The 324.4 MB checkout holds many independent workflows
Our clone of commit 4f340b0 contained 25,510 files, about 600,443 source lines, and occupied 324.4 MB. The live v18.11.0 README lists more than 2,610 SKILL.md playbooks across coding, design, security, and data work. You can probably find instructions close to the job, but the entire tree is not one coherent operating method.
The small npm layer hides that physical scale. Our September 30 run added only 11 packages and 5 MB in 3 seconds, while the checked-out catalogue was about 65 times larger on disk. Indexes, filters, plugins, bundles, and workflows spare you from hunting through thousands of directories. Start with a task, inspect a few exact IDs, and leave the rest outside the active agent directory.
Nine read-only tools preserve the choice without making it
AAS Core v18.11.0 exposes nine read-only MCP tools for search, file inspection, stack composition, comparison, and selection evidence. A client or the aas command saves aas-stack.json, checks it, and writes a plan you can inspect. Workbench opens those artifacts in browser memory. None of those steps gives Core authority to pick the right instructions.
In a repository with 600,443 lines of source, search results have no relevance score or preferred order, and metadata does not exclude a poorly matched skill. Codex or Claude owns the semantic decision. Core checks identity, structure, digests, and artifact consistency. Its 128-skill manifest limit is a technical ceiling, not advice that a large stack makes sense.
The supported path stops before automatic apply
The setup guide requires Node.js 22 and configures AAS Core as a local stdio MCP. The server can work offline and contains no model credentials or telemetry. Its first configuration command previews the host change and returns an approval digest. Selection evidence records search queries, so keep credentials and private source text out of them.
Our 3-CPU, 8 GB Debian container had no secrets and no elevated privileges. The supported route lets the agent choose IDs, validates the manifest, produces an immutable plan, and prepares a direct-installer dry run. stack apply and stack recover remain experimental. A review artifact is useful, but it is not permission to alter the target project.
What happened when we ran it
Our sandbox installed commit 4f340b0 in 3 seconds. Npm added 11 packages and used 5 MB on disk. Npm audit reported 0 known vulnerabilities at every listed severity. The checkout itself was far larger at 324.4 MB, so the dependency audit describes the small JavaScript layer rather than the safety of thousands of instruction files.
The build failed after 4 seconds at its first validation command. Node launched tools/scripts/validate_skills.py, and Python stopped at import yaml with ModuleNotFoundError: No module named 'yaml'. The log does not establish why that module was absent. It shows that the v18.9.0 checkout did not build in our fresh Node 22 container with its npm install alone.
The test command reached the 900-second limit. Node's reporter showed 12 passed and 0 failed out of 12 before the timeout, including checks that reject unsafe cache-parent permissions. The command never completed, so we cannot call the suite green. Our scan found 10 CI workflow files, no Dockerfile, and no conventional tests directory.
Zero dependency advisories do not clear 2,610 instruction packs
Npm audit found 0 known vulnerabilities in the 11 installed packages. That result says nothing about what an agent may do after receiving shell, network, filesystem, browser, or credential access. The project's audit looks for eight signal types, including commands, privileged actions, destructive operations, symlinks, and binaries. Its security guide says static matching can miss harmful logic and flag legitimate examples.
Reviewing every byte in a 25,510-file checkout is unrealistic for one task, so narrow selection is the sensible model. Audit the exact IDs, inspect bundled files, pin an immutable release or commit, run the installer preview, and keep agent permissions small. A risk label describes intended capability. It does not turn community instructions into trusted code, and the local MCP gives them no extra authority.
v18.11.0 shipped on October 1 with three open pull requests
GitHub showed 47,164 stars, 6,870 forks, and a push on October 1, 2026. Release v18.11.0 landed the same day, one day after v18.10.0. The open count was 3, and all three returned items were pull requests adding skills. That indicates current maintenance and incoming contributions. It does not prove that each of the 2,610 skills fits your agent, project, or permission model.
The 10 CI workflow files matter beside the frequent releases and current pull requests. Our build failure still belongs in the decision because contributors start from the repository. Users have an easier route: choose a focused plugin or exact IDs, keep the dry run, and inspect what will be copied. The project works best when you want a broad shelf and accept that selection remains your responsibility.
Start with exact IDs, then keep the evidence
A 2,610-skill catalogue reduces search cost, while our 324.4 MB checkout shows why installing everything is the wrong default. For Codex or Claude, use AAS Core to inspect candidates and record the chosen stack. Other supported clients can use a focused plugin or filtered direct install. Keep the manifest, selection evidence, and plan. If nobody will review those artifacts, Anthropic Skills or the single method in Superpowers is the safer choice.