source-driven-development
An agent skill by addyosmani, from addyosmani/agent-skills. Tags: api, developer-tools, documents, web.
What it does
Grounds every implementation decision in official documentation. Use when you want to verify an approach against the official docs before implementing it, or when you want authoritative, source-cited code free from outdated patterns. Use when building with any framework or library where correctness matters.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add addyosmani/agent-skills --skill source-driven-developmentOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/addyosmani/agent-skills
cp -r agent-skills/skills/source-driven-development ~/.claude/skills/source-driven-developmentSafety box score
Grade B, low risk: 16 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This is a documentation/research skill, not a code runner: it reads project dependency manifests to detect versions and fetches official docs to ground implementation choices. The main exposure is outbound network access to doc sites and the fact that it will ingest untrusted web content, which creates a prompt-injection surface even though the skill tells the agent to ignore such directives.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | No shell commands, code execution, or shipped scripts are included; the skill only instructs the agent to read manifests and fetch documentation. |
| Network access | 2 (moderate) | Step 2 explicitly says to "Fetch the specific documentation page" and may also use compatibility sources like MDN or caniuse, so the agent will make outbound requests to third-party hosts. |
| Filesystem reach | 1 (low) | It asks the agent to read dependency files such as `package.json`, `composer.json`, `pyproject.toml`, and `go.mod`, but it does not write or delete files outside the project. |
| Secrets & credentials | 0 (none) | There is no instruction to access tokens, passwords, key files, `.env` files, browser sessions, or logins. |
| Privilege & persistence | 0 (none) | No sudo, global installs, services, scheduled tasks, or OS/shell configuration changes are requested. |
| Instruction hijack surface | 1 (low) | The workflow intentionally processes fetched docs as untrusted input and warns about directives like "ignore previous instructions"; that is a prompt-injection surface, though the skill tells the agent to ignore such content. |
| Irreversible actions | 0 (none) | It does not push, deploy, publish, message, pay, book, or delete anything; it only verifies sources and surfaces conflicts. |
| Transparency | 0 (none) | The file is plain markdown with no binaries, encoded blobs, or uninspectable installers. |
Before installing
- Confirm outbound HTTP is acceptable to the official doc domains this skill will contact.
- Make sure the agent may read dependency manifests in the repository to detect versions.
- Verify you are comfortable with the agent ignoring instructions embedded in fetched documentation pages.
Rated 2026-10-19 by an automated review of 1 file from the skill's repository.
Source
- Repository
- addyosmani/agent-skills (all skills from this repository)
- Path
- skills/source-driven-development/SKILL.md
- Branch
- main
- Updated
- 2026-09-19
Related skills
- code-documenter — Generates, formats, and validates technical documentation — including docstrings, OpenAPI/Swagger specs, JSDoc annotations, doc portals, and user guides.
- api-and-interface-design — Guides stable API and interface design. Use when designing APIs, module boundaries, or any public interface.
- debugging-and-error-recovery — Guides systematic root-cause debugging.
- deprecation-and-migration — Manages deprecation and migration. Use when removing old systems, APIs, or features. Use when migrating users from one implementation to another.
- documentation-and-adrs — Records decisions and documentation.
- observability-and-instrumentation — Instruments code so production behavior is visible and diagnosable. Use when adding logging, metrics, tracing, or alerting.