# Catalog

> Every skill, plugin and docs server the bootstrap prompt may install, pinned to a release or commit, plus the ones it only suggests and the ones it retired.

Every source the bootstrap prompt may install. Each is maintained by the vendor of the platform it covers and pinned to a release, a commit or Anthropic's official marketplace, except Devbook's own skills, which track `main`. The list comes from [`catalog/sources.json`](https://github.com/nitinraturi/devbook.raturi.in/blob/main/catalog/sources.json), the same file the prompt is built from, in the same groups.

- Installable: 13 sources

## Always on

Claude Code; doesn’t count toward the cap.

| Source | Use | Agents | Pinned to |
|---|---|---|---|
| [Security guidance](https://github.com/anthropics/claude-plugins-official) (`anthropics/claude-plugins-official`) | Pattern-based security warnings on edits, as hooks | Claude Code | `official` (free) |
| [Language server plugin](https://github.com/anthropics/claude-plugins-official) (`anthropics/claude-plugins-official`) | Diagnostics and code navigation for the main language, only when its language server binary is on PATH: pyright-lsp, typescript-lsp, swift-lsp, gopls-lsp or rust-analyzer-lsp | Claude Code | `official` (free) |

## Your stack

Only when phase 1 detects it.

| Source | Use | Agents | Pinned to |
|---|---|---|---|
| [Cloudflare skills](https://github.com/cloudflare/skills) (`cloudflare/skills`) | Workers, Durable Objects, Wrangler, web performance; bundles the Cloudflare docs MCP | Claude Code, others | `1a33048` |
| [React best practices](https://github.com/vercel-labs/agent-skills) (`vercel-labs/agent-skills`) | React and Next.js performance and composition; keep any AGENTS.md block Next.js writes itself | Claude Code, others | `1a2c79d` |
| [Supabase skills](https://github.com/supabase/agent-skills) (`supabase/agent-skills`) | Supabase and Postgres best practices | Claude Code, others | `v0.1.9` |
| [Expo skills](https://github.com/expo/skills) (`expo/skills`) | Building, upgrading and debugging Expo and React Native apps | Claude Code, others | `a9e5bd3` |
| [Stripe plugin](https://github.com/stripe/ai) (`stripe/ai`) | Stripe integration best practices | Claude Code | `official` |
| [Astral (uv, ruff)](https://github.com/astral-sh/claude-code-plugins) (`astral-sh/claude-code-plugins`) | Python projects with uv and ruff | Claude Code | `f3ce88a` |

## Ways of working

Opt-in.

| Source | Use | Agents | Pinned to |
|---|---|---|---|
| [Superpowers](https://github.com/obra/superpowers) (`obra/superpowers`) | Test-driven development, verification before completion, systematic debugging and planning; opt-in, because it is heavy for small edits, and some of its steps commit or offer to push, which the core block leaves to the user | Claude Code, others | `v7.0.1` |
| [Frontend design](https://github.com/anthropics/skills) (`anthropics/skills`) | Distinctive, production-grade UI | Claude Code, others | `ca45fc4` |
| [Trail of Bits skills](https://github.com/trailofbits/skills) (`trailofbits/skills`) | Security audits on request (static analysis, differential review, insecure defaults); link to it, never vendor modified copies (CC BY-SA) | Claude Code | `711af09` |

## Docs

Optional; ask first.

| Source | Use | Agents | Pinned to |
|---|---|---|---|
| [Context7 docs MCP](https://github.com/upstash/context7) (`upstash/context7`) | Version-matched library docs when the vendor has no docs MCP of its own; ask first, because CLIs cost less context | Claude Code | `official` |

## From Devbook

Only where no vendor maintains one.

| Source | Use | Agents | Pinned to |
|---|---|---|---|
| [Devbook optional skills](https://github.com/nitinraturi/devbook.raturi.in) (`nitinraturi/devbook.raturi.in`) | Domain skills with no maintained equivalent: api-design, db-migration, feature-doc, licensing, llm-security | Claude Code, others | `main, not pinned` |

## Suggested, never installed

- [Django AI plugins (Vinta)](https://github.com/vintasoftware/django-ai-plugins): The repository has no licence, and it is maintained by an agency, not the Django Software Foundation.
- [Astro docs MCP](https://github.com/withastro/docs-mcp): Not updated since October 2025 and reported intermittent; no official Astro skill exists.

## Retired

- [Web design guidelines](https://github.com/vercel-labs/agent-skills): At its pinned ref it fetches its rules at run time from an unpinned raw.githubusercontent.com URL on main, so pinning it pins nothing; the prompt rejects remote instructions.
- [Vercel plugin](https://github.com/vercel/vercel-plugin): It manages deployments, which Devbook stays out of; use react-best-practices for code quality.

Claude Code already has `/code-review`, `/security-review`, `/verify`, `/simplify`, so the catalog has no review skills.

## How a source gets in, and out

A source gets in when its vendor maintains it, it covers code quality for a common stack, and it doesn't touch deploys or CI. "Official" means Anthropic's `claude-plugins-official`, which pins the third-party plugins it lists and updates them automatically; the prompt reads every other source in full at its pinned ref before it installs it. An automated check opens a pull request each week for every source with a new release or commit, and the maintainer reads the upstream diff before merging. A source is retired when its vendor drops it, when it takes over deploys, when it fetches instructions at run time, or when the [measured evals](/evals/) show it no longer helps.