A curated collection of skills and agents for Claude Code CLI, covering software engineering, DevOps, data engineering, infrastructure administration, and workflow orchestration.
Version: 1.6.0 · Last published: 2026-07-26 (v1.5.0) · 225 skills · 6 agents · 8 workflows · 2 commands See the Changelog for what changed in each release.
- 225 skills — domain knowledge Claude loads on demand to help with specific tasks. Highlights include the web-experience pair (
modern-frontend— the promoted canonical frontend skill: Vite/Next rendering-mode selection, RSC-first App Router, CWV build budgets, debugging, withjava-frontendliving on as an enterprise-scoped compatibility stub; andaudience-experience-design— the generative sibling of ux-reviewer that turns audience, intent, and emotional/trust response into buildable design decisions for web, apps, and reports), the trading-engineering pair (trading-automation-runtime,trading-dashboard-ux— the unattended-bot process lifecycle with halts that persist across restarts, gateway-fenced single-instance enforcement, and a crash-consistent drain; plus the trading-surface UX where a mis-shown side or a stale quote is a monetary loss), the equity day-trading family (equity-broker-execution,equity-scanning-and-watchlists,equity-trading-compliance,trade-journaling-and-review— real-broker order execution with a fail-closed exposure-intent gate, universe screening, PDT/wash-sale/§475(f) compliance with a canonical pre-trade guard, and a live-fill journal), the legacy-comprehension family (lineage-extract-static,mainframe-lineage-parsers,legacy-code-intel,structure-recovery,intent-extract— data/process lineage, deterministic COBOL/JCL/DB2 + Control-M → OpenLineage, SCIP-style symbol graphs, and record-structure recovery for legacy estates),env-readiness(read-only environment readiness doctor),publish-to-github(releasing this whole tree to public github safely),visual-companion(browser-based mockup/diagram review during design), andcross-project-mail(AI-agent messaging across sibling projects on one host) - 6 agents — specialized sub-agents for execution, review/evolution, evergreening, task routing, and knowledge management
- 8 saved workflows — committed
.jsorchestration scripts under~/.claude/workflows/(e.g.bob-serial-exec,design-tournament,alf-sweep) that parameterize the existing agents; main-loop-only on Claude Code, with a host-neutral serial fallback for every other host - Slash commands — short user-invoked workflows under
~/.claude/commands/(e.g./exit-with-docsto wrap up a session and update project docs)
Skills are auto-discovered from frontmatter descriptions — you don't call them explicitly. Agents are invoked by name (forge, bob, alf, pa, wiki). Commands are invoked with a leading slash (e.g. /exit-with-docs).
~/.claude/skills/ is the shared location all of these tools read — Claude Code, Copilot CLI and VS Code alike. Install the claude target even if Claude Code is not the tool you use; see the note under Quick Start.
# 1. Clone the repo
git clone https://github.com/<your-username>/<repo-name>.git
cd <repo-name>
# 2. Bootstrap a full environment (recommended for first-time setup)
python3 bootstrap-environment.py
# or, on Windows: pwsh -NoProfile -NonInteractive -File bootstrap-environment.ps1The bootstrap orchestrator runs install.py plus a series of idempotent post-install steps so a fresh machine reaches a complete Claude Code environment in one command. Re-run any time — every step skips work already done.
~/.claude/skills/is the canonical skill library, not a Claude-only directory. Copilot CLI and VS Code both auto-discover it as a user-level skill location; that is why installing skills for them needs no bridge. The directory name reflects where the convention started, not who may use it.So always install the
claudetarget, whichever tool you actually work in:python3 install.py --target claude,copilot # Copilot user python3 install.py --target claude # VS Code user — nothing else needed for skills
--target copiloton its own writes only~/.copilot/copilot-instructions.md— no skills, no agents. It is an add-on to the claude target, not a replacement for it.The same applies to the machinery: the gates, hooks and shared tooling live in
~/.claude/skills/_meta/, and skills that call into them break if that tree is absent.
