Netresearch Agentic Skills Marketplace
39 curated agent skills for TYPO3, PHP, Go, Docker, Jira, and security — portable across Claude Code, Cursor, Copilot, Gemini CLI, and 30+ other agents.
The repository itself contains almost no executable code (a marketplace. catalog only), so the permission surface is inherently minimal; CI conventions mandate minimal per-job permissions, SHA-pinned third-party actions, and forbid secrets:inherit — verifiable supply-chain controls, hence least_privilege and dependency_security at 2. However, each skill's implementation lives in an external repo whose runtime behavior this repo cannot attest: user_confirmation, external_effects and rollback appear only as vague one-line claims (jj's reversible op-log, blocking dangerous gh release commands) with no in-repo evidence — scored 1; sensitive_data_handling has no concrete statement at all, scored 1.
README, catalog structure and the Pages site build are mutually consistent, backed by site tests (install-methods.test.js, Playwright visual regression) that guard install commands, giving self_consistency a 2. Installation depends on external skill repos and the unseen marketplace., so dependency_availability is 1; no documentation of failure messages or user-facing validation errors (scripts/validate.sh not shown in evidence), failure_messages scored 1.
Audience and scenarios are clearly organized: 39 skills grouped by stack (TYPO3, PHP, Go, DevOps, productivity) with explicit multi-platform support lists (Claude Code, Cursor, Copilot, Codex, Gemini CLI, 30+), audience_and_scenarios scored 3. But per-skill trigger conditions and capability boundaries live in external repos; this repo gives only one-line summaries, so capability_boundaries and trigger_precision are 1. Environment_fit claims broad compatibility without per-platform verification detail — scored 2.
Information architecture is strong: category tables, two-layer AGENTS.md (root + workflows), site ADRs, DE/EN bilingual pages, a clear skill-adding procedure — information_architecture and install_notes at 3. The MIT LICENSE file is complete and matches the badge, license at 3. Naming is mostly consistent (-skill suffix) with exceptions (php-ast-edit-skill vs php-modernization name, claude-coach-plugin), naming_stability at 2. Install examples exist but no FAQ; no known-limitations section anywhere; per-skill versions and changelogs live outside this repo — examples_and_faq 2, known_limitations 1, versioning_changelog 1. Maintainer is named (Netresearch DTT GmbH) with an internal marketplace path, maintenance_responsibility at 2.
Deliverable is a directly installable catalog plus a bilingual site whose install commands are protected by unit and visual-regression tests — output_usability at 2. Clear marginal value for TYPO3/PHP teams as a standardized skill suite, though claims like jj 'proven with evals' lack in-repo evidence, marginal_value at 2. Installation cost is one command and skills install individually on demand, cost_benefit at 2.
Every skill in the README links to a concrete GitHub repository, so claims are traceable — claim_traceability at 2. External claims (agentskills.io spec conformance, OpenSSF Scorecard status, 'proven with evals') cannot be cross-verified from the provided sources, cross_source_corroboration at 1. Factual listings (which skills, how to install) are mostly separable from marketing assertions ('30+ more agents'), but some phrasing is vague — fact_inference_separation at 2.
- This repository is only a catalog index: the actual code, permissions and behavior of all 39 skills live in external repositories — review each skill repo's source and permission needs before installing.
- Skills are pulled dynamically via source references; external repo contents can change at install time and are outside this review, creating supply-chain drift risk.
- The publisher is unverified; the curation standard and quality bar behind '39 curated skills' are undocumented in the evidence.
- Several skills operate on external systems (Jira, Matrix messaging, gh releases) — confirm their authorization scope and confirmation mechanisms before use.
- Performance and correctness claims (jj eval results, 74+ tool catalog) are self-reported and independently unverified.
What does this agent do, and when should you use it?
