SOTA Engineering Skills

<p align="center"> <a href="https://github.com/martinholovsky/SOTA-skills/releases"><img src="https://img.shields.io/github/v/release/martinholovsky/SOTA-skills?color=2fa45f&label=release" alt="Latest release"></a> <a href="https://github.com/martinholovsky/SOTA-skills/actions/workflows/ci.yml"><img src="https://github.com/martinholovsky/SOTA-skills/actions/workflows/ci.yml/badge.svg" alt="CI status"></a> <img src="https://img.shields.io/badge/skills-42-2fa45f" alt="42 skills"> <img src="https://img.shields.io/badge/modes-BUILD%20%2B%20AUDIT-2fa45f" alt="BUILD + AUDIT"> <a href="LICENSE"><img src="https://img.shields.io/badge/license-CC%20BY%204.0-blue" alt="License: CC BY 4.0"></a> </p> <p align="center"> <img src="assets/social-preview.png" alt="SOTA Engineering Skills — 40+ Claude Code skills to build and audit software at state-of-the-art practices" width="100%"> </p>

Make your AI coding assistant build and audit like your most senior engineer.

Your assistant is brilliant — it just doesn't know your standards, and it forgets the ones it does know as the task grows long. SOTA-skills fixes both, and the fix is measured: from a bare "build X" prompt, best-practice coverage climbs from ~59% to ~98% (+0.39) — the model stops silently dropping tests, rate limiting, structured logging, and TLS (see every number →).

It works by being a loop, not a prompt dump: route in only the rules a task needs, re-state them every turn, and re-check them last before shipping — so the guidance survives a long context instead of fading into it. That's why it beats a bigger prompt instead of becoming one. Native on Claude Code; works with Antigravity CLI, Codex, and any agent that reads AGENTS.md.

Under the hood: 42 skills (317 files, ~71k lines) of state-of-the-art 2026 practice, each instruction file under 500 lines so only the matching rules load — the cap applies to skills/** alone, never to README/CHANGELOG/docs/ — every fast-moving claim web-verified against a primary source as of the last full sweep (the root LAST-VERIFIED stamp). Between sweeps an upstream can still move under a claim, so the router's own operating principle 1 stands: re-verify anything version- or CVE-sensitive at use time.

Two commands to install:

/plugin marketplace add martinholovsky/SOTA-skills
/plugin install sota-skills@sota-skills

Or clone + link (best if you want a local checkout to read, hack on, or pin). Skills are discovered from .claude/skills/ (per project) or ~/.claude/skills/ (personal, all projects). Clone the repo, then run the installer — it symlinks every skill (and your profile, if you have one):

git clone https://github.com/martinholovsky/SOTA-skills && cd SOTA-skills
./scripts/install.sh                 # personal: ~/.claude/skills (all projects)
./scripts/install.sh --project DIR   # one project: DIR/.claude/skills
./scripts/install.sh --copy          # copy instead of symlink (pin a snapshot)

The installer colour-codes what it did (✓ done · ↻ changed or act on this · · no-op) and drops to plain ASCII when the output is not a terminal, on a non-UTF-8 locale, on TERM=dumb, or with NO_COLOR set — --color=always|never|auto (or --no-color) overrides the detection either way.

Then describe the task in plain language — routing loads the right skills; the stack comes from your profile or the skills' defaults (naming one is optional):

Design a multi-tenant invoicing service.

Run a full audit of this repo — severity, effort, and fix on every finding.

<img src="assets/how-it-works.png" alt="How it works: a plain prompt is routed automatically — the sota router maps the task to skills, only the matching rules files load, and the rules are applied in BUILD or AUDIT mode; a return path shows the routing directive re-stated on every prompt so the rules survive a long session" width="100%">

More install options: Installation · more prompts: Using it.

Five slash commands ship with the library — four bracket a working session, the fifth is the heavy escalation. scripts/install.sh links them into ~/.claude/commands/, so they work in any project, not just this one:

| | When | What it does | |---|---|---| | /sota-resume | start of a session | Finds the open work — every tracker, checkbox and TODO marker, swept with a controlled search — classifies it (ready · needs a decision · deferred · not an item · already done and never ticked off), shows you the table, then executes what you agree to against the project's own CI. | | /sota-close | end of a session | The closure pass: retract first, record open items where the next session will trip over them, update what the session made false, re-derive every number from its source, say what is not done and blocked on whom, then commit the evidence. | | /sota-audit | work finished, or a codebase you did not write | Audits what is in front of you against the library: agrees the scope first, maps every surface to its owning skill and says which domains nobody opened, walks each Audit checklist item by item, then fixes what you agree to. | | /sota-deep-audit | a milestone, an inheritance, a go/no-go | The heavy pass, and expensive: reconstructs the threat model from the code — entry points, trust boundaries, a control-presence matrix — then fans the audit across independent agents, re-measures the numbers past decisions rest on, and hands every serious finding to a refuter that did not find it. | | /sota-report | end of a session | Writes a gitignored field report on where the guidance failed, was absent, was wrong — or was right and did not fire. Prints a gh issue create line; it never posts anything itself. |

They take free-text arguments (/sota-close focus on the migration branch). Full detail: slash commands.

