tells agents how to use Deep API's endpoints.

He's transparent about it not being publicly available yet (application-only at time of recording), and about his benchmarks against Perplexity and ChatGPT being his own. But it raises an interesting structural question about open-source skills repos: when a skill assumes a proprietary, paid service, how open is it really? The other seven skills in this walkthrough are genuinely portable—they encode practices, not dependencies. This one is a product funnel built into a public repo.

That's not inherently wrong. But it's worth knowing what you're looking at.

The broader argument Ondrej makes—that controlling agents well is going to be the differentiating skill in developer productivity—is one I've heard from enough different directions now that I take it seriously without treating it as settled. Google's progressive disclosure approach to agent skills is one answer to the same problem; Ondrej's markdown-skill library is another. They're not mutually exclusive, and the ecosystem is early enough that nobody knows which patterns will stick.

What Ondrej's repo represents is one practitioner's accumulated operational knowledge, externalized into a form that agents can read directly. The value of that depends entirely on whether the practices hold up under conditions other than his own. That's the thing about open source: the community gets to find out.

— Dev Kapoor, Open Source & Developer Communities Correspondent, Buzzrag