This is a curated agent skills marketplace maintained by Netresearch (GitHub: netresearch/claude-code-marketplace) containing 39 skills spanning TYPO3, PHP, Go, Docker, Jira, security, and documentation. The repository itself is only a marketplace. catalog that references individual skill repositories via source entries; Claude Code fetches each skill directly from its source repository at install time. Every entry conforms to the open Agent Skills specification (agentskills.io) and to the Agent Plugins 1.0.0 packaging standard, making skills portable to Cursor, GitHub Copilot, OpenAI Codex, Gemini CLI, and 30+ other compatible agents. A companion GitHub Pages site provides per-skill detail pages in English and German, grouped by stack and category. The project is MIT-licensed and maintained by Netresearch DTT GmbH in Leipzig.
The repository is effectively a skills catalog: .claude-plugin/marketplace. lists each skill's name, description, GitHub source repo, and category. Two installation paths exist: in Claude Code, run /plugin marketplace add netresearch/claude-code-marketplace and browse via /plugin; or in any conformant agent, run npx skills add https://github.com/netresearch/{repo-name} --skill {skill-name}. Skill content covers: typo3-conformance evaluates extension quality and standards compliance, typo3-testing provides unit/functional/E2E/architecture/mutation test infrastructure, typo3-extension-upgrade systematizes migrations to newer LTS versions, php-modernization handles PHP 8.x type safety and Rector upgrades, security-audit supplies OWASP audit patterns, docker-development covers multi-stage builds and CI, github-release automates signed releases with supply-chain safeguards, and jira-integration provides Jira API operations and wiki markup. A meta-family (agent-harness, automated-assessment, retro, agent-rules, skill-repo) forms a Harness–Assessment–Retro loop for skill authors themselves.
- A TYPO3 extension developer upgrading an extension to a newer LTS release can use typo3-extension-upgrade and typo3-project-upgrade for a systematic migration workflow.
- A PHP team modernizing legacy code to PHP 8.x can apply php-modernization (type safety, enums, DTOs, PHPStan, Rector).
- A security engineer auditing a PHP application before release can use security-audit plus enterprise-readiness (SLSA, OpenSSF, SBOMs).
- Developers on Cursor, Copilot, or Gemini CLI instead of Claude Code can still install the same skills via npx skills add.
- Skill authors building and validating their own skill repos can use the meta-skills skill-repo, retro, and agent-harness to run assessment and retrospection loops.
- Daily integration needs — messaging Matrix rooms, Jira operations, auto-installing missing CLI tools — are covered by matrix-skill, jira-integration, and cli-tools.
What are this agent's strengths and limitations?
- Built on the open Agent Skills spec (agentskills.io) and Agent Plugins 1.0.0 packaging, so skills port across 30+ agents without vendor lock-in.
- Exceptionally deep TYPO3 coverage (conformance, testing, docs, DDEV, upgrades, CKEditor 5, Gerrit core contributions) — rare in generic skill collections.
- Source-reference architecture means skills install straight from their own repositories, and the GitHub Pages site offers bilingual (DE/EN), category-grouped detail pages.
- The marketplace repo is only a catalog; actual quality depends on each separate skill repository, so adopters must evaluate skills individually.
- The deep TYPO3/OroCommerce/Concourse skills offer limited value outside those stacks; only a subset of the 39 skills may be relevant to a given team.
- The docs do not state versioning, update policy, or a compatibility matrix for individual skills, leaving cross-agent behavioral consistency unevidenced.
How do you install or deploy this agent?
Claude Code path: run /plugin marketplace add netresearch/claude-code-marketplace inside Claude Code, then use the /plugin command to browse and install individual skills. Any-agent path: npx skills add https://github.com/netresearch/{repo-name} --skill {skill-name}; all skills are browsable at skills.sh/netresearch. Requires Node.js (for npx) and network access to GitHub.
How do you use this agent?
Once installed, skills load as portable procedural-knowledge packages in any supported agent. In Claude Code, manage them via /plugin; other conformant agents read the skills directly from each source repository, which contains a plugin. at the root plus a skills/ directory. The full catalog with per-skill detail pages is at https://netresearch.github.io/claude-code-marketplace/ in English and German. To contribute a skill, add an entry to .claude-plugin/marketplace. with name, description, source (GitHub repo), and category.