new file mode 100644
index 0000000..09f34ce
@@ -0,0 +1,87 @@
+---
+visibility: public
+---
+
+# company skills
+
+skills published by companies for their own products. high trust — they know their APIs best.
+
+## tier 1: essential
+
+### Vercel ([vercel-labs/agent-skills](https://github.com/vercel-labs/agent-skills), 24.9k stars)
+
+- **web-design-guidelines** — 100+ accessibility, performance, and UX rules. **133k weekly installs.** the most-installed community skill.
+- **react-best-practices** — 57 React/Next.js performance optimization rules
+- **composition-patterns** — compound components, context providers, clean APIs
+- **next-best-practices** — Next.js recommended patterns
+- **next-cache-components** — caching strategies
+- **next-upgrade** — version upgrade guide
+- **react-native-skills** — React Native performance guidelines
+
+also: [agent-browser](https://github.com/vercel-labs/agent-browser) (14k stars) — headless browser automation CLI in Rust + Playwright.
+
+### Trail of Bits ([trailofbits/skills](https://github.com/trailofbits/skills), 4.5k stars)
+
+**40+ professional security skills.** Trail of Bits is one of the top security auditing firms. see [[security]] for the full breakdown.
+
+highlights: `static-analysis` (CodeQL + Semgrep), `variant-analysis`, `building-secure-contracts`, `supply-chain-risk-auditor`, `audit-context-building`, `mutation-testing`, `property-based-testing`.
+
+### Cloudflare
+
+- **agents-sdk** — stateful AI agents with scheduling, RPC, MCP servers
+- **building-ai-agent-on-cloudflare** — AI agents with state + WebSockets
+- **building-mcp-server-on-cloudflare** — remote MCP servers with OAuth
+- **durable-objects** — stateful coordination with RPC, SQLite, WebSockets
+- **web-perf** — Core Web Vitals audit
+- **wrangler** — Workers, KV, R2, D1, Vectorize, Queues, Workflows
+
+## tier 2: strong if you use the product
+
+### HashiCorp/Terraform ([hashicorp/agent-skills](https://github.com/hashicorp/agent-skills), 534 stars)
+
+11 skills: `azure-verified-modules`, `new-terraform-provider`, `provider-resources`, `provider-test-patterns`, `provider-actions`, `run-acceptance-tests`, `refactor-module`, `terraform-search-import`, `terraform-style-guide`, `terraform-stacks`, `terraform-test`
+
+### Stripe
+- **stripe-best-practices** — building Stripe integrations
+- **upgrade-stripe** — upgrade SDK/API versions
+
+### Expo ([expo/skills](https://github.com/expo/skills))
+- official skills for Expo/React Native: `building-ui`, `data-fetching`, `deployment`
+
+### Netlify (12 skills)
+- `netlify-functions`, `netlify-edge-functions`, `netlify-blobs`, `netlify-db`, `netlify-image-cdn`, `netlify-forms`, `netlify-frameworks`, `netlify-caching`, `netlify-config`, `netlify-cli-and-deploy`, `netlify-deploy`, `netlify-ai-gateway`
+
+### Remotion ([remotion-dev/skills](https://github.com/remotion-dev/skills), 2.7k stars)
+- **remotion-best-practices** — programmatic video creation with React. **117k weekly installs.**
+
+### Firecrawl (8 skills)
+- `firecrawl-cli`, `firecrawl-agent`, `firecrawl-browser`, `firecrawl-crawl`, `firecrawl-download`, `firecrawl-map`, `firecrawl-scrape`, `firecrawl-search`
+
+### Neon (3 skills)
+- `neon-postgres`, `claimable-postgres`, `neon-postgres-egress-optimizer`
+
+## tier 3: niche but solid
+
+### Google Labs (Stitch)
+- `design-md`, `enhance-prompt`, `react-components`, `remotion`, `shadcn-ui`, `stitch-loop`
+
+### Sanity (4 skills)
+- `sanity-best-practices`, `content-modeling-best-practices`, `seo-aeo-best-practices`, `content-experimentation-best-practices`
+
+### Tinybird (4 skills)
+- `tinybird-best-practices`, `tinybird-cli-guidelines`, `tinybird-python-sdk-guidelines`, `tinybird-typescript-sdk-guidelines`
+
+### Better Auth (7 skills)
+- `best-practices`, `explain-error`, `providers`, `create-auth`, `emailAndPassword`, `organization`, `twoFactor`
+
+### Callstack (3 skills)
+- `react-native-best-practices`, `github`, `upgrading-react-native`
+
+### Other
+- **shadcn/ui** — component patterns and composition ([ui.shadcn.com/docs/skills](https://ui.shadcn.com/docs/skills))
+- **ClickHouse** — `clickhouse-best-practices`
+- **Supabase** — `postgres-best-practices`
+- **Replicate** — discover, compare, run AI models
+- **Typefully** — social media publishing across X, LinkedIn, Threads, Bluesky, Mastodon
+- **Courier** — multi-channel notifications (email, SMS, push, chat)
+- **Composio** — 850+ SaaS app integrations (see [[app-automation]])
\ No newline at end of file