[Akshat0694]

PR 1 of 4 from the standalone-skills plan: the standalone/ layout, the Tirith sync, the Claude Code marketplace, the catalog and the README top.

What changes

• standalone/ holds skills that need no StackGuardian account. tirith-policies is copied from StackGuardian/tirith at the tag in standalone/TIRITH_VERSION (1.2.1) by scripts/sync-tirith-skills.mjs. A new CI step runs --check, which re-syncs into a temp directory and fails on any hand edit. The copies are in .prettierignore so bun run fmt can't break the check.
• The six sg-* skills start with the same "Before you start" note: if no StackGuardian tools are available, stop and tell the user to run npx @stackguardian/mcp-wizard.
• .claude-plugin/marketplace.json: marketplace stackguardian, with plugins terraform (./standalone) and stackguardian (./skills). Skills only, no MCP.
• catalog/skills.json (the schema shared with the Webflow plan) and skills.sh.json.
• tests/skills-structure.test.ts: SKILL.md frontmatter and links, the catalog contract, skills.sh groupings, a skills-only marketplace, and a real install proving the wizard still installs exactly the six sg-* skills.
• README top, down to "Get started": the new headline and a two-tier table. The rest of the README is unchanged.

The wizard's SG_SKILL_NAMES, the files list in package.json and the build:binary glob are unchanged.

Change from the plan: three Tirith skills became one

Tirith tag 1.2.1 contains only tirith-policies. tirith-standards and tirith-migrate exist only on Tirith main (added 2026-09-27, not in any release). The repo owner chose to sync from 1.2.1 only. Both skills will be added by appending them to TIRITH_SKILLS in the sync script and bumping TIRITH_VERSION once a Tirith release contains them. Until then the catalog and skills.sh.json list only skills that exist.

The synced tirith-policies pins its own install line to @1.2.0, not 1.2.1. That has to change in Tirith, because copies here are never edited.

Install commands verified

All run from a clean temp directory with a throwaway HOME, skills@1.7.4, against this branch.

Command	claude-code	cursor	codex
npx skills add …/tree/<branch>/standalone -a <agent> -y	✅ .claude/skills/tirith-policies	✅ .agents/skills/tirith-policies	✅ .agents/skills/tirith-policies
same with -g	✅ ~/.claude/skills/	✅ ~/.agents/skills/	✅ ~/.agents/skills/
…/standalone --skill tirith-policies	✅
…/tree/<branch> --skill tirith-policies (repo root)	❌ "no matching skills"
…/tree/<branch> --skill sg-create-workflow (repo root)		✅ .agents/skills/
npx skills add StackGuardian/stackguardian-mcp --skill sg-create-workflow (against main)	✅
claude plugin marketplace add StackGuardian/stackguardian-mcp#<branch>, then claude plugin install terraform@stackguardian / stackguardian@stackguardian	✅ 1 skill and 6 skills, 0 MCP servers
claude plugin install terraform --marketplace StackGuardian/stackguardian-mcp#<branch>	✅ one step
claude plugin validate . --strict	✅

Discovery findings:

• Subpath install (…/tree/main/standalone) finds only the standalone skills. That is the documented command.
• Repo root finds only the six sg-* skills. The skills CLI doesn't search standalone/ from the root, even though marketplace.json declares it (I also tried listing each skill folder explicitly). So --skill tirith-policies from the root fails, and the fallback the plan describes isn't needed.
• Branch names with / are misread in tree/ URLs (feat/x was read as branch feat). This branch is named standalone-skills for that reason. After merge the commands use tree/main.
• Agent loading: Claude Code loaded tirith-policies after a skills CLI install (claude -p listed it). Cursor and Codex aren't installed on the test machine, so for them only the file locations above are verified, not that the agent reads them. supportedAgents in the catalog therefore lists only Claude Code until someone confirms the other two.
• The README and catalog use the main forms of the commands above. They work once this is merged; PR 4 re-runs them against main.

Checks

• bun run fmt, bun run build, bun run typecheck: clean.
• bun run test: 23/23 test files pass, including the new structure test (8 checks).
• node scripts/sync-tirith-skills.mjs --check: passes, and fails when a synced file is edited (tested).
• bun run fallow -- --summary: main has 47 issues; this branch has 48, plus 30 duplicated lines and 2 more functions over the complexity threshold. The new "unused file" is the sync script, which runs from the command line. The duplication is the hand-rolled test() helper every test file copies. Left as is.

Requests for the repo owner

• Repository description: for example "Deploy Terraform with AI, without losing control: agent skills and MCP setup for Claude Code, Cursor and Codex."
• Topics to add: policy-as-code. terraform, opentofu, agent-skills, claude-code and mcp are already set.
• The sg-* skills are copied by hand from sg-clickhouse-mcp. Add the same "Before you start" note there, or the next copy will remove it.
• Enable GitHub Issues. package.json bugs.url points to /issues, which is turned off.

Not done in this PR

• Agent loading checks in Cursor and Codex (see above).
• tirith-standards and tirith-migrate (no Tirith release has them yet).

🤖 Generated with Claude Code