Look before you install. install.py --preview prints exactly what will be placed, where, for every tool it supports — and --os lets you inspect a machine you are not sitting at:
python3 install.py --preview # this machine
python3 install.py --preview --os windows # what your Windows laptop will do
python3 install.py --preview --os macos --tool vscode # one cellSimulated output is labelled as such: paths are computed, nothing is probed, and no tool detection runs.
| Step | What happens |
|---|---|
| 1 | install.py places skills / agents / commands under ~/.claude/ |
| 2 | Places ~/.claude/CLAUDE.md (global instructions) |
| 3 | Symlinks ~/.claude/AGENTS.md → CLAUDE.md (GitHub Copilot bridge) |
| 4 | Mirrors pa-server/ into ~/.claude/pa-server/ (MCP server for the pa agent) |
| 5 | Merges canonical SessionStart hooks into ~/.claude/settings.json (preserves any you already have; backs the old file up to .bak) |
| 6 | Writes ~/.claude/policy-limits.json with conservative defaults, mode 0600 |
| 6b | Seeds ~/.claude/memory/ — the global memory tier + preference profiles (user-preferences); never clobbers a populated profile |
| 6c | Restores ~/.claude/publish-config.json from the repo root if present (your private publish scrub list) — else points you at init-config |
| 7 | Symlinks ~/.claude/bin/claude-observe for the process-observation skill |
| 8 | Mirrors skills into ~/.codex/skills/* (only if codex CLI is on PATH) |
| 9 | Pins Gemini model in ~/.gemini/settings.json (only if the file exists) |
| 10 | Prints next-step guidance |
After bootstrap, two more steps inside Claude Code finish the setup:
# Inside Claude Code:
/setup # interactive permissions upgrade
# (conservative -> autonomous)
# Per working repo you care about:
bash scripts/install-pre-push-hook.sh /path/to/repo # POSIX
# or any OS (incl. enterprise Windows where PowerShell is blocked):
python3 scripts/install-pre-push-hook.py --target-repo /path/to/repoThe pre-push hook runs a secrets scanner (live API keys, PEM private keys, AWS credentials, JWTs, inline tokens, etc.) before every git push. Critical/high findings block the push; medium/low advisory hits print but don't block. Override per-push with git push --no-verify.
The installer installs these for you by default. Everything else ships stdlib-only — all 225 skills, the gates and the hooks work with no third-party Python and no Node — so a failed optional install is reported, never fatal. On a locked-down or offline machine you still get a working harness with those capabilities simply unavailable.
python3 install.py # installs extras by default
python3 install.py --no-extras # skip them entirely
python3 install.py --with-extras=documents,spreadsheets # narrow the set
python3 install.py --extras-report # what's missing, and what it costs
python3 skills/_meta/optional_deps.py doctor # which package managers work hereOne group is not optional. core (pyyaml, jsonschema) is needed by the harness itself — a SessionStart hook imports pyyaml on every session, and the gates use jsonschema for schema validation, which fails toward "not checked" rather than "checked and passed". If it is missing you get a banner, not a footnote.
| Capability | Unlocks | Without it |
|---|---|---|
core |
the harness itself — a SessionStart hook + gate schema validation | not optional; the harness misbehaves |
documents |
PDF statements, invoices, receipts | CSV import still works, and is the better source anyway |
spreadsheets |
.xlsx read/write |
the spreadsheet route is unavailable |
office-docs |
.docx / .pptx |
Markdown and HTML output unaffected |
reporting |
HTML report rendering | lineage/code-intel reports emit Markdown only |
lineage-sql |
SQL-dialect parsing | nothing breaks — stdlib-first by design |
hardening |
XXE-refusing XML parsing | needed by skills that parse untrusted XML |
llm-clients |
direct Anthropic / Google API calls | CLI-routed work is unaffected |
browser-measurement (npm) |
real-browser DOM geometry | the UI-verification lane cannot run |
A failed optional install is a reported outcome, not an installer failure — on a locked-down machine where pip install is refused, you still get a working harness. Readiness is announced before placement, so you learn what is missing up front rather than at the end.
