AAS 20 revises 2,042 AI skill bundles after catalog review
3-line summary
- AAS 20 revises 2,042 AI-agent skill bundles and publishes individual review records.
- Repairs cover credential disclosure, destructive commands and outdated technical instructions.
- The review records unread files and untested external workflows; completion is not safety certification.
Agentic Awesome Skills released version 20.0.0 on October 24 with a catalog-wide review and revisions to 2,042 skill bundles. Maintainers say the changes address unsafe commands, credential handling, unsupported claims and other instruction defects.
AAS distributes reusable SKILL.md playbooks for agents such as Codex and Claude. A bundle can contain the main instructions plus supporting resources. Its existing Core tooling lets an agent inspect the catalog, record an exact selection and preview changes to a target project before applying them. Core does not rank or recommend the skills.
Of 2,652 root bundles at integration, 2,042 were corrected, 322 retained and four removed; another 284 preserved earlier review records. The remaining 2,648 bundles contain 2,750 top-level and nested SKILL.md entrypoints.
One repair removed instructions in vibers-code-review that disclosed credentials through commit messages. The review also added boundaries around external disclosure, payments and feedback submission. In the text-cleanup skill unslop, instructions that used the same file for input and output were replaced with a separate-file review step to avoid destroying the original.
Other changes concern instruction priority and technical accuracy. The using-superpowers loading procedure now respects higher-level instructions, available tools and user constraints. Outdated cached-by-default fetch advice was removed from nextjs-best-practices. Its review explicitly says no Next application was built, and that behavior depends on the installed version and configuration.
The final batch also documents defects beyond security. The comfyui-gateway review removed claims about an application, Dockerfile and CLI that were not bundled. The canvas-design record reports corrections to fabricated earlier user feedback and instructions that overrode user constraints, rather than presenting those claims as verified context.
The records preserve inspection exceptions. In the final batch, 113 deleted files were explicitly unread. One MP3 was inspected through its hash and container metadata, without listening or transcription. Completing the catalog review did not mean exercising every external API, paid workflow, GPU job or native application.
Four bundles were removed following what maintainers described as restrictive-license reviews: xlsx-official, pdf-official, docx-official and pptx-official. The old docx and pptx alias links were removed too. The completion record binds file inventories to before-and-after SHA-256 hashes and Git modes, providing a way to identify the exact changed bytes.
Core’s structural and identity checks do not certify semantic fit, compatibility or safety to apply. The README keeps application and recovery behind experimental opt-in, separate from the supported preview. Existing installations pinned to an earlier catalog release retain that version until updated, according to the release notes.