Contents

• Standards & practices baked in · What the audit hunts that a scanner can't · How the numbers are kept honest
• Skills · Coverage & non-goals
• Installation · Always-on routing · Updating
• Using it — slash commands (/sota-resume · /sota-audit · /sota-deep-audit · /sota-close · /sota-report)
• Optional setup & integrations — badge, gates, other agents, status line, plugin extras
• Structure · How it works · Conventions
• Found a gap? Tell us · Contributing · License

Deeper docs: Find it fast (docs index) · Does it work? (measured results) · Why it works · Why some lifts expire and others don't · Keeping rules applied as context fills · Roadmap

Standards & practices baked in

Findings name the control they violate — not just "this looks wrong":

• Security — OWASP Top 10 (2025), ASVS, API & LLM Top 10; findings cite CWE IDs. Disabled TLS certificate and SSH host-key verification are each stated once, with a detector per library read from that library's own source
• Languages — all 9 language skills (Rust → Ruby, below) get the same rigor; formal standards where they exist: SEI CERT (C, C++, Java), MISRA C/C++, ANSSI Rust. Each is also gap-checked against its ecosystem's own scanner registry (Bandit, gosec, cppcheck and Brakeman so far — LANGUAGE-TIER)
• Supply chain — SLSA, Sigstore, in-toto, SBOM (CycloneDX/SPDX), NIST SSDF
• Cloud & identity — CIS Benchmarks, NIST 800-207 zero trust, NIST 800-63-4, OAuth 2.1, FAPI 2.0, passkeys, SPIFFE
• Privacy & compliance — GDPR, CCPA/CPRA, HIPAA, PCI DSS 4.x, SOC 2, ISO 27001, EU AI Act, NIS2, DORA
• Government & regulated — NIST CSF 2.0, 800-53, 800-171/CMMC, FedRAMP, EU Cyber Resilience Act, IEC 62443, ISO/IEC 29147 & 30111 (vulnerability disclosure and the handling process behind it)
• Threats, detection & AI/ML — STRIDE, LINDDUN, MITRE ATT&CK & ATLAS, NIST 800-61, NIST AI RMF
• Frontend, mobile & testing — WCAG 2.2 AA, Core Web Vitals, OWASP MASVS & WSTG

Named standards are the floor. Most of the library is the practice layer no regulation writes down: cancellation & backpressure, retries with jitter, circuit breakers, outbox/saga, double-entry ledgers and the reconciliation that proves an integration is complete rather than merely correct, zero-downtime migrations, measure-first performance, API evolvability, per-language idioms, SLOs, test-suite health — and the ones that only show up once something is already running: triaging a vulnerability report a stranger sent you (reproduce before you rate it, check the cited code even exists, and decide the regulatory clock explicitly, because it starts at awareness), and why a skill can stop triggering with nothing about it changed (a length cap is enforced either by skipping or by silent truncation, and a shared listing budget means a neighbour's bloat eats the trigger words you wrote).

Measured, not asserted — library vs. an unguided model (same model, no library); clean, blind-judged, stable across samples (results & method →). Every number below names the model it was measured on, because a lift can be overtaken by model progress and then reads as current when it is historical — that happened to the defect-avoidance row on 2026-08-21 and is stated there rather than quietly left standing:

<p align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="assets/lift-dark.svg"> <img alt="Measured lift with the library vs without. Completeness 0.59 to 0.98 (+0.39) on claude-sonnet-4.6 and 0.62 to 1.00 (+0.38) on claude-sonnet-5 — durable. Freshness 0.44 to 0.97 (+0.53) on a set authored July 2026, 0.69 to 0.99 (+0.30) on that same set once aged, and 0.33 to 1.00 (+0.67) on a set re-authored August 2026 — the question set ages, not the library. Routing 0.90 to 1.00 (+0.10) then 0.87 to 0.99 (+0.13) — holds. Defects avoided 0.81 to 1.00 (+0.19) then 1.00 to 1.00 (+0.00) — expired." src="assets/lift-light.svg" width="100%"> </picture> </p>

• Completeness +0.39 — and it did not expire. Re-measured 2026-08-21 on the current flagship claude-sonnet-5: 0.62 → 1.00, +0.38 — unchanged. From a bare "build X" prompt, best-practice coverage goes ~59% → ~98% (7 tasks): the model stops silently dropping tests, rate limiting, structured logging, and TLS. Web search likely can't recover this (an agent won't search "should I add rate limiting"). Not model-specific, and not stale: a different-family model (openai/gpt-5.1) shows +0.44 on the same tasks (cross-model →), and claude-sonnet-5 — four months newer than the model this was established on — still shows +0.38 (2026-08-21 →). Why this one lasted while defect-avoidance did not: newer models stopped writing known-bad patterns, but sonnet-5 unguided still omits tests in 7 of 7 tasks, transport in 5, rate limiting in 5. Knowledge gaps close with model progress; salience gaps do not.
• Freshness +0.53 → +0.30 — it erodes, and we measured that rather than assuming either way. Current-2026 facts (RFCs, CVEs, EOLs) 0.44 → 0.97 on `