Two traps it handles for you, because both produce a silent wrong result:
- A bare
pip/pip3may belong to a different Python than the one that will import the package. Installs always go through<the running interpreter> -m pip, anddoctornames any mismatched shim. - PEP 668 externally-managed environments (Debian, Ubuntu, Fedora) refuse
pip install— and refuse--usertoo, which is the part that surprises people. The emitted command carries the flags that actually work there.
python3 bootstrap-environment.py --dry-run # preview without writing
python3 bootstrap-environment.py --force # overwrite existing CLAUDE.md / pa-server / policy-limits
python3 bootstrap-environment.py --skip-install # don't run install.py
python3 bootstrap-environment.py --skip-codex # don't touch ~/.codex/
python3 bootstrap-environment.py --skip-gemini # don't touch ~/.gemini/settings.json
python3 bootstrap-environment.py --claude-home /opt/claude # custom config root
python3 bootstrap-environment.py --helpIf you already have a CLAUDE.md, hooks, and other host config and just want the skill content placed:
python3 install.py # interactive
python3 install.py --noninteractive # Claude + link
python3 install.py --target claude,gemini --mode link
python3 install.py --target all --mode move --force # full copy, overwrite
python3 install.py --claude-home /opt/claude # custom path
python3 install.py --help # all flagsinstall.py is what bootstrap-environment.py calls under the hood for step 1, so the flags are pass-through-able via --install-arg.
bootstrap-environment.ps1is enterprise-hardened —#Requires -Version 5.1,[CmdletBinding()]with named switch parameters, no-ExecutionPolicy Bypass, no dot-source, no-Command. Invoke withpwsh -NoProfile -NonInteractive -File bootstrap-environment.ps1.- The bootstrap script probes
py(PEP-397 launcher) →python3→pythonin that order and runs the orchestrator with whichever resolves first. - For backward compatibility, the older
install.cmd/install.ps1entry points are still present. They use-ExecutionPolicy Bypassfor compatibility with very locked-down machines; preferbootstrap-environment.ps1on modern setups. - Symbolic links on Windows require admin or Developer Mode. If symlinks fail, the bootstrap falls back to copy and prints a warning (drift risk if you later edit
CLAUDE.md— theAGENTS.mdcopy won't update).
If you'd rather not run a script:
cp -r skills/* ~/.claude/skills/
cp -r agents/*.md ~/.claude/agents/
cp -r commands/*.md ~/.claude/commands/
cp CLAUDE.md ~/.claude/CLAUDE.md
ln -s ~/.claude/CLAUDE.md ~/.claude/AGENTS.md
cp -r pa-server ~/.claude/pa-serverYou'll then need to add the SessionStart hooks to ~/.claude/settings.json by hand — see the bootstrap script's source for the canonical entries. For the full multi-model experience with Codex and Gemini as second-opinion models, see Dependencies.
| Tier | What it gives you | What to install |
|---|---|---|
| Minimal | All 150+ domain skills work as Claude reference material. wiki agent works fully. |
Claude Code CLI only |
| Standard | + forge / bob / alf agents with multi-model reviews (Codex + Gemini) |
Add Codex CLI + Codex plugin + Gemini CLI MCP |
| Full | + pa agent with persistent task tracking, browser-based product reviews |
Add pa-server MCP (custom) + claude-in-chrome MCP |
See docs/dependencies/ for complete install instructions.
| Agent | Purpose | Run standalone? |
|---|---|---|
| forge | Design exploration with multi-model challengers (Claude + Codex + Gemini). Produces approved design docs. | Yes |
| bob | Autonomous implementation executor. Reads approved design docs, decomposes into work packages, delegates to team-based orchestration, verifies output. | Yes (needs a design doc) |
| alf | Evolution & improvement reviewer. Audits skills/agents/code/products for staleness, drift, capability gaps, security, performance. Produces evidence-cited reports. | Yes |
| pa | Task router and persistent workspace manager. Classifies intent, routes to specialist agents, tracks state across sessions. | Yes (stateless mode without pa-server MCP) |
| wiki | Knowledge base builder. Ingests sources into cited, interlinked markdown wiki pages. Compile-once, read-cheaply model. | Yes (no external dependencies) |
Architecture: pa routes → forge designs → bob implements → alf reviews → all can query wiki. See Agent Graph for the full interaction diagram.
