Every source the bootstrap prompt may install. Each is maintained by the vendor of the platform it covers and pinned to a release, a commit or Anthropic’s official marketplace, except Devbook’s own skills, which track main. The list comes from catalog/sources.json, the same file the prompt is built from, in the same groups.
- Installable
- 13 sources
- Per repository
- 3 optional at most
- Drift check
- Weekly pull request
- Last verified
- 3 Nov 2026
free Hooks or a language server: doesn’t use one of your 3 slots. Everything else uses one.
Always on
Claude Code; doesn’t count toward the cap
| Source | Use | Agents | Pinned to |
|---|---|---|---|
| Security guidanceanthropics/claude-plugins-official | Pattern-based security warnings on edits, as hooks | Claude Code | officialfree |
| Language server pluginanthropics/claude-plugins-official | Diagnostics and code navigation for the main language, only when its language server binary is on PATH: pyright-lsp, typescript-lsp, swift-lsp, gopls-lsp or rust-analyzer-lsp | Claude Code | officialfree |
Your stack
Only when phase 1 detects it
| Source | Use | Agents | Pinned to |
|---|---|---|---|
| Cloudflare skillscloudflare/skills | Workers, Durable Objects, Wrangler, web performance; bundles the Cloudflare docs MCP | Claude Code, others | 1a33048 |
| React best practicesvercel-labs/agent-skills | React and Next.js performance and composition; keep any AGENTS.md block Next.js writes itself | Claude Code, others | 1a2c79d |
| Supabase skillssupabase/agent-skills | Supabase and Postgres best practices | Claude Code, others | v0.1.9 |
| Expo skillsexpo/skills | Building, upgrading and debugging Expo and React Native apps | Claude Code, others | a9e5bd3 |
| Stripe pluginstripe/ai | Stripe integration best practices | Claude Code | official |
| Astral (uv, ruff)astral-sh/claude-code-plugins | Python projects with uv and ruff | Claude Code | f3ce88a |
Ways of working
Opt-in
| Source | Use | Agents | Pinned to |
|---|---|---|---|
| Superpowersobra/superpowers | Test-driven development, verification before completion, systematic debugging and planning; opt-in, because it is heavy for small edits, and some of its steps commit or offer to push, which the core block leaves to the user | Claude Code, others | v7.0.1 |
| Frontend designanthropics/skills | Distinctive, production-grade UI | Claude Code, others | ca45fc4 |
| Trail of Bits skillstrailofbits/skills | Security audits on request (static analysis, differential review, insecure defaults); link to it, never vendor modified copies (CC BY-SA) | Claude Code | 711af09 |
Docs
Optional; ask first
| Source | Use | Agents | Pinned to |
|---|---|---|---|
| Context7 docs MCPupstash/context7 | Version-matched library docs when the vendor has no docs MCP of its own; ask first, because CLIs cost less context | Claude Code | official |
From Devbook
Only where no vendor maintains one
| Source | Use | Agents | Pinned to |
|---|---|---|---|
| Devbook optional skillsnitinraturi/devbook.raturi.in | Domain skills with no maintained equivalent: api-design, db-migration, feature-doc, licensing, llm-security | Claude Code, others | main, not pinned |
Suggested, never installed
- Django AI plugins (Vinta)
The repository has no licence, and it is maintained by an agency, not the Django Software Foundation.
- Astro docs MCP
Not updated since October 2025 and reported intermittent; no official Astro skill exists.
Retired
- Web design guidelines
At its pinned ref it fetches its rules at run time from an unpinned raw.githubusercontent.com URL on main, so pinning it pins nothing; the prompt rejects remote instructions.
- Vercel plugin
It manages deployments, which Devbook stays out of; use react-best-practices for code quality.
How a source gets in, and out
Section titled “How a source gets in, and out”A source gets in when its vendor maintains it, it covers code quality for a common stack, and it doesn’t touch deploys or CI. “Official” means Anthropic’s claude-plugins-official, which pins the third-party plugins it lists and updates them automatically; the prompt reads every other source in full at its pinned ref before it installs it. An automated check opens a pull request each week for every source with a new release or commit, and the maintainer reads the upstream diff before merging. A source is retired when its vendor drops it, when it takes over deploys, when it fetches instructions at run time, or when the measured evals show it no longer helps.