Let a jacked user opt in to curated collections of third-party skills ("skill packs")
as part of jacked install and from the dashboard, without jacked vendoring any
third-party content. Upstream repos stay the single source of truth; jacked orchestrates
install, update, verification, and removal through the
vercel-labs npx skills CLI
(skills.sh), which is also the upstream-recommended installer for the repos in question.
| Decision | Choice | Why |
|---|---|---|
| Delivery | Live install via npx skills, never vendored | Jack's call: upstream ships multiple releases per week; snapshots drift. The skills CLI has per-skill selection, a lockfile, an update command, and multi-agent targeting. |
| Curation | jacked owns only a pack registry (name, repo, skill list) | The 28-skill marketing list keeps the practitioner-depth skills and drops the generic filler plus the broken image skill (fabricated model names). |
| Opt-in UX | jacked install --packs NAME + dashboard toggle, persisted state | Jack picked flag + dashboard. Enabled packs auto-refresh on every subsequent jacked install. |
| Emil skills | The 4 vendored core skills stay vendored; only improve-animations ships as a pack | jacked's own behavior rules reference the 4 by name, so they cannot be optional or network-dependent. |
| first-customer-finder | Excluded | Superseded: marketingskills' prospecting re-expresses its framework with credit and extends it. |
| Codex | Pack skills install for Codex too when Codex is present | Matches jacked's existing Codex-parity pass; the skills CLI natively supports -a claude-code codex. |
npx -y skills add owner/repo --skill a b -g -y -a claude-code codex puts the canonical full skill directory at ~/.agents/skills/<name>/ and a relative symlink at ~/.claude/skills/<name>.~/.agents/.skill-lock.json (v3): per-skill source, sourceUrl, skillFolderHash, timestamps. Multiple source repos coexist.npx -y skills update -g -y refreshes all globally installed skills from their sources; npx -y skills remove name -g -y removes canonical dir, symlink, and lock entry.-y plus explicit -a makes runs deterministic. skills.sh runs its own per-skill security scan during install.One new core module (jacked/packs.py) owns registry parsing, enablement state,
subprocess orchestration of the skills CLI, and post-operation disk verification. The CLI
layer and the dashboard API are thin consumers of that module.
flowchart LR
subgraph jacked
R[packs.json registry] --> P[packs.py]
S[state: ~/.claude/jacked-packs.json] --> P
C[cli.py: install --packs / jacked packs] --> P
A[api/routes/packs.py] --> P
W[dashboard Skill Packs section] --> A
end
P -->|npx -y skills add/update/remove| CLI[skills CLI]
CLI -->|clone| U[(upstream GitHub repos)]
CLI --> D1[~/.agents/skills/ canonical]
CLI --> D2[~/.claude/skills/ symlinks]
CLI --> L[.skill-lock.json]
P -->|verify on disk after every op| D1
P -->|verify| D2
P -->|source check before remove| L
flowchart LR
packs.json --> packs.py --> skills CLI --> upstream repos
cli.py + dashboard API consume packs.py
packs.py verifies ~/.claude/skills + ~/.agents/skills after every op
skills add with the pack's curated --skill list, verify every expected skill exists at both destinations, report loudly on misses.jacked install: after the main install and Codex pass, refresh enabled packs (skills update + verify + one repair attempt for missing skills). Missing npx: loud warning, never fails the main install.jacked uninstall removes all enabled packs' skills and the state file.GET /api/packs for status (per-skill installed/source-ok/updated-at), PUT /api/packs/{name} to toggle; the slow npx work runs off the event loop with a pending state in the UI.| Pack | Source | Contents |
|---|---|---|
marketing |
coreyhaines31/marketingskills | 28 curated of 47: ad-creative, ads, ai-seo, aso, churn-prevention, cold-email, competitor-profiling, competitors, copy-editing, copywriting, customer-research, directory-submissions, marketing-council, marketing-loops, marketing-plan, offers, pricing, product-marketing, programmatic-seo, prospecting, public-relations, referrals, revops, sales-enablement, seo-audit, sms, social, video. Excluded: image (fabricated model names) and 18 generic-tier skills. |
design-extras |
emilkowalski/skills | improve-animations (whole-codebase motion audit producing self-contained fix plans). |
| File | Responsibility |
|---|---|
jacked/data/packs.json | Pack registry: display name, description, source repo, curated skill list. |
jacked/packs.py | Core: registry load, state persistence (atomic), npx discovery via findbin, skills-CLI orchestration, post-op disk verification, lockfile source checks, pack status. |
jacked/cli.py | --packs option on install, enabled-pack refresh on every install, jacked packs list/enable/disable/update group, uninstall removal. |
jacked/api/routes/packs.py | GET /api/packs, PUT /api/packs/{name}; registered like the features router. |
jacked/data/web/js/components/settings.js | Skill Packs section in the Features tab: toggle, per-pack install count, upstream link, pending state. |
tests/test_packs.py + route/CLI tests | Fake-npx shim tests; no network anywhere in the suite. |
jacked/data/skills/, so a pack can never shadow a vendored skill.~/.claude/jacked-packs.json.skills/ content is installed; upstream AGENTS.md and tools/ never reach the machine. skills.sh adds its own scan during install.Generated with the jacked HTML artifact template. Edit freely.