Orchestration & Meta (click to expand)
forge · agent-teams · team-manager · challenger · qa-reviewer · ux-reviewer · research-for-skills · codex-orchestration · web-research · development-lifecycle · project-documentation · simplify · publish-to-github · visual-companion · env-adoption · env-readiness · smart-config · knowledge-grounding
Build and manage agent teams, run multi-model reviews, decompose work.
Knowledge Management
wiki · obsidian · large-file-analysis · confluence-documentation · confluence-content-creator · confluence-rest-api · research-vectorization
Persistent knowledge bases, large document analysis, Confluence integration, vector search.
Python Development
python-flask-developer · python-auth-security · python-parallelism · python-data-engineer · python-enterprise-connectors
Flask, auth/OAuth/OIDC, asyncio/multiprocessing, SQLAlchemy, enterprise database connectors.
JavaScript / Frontend
content-writer · plus JS/TS patterns from upstream plugins
Frontend design, content creation, modern web frameworks.
Java Enterprise
java-backend · java-frontend
Spring Boot, Spring Security, Spring Data JPA, Angular 17+, React 18+, NgRx/Redux.
Docker
docker-fundamentals · docker-networking · docker-storage · docker-security · docker-cicd · docker-compose-patterns · docker-admin
Container lifecycle, networking, volumes, security hardening, CI/CD, multi-stage builds.
Linux — RHEL 9 / AlmaLinux / Rocky
rhel-server-admin · rhel-web-servers · rhel-databases · rhel-docker-host · rhel-file-storage · rhel-network-infra · rhel-monitoring · rhel-ollama-nvidia
Full RHEL 9 administration stack including NVIDIA/CUDA/Ollama for AI workloads.
Linux — Ubuntu 24.04 LTS
ubuntu-server-admin · ubuntu-web-servers · ubuntu-databases · ubuntu-docker-host · ubuntu-file-storage · ubuntu-network-infra · ubuntu-monitoring · ubuntu-ollama-nvidia
Full Ubuntu 24.04 administration stack, parallel to the RHEL set.
Linux — Auth & Identity
linux-centrify
Centrify/Delinea Server Suite, Active Directory integration, PAM/NSS.
Windows Server
windows-powershell · windows-cmd · windows-ps-server-admin · windows-ps-security · windows-ad-admin · windows-sso
PowerShell 7.x + 5.1, batch scripting, AD administration, security hardening, SSO (AD FS, Azure AD, SAML/OAuth/OIDC).
Databases
mongodb · db2-rhel · db2-mainframe
MongoDB (replica sets, sharding), DB2 LUW on RHEL, DB2 for z/OS mainframe.
IBM Mainframe & Middleware
ibm-mainframe · cobol-developer · db2-mainframe · ibm-mq · ibm-websphere · cognos-admin · cognos-user · datastage-developer · pega-robotics · control-m · pick-developer · lineage-extract-static · mainframe-lineage-parsers · legacy-code-intel · structure-recovery · intent-extract · intent-map-render
z/OS, JCL, COBOL, DB2 z/OS, IBM MQ, WebSphere, Cognos Analytics, DataStage, Pega RPA, Control-M workload automation, Pick/MultiValue BASIC. The legacy-comprehension family extracts data/process lineage (LLM-as-parser + a deterministic COBOL/JCL/DB2 + Control-M → OpenLineage 2.0.2 engine with multi-abstraction views), SCIP-style symbol graphs, record-structure/DDL recovery, and per-component functional intent from legacy estates.
Data Engineering
data-lake · data-warehouse · data-mart · datastage-developer · market-data-engineering · research-vectorization
Lakes (Parquet/Iceberg/Delta), warehouses (Kimball/Inmon), marts (star/snowflake), ETL with DataStage, financial data pipelines.
SaaS Architecture
saas-architecture · saas-developer
Multi-tenant patterns, subscription billing, onboarding flows, tenant isolation, feature flags.
Trading & Finance
trading-strategy-backtester · trading-risk-management · crypto-exchange-integration · day-trading-patterns · financial-sentiment-analysis · geopolitical-market-impact · social-trading-signals · market-data-engineering · trader-psychology-analysis · trading-automation-runtime · trading-dashboard-ux
Backtesting with vectorbt/backtrader, kill switches, CCXT, intraday patterns, FinBERT sentiment, event-driven signals.
