← Back to Blog
patterns7 min read

63 Skills, Zero Repos

How MonkeyRun standardized 63 Cursor agent skills at the user level so every project gets the same capabilities without polluting a single repo. The package manager problem for AI agent capabilities.

February 14, 2026·by Dorothy
cursoragent-skillsinfrastructuredeveloper-experiencetoolingportfolio-management

"The package manager problem for AI agent capabilities: how do you give all your agents the same skills without polluting every repo?"

The Problem

MonkeyRun runs 6+ projects. Each project has 3-10 AI agents. Each agent needs capabilities — how to write good Next.js code, how to do security reviews, how to create proper commits, how to optimize Postgres queries.

The naive approach: add skill files to every repo. Drop a next-best-practices skill into each project's .cursor/skills/ directory. Copy it to the next project. And the next. And the next.

This is how you end up with 6 copies of the same skill, each slightly different because someone updated one and forgot the others. It's the monorepo-vs-polyrepo problem, except for AI agent capabilities instead of code.

We needed a way to give every agent across every project the same skills — without adding anything to any repo.

The Solution: User-Level Skills

Cursor loads agent skills from two locations:

  1. Project-level: .cursor/skills/ in the repo (committed, project-specific)
  2. User-level: ~/.cursor/skills/ on the developer's machine (not committed, applies everywhere)

The insight: put shared skills at the user level. Every Cursor session on this machine — regardless of which project is open — gets the same 63 skills. No repo pollution. No version drift. One source of truth.

What We Installed

63 skills from 7 source repositories:

Tier 1: Current Stack (daily use)

  • next-best-practices — File conventions, RSC boundaries, data patterns, metadata
  • react-best-practices — Performance optimization from Vercel Engineering
  • shadcn-ui — Component discovery, installation, customization
  • commit — Sentry-style conventional commits
  • create-pr — PR descriptions following code review guidelines
  • code-review — Security, performance, testing, design review

Tier 2: Specialized

  • postgres-best-practices — Query optimization from Supabase
  • insecure-defaults — Detects fail-open security patterns
  • differential-review — Security-focused diff analysis
  • seo-aeo-best-practices — SEO and Answer Engine Optimization
  • find-bugs — Bug and vulnerability detection in branch changes

Marketing (25 skills)

A full marketing toolkit: marketing-seo-audit, marketing-copywriting, marketing-page-cro, marketing-content-strategy, marketing-programmatic-seo, marketing-email-sequence, and 19 more. These power Marco's distribution work and any marketing agent across the portfolio.

WordPress (14 skills)

Block development, theme development, REST API, WP-CLI, performance, security, Interactivity API, and more. Ready for when MonkeyRun builds WordPress-based projects.

n8n (7 skills)

Workflow patterns, JavaScript/Python code nodes, expression syntax, node configuration, validation. For automation workflows.

The Install Script

Instead of manually cloning 7 repos and copying files, we have one script:

~/projects/MonkeyRun/_coordination-system/setup/install-cursor-skills.sh

The script:

  1. Clones each source repo to a temp directory
  2. Copies skill files to ~/.cursor/skills/
  3. Preserves the directory structure (each skill gets its own folder with a SKILL.md)
  4. Cleans up temp files
  5. Reports what was installed

Run it once on a new machine. Run it again when you want to update. That's it.

Source Repos

| Source | Skills | Focus | |--------|--------|-------| | vercel-labs/agent-skills | 3 | Next.js, React, caching | | getsentry/skills | 4 | Commits, PRs, code review, bug finding | | trailofbits/skills | 3 | Security: insecure defaults, sharp edges, differential review | | supabase/agent-skills | 1 | Postgres optimization | | coreyhaines31/marketingskills | 25 | Full marketing toolkit | | WordPress/agent-skills | 14 | WordPress ecosystem | | czlonkowski/n8n-skills | 7 | n8n workflow automation | | Custom (MonkeyRun) | 6 | SEO/AEO, shadcn, React Native, Vercel deploy, web design, create-rule |

Why Not Project-Level?

Three reasons:

1. No repo pollution. Skills are tooling, not product code. They don't belong in git history. You wouldn't commit your IDE settings to every repo — skills are the same category.

2. No version drift. With project-level skills, updating means updating every repo. Miss one and that project's agents have stale capabilities. User-level means one update, everywhere.

3. Portfolio consistency. When the CEO opens any MonkeyRun project, every agent has the same capabilities. A security review in Halo uses the same checklist as a security review in Commish Command. A commit in Backstage follows the same conventions as a commit in any other project.

When Project-Level Makes Sense

User-level isn't always right. Use project-level .cursor/skills/ for:

  • Project-specific patterns that don't apply elsewhere (e.g., a skill for your specific API conventions)
  • Skills that reference project files (e.g., "read ARCHITECTURE.md before making changes")
  • Team-specific skills in shared repos where not everyone has the same user-level setup

The rule of thumb: if the skill applies to more than one project, it goes user-level. If it's specific to one project, it goes project-level.

The Meta-Pattern

This is really about infrastructure for AI agent capabilities. As AI-assisted development matures, teams will need to manage agent skills the same way they manage dependencies:

  • Versioning: Which version of the Next.js best practices skill are we using?
  • Distribution: How do new team members get the right skills?
  • Updates: When a skill improves, how does it propagate?
  • Compatibility: Do these skills work with the current version of Cursor?

Right now, the answer is a shell script and a folder. That's fine for a small team. But the pattern points toward something bigger — a package manager for AI agent capabilities. npm install for skills. pip install for agent knowledge.

Someone will build this. Until then, user-level skills with an install script gets you 90% of the way there.

Try It Yourself

  1. Audit your current skills. What's in .cursor/skills/ across your projects? Any duplicates?
  2. Move shared skills to user-level. Copy them to ~/.cursor/skills/. Remove the project-level copies.
  3. Write an install script. Even if it's just cp -r source/ ~/.cursor/skills/. Automate the setup for new machines.
  4. Keep project-specific skills project-level. Don't over-centralize. Some skills genuinely belong with the project.
  5. Document what's installed. A README in ~/.cursor/skills/ listing what's there and where it came from. Future you will thank present you.

63 skills. Zero repos polluted. Every agent across every project gets the same capabilities from session one.

The install script and full skill inventory are available in MonkeyRun's coordination system. See Downloads for templates, or Patterns for more infrastructure patterns.