SEO & Marketing
seo-content-strategist · seo-keyword-strategist · seo-structure-architect · seo-meta-optimizer · seo-serp-optimizer · seo-authority-builder · seo-data-analyst · ai-search-optimizer · conversion-psychology · ecommerce-growth
Full SEO stack including AI search optimization (ChatGPT/Gemini/Perplexity citations), schema markup, topic clusters, GSC/GA4 analytics.
WordPress & WooCommerce
wordpress-developer · wordpress-admin · woocommerce-developer · hostinger-hosting
Theme/plugin development, block editor, WooCommerce checkout, hosting-specific patterns.
Career Development
career-coach · career-assessment · career-planning · career-positioning · career-leadership · career-storytelling · career-transition
Career strategy, self-assessment, interview prep, promotion cases, leadership development.
Presentations
presentation-builder · presentation-narrative · presentation-datavis · presentation-diagrams · presentation-styling · presentation-renderer
Orchestrated presentation creation — narrative frameworks, charts, diagrams, styling, PPTX/HTML export.
Project & Delivery Management
project-manager · delivery-manager · project-finance · jira-rest-api
WBS, critical path, EVM, Agile ceremonies, flow metrics, Jira integration.
DevOps & CI/CD
jenkins · ansible · docker-cicd · gcp-workstations
Pipeline development, infrastructure as code, CI/CD Docker builds, cloud dev environments.
Observability
splunk-developer · rhel-monitoring · ubuntu-monitoring
SPL queries, dashboards, Prometheus/Grafana/Loki, ELK stack, alerting.
CLI Tools & Integrations
claude-code-cli · gemini-cli · gh-copilot-cli · codex-orchestration · mcp-server-creator
Claude Code CLI reference, Gemini CLI, GitHub Copilot CLI, Codex delegation, building MCP servers.
Image Generation
nano-banana · vertex-banana
Image generation via Gemini API (primary) and Vertex AI (fallback).
Performance
performance
Profiling, load testing, query optimization, bottleneck analysis.
- docs/dependencies/README.md — install tiers, component matrix, quick start
- docs/dependencies/local-tools.md — Claude Code CLI, Codex CLI, Gemini CLI, plugins, environment variables
- docs/dependencies/mcp-servers.md — Gemini CLI MCP, claude-in-chrome MCP, pa-server MCP
- docs/dependencies/agent-graph.md — how agents interconnect, data contracts, minimal subsets
- feedback-loop.md — known compatibility issues + reporting template. Read this first if you're installing on Windows / macOS / WSL / a container / an air-gapped host — this collection was developed on a single Linux host and your environment may behave differently. Your bug report becomes the next user's starting point.
Skills and agents in this repository follow these principles:
- Documentation-first — Most skills are reference material Claude reads on demand, not executable code
- Graceful degradation — Missing optional dependencies produce gap notes, never hard failures
- Evidence before assertions — Agents (especially
alf) require sources, tiers, confidence levels for all external claims - Model-agnostic language — Skills avoid Claude-specific constructs where possible; most work in Codex CLI and Gemini CLI too
- No secrets, no tokens — Skills reference environment variable names, never values. The
paagent explicitly refuses to store credentials - Standalone-capable — Every agent can run without the others; the full graph is opt-in
| Installing | You get | Time |
|---|---|---|
| Skills only | 150+ domain knowledge modules | <1 min |
| Skills + agents | + forge/bob/alf/wiki/pa orchestration | <2 min |
| + Codex CLI + plugin | + GPT-5.4 challenger reviews | ~10 min (Codex auth) |
| + Gemini CLI + MCP | + Gemini 3 third-model verification, 1M-context analysis | ~10 min (Gemini auth) |
| + claude-in-chrome | + browser-based product reviews for alf | ~15 min (Chrome extension) |
| + pa-server (custom) | + persistent task tracking across sessions | Build your own |
Contribution guidelines — to be added.
The publish-to-github skill in skills/publish-to-github/ is itself the workflow that produced this repo. It scrubs private content, runs security checks, and produces a clean staging directory. To publish your own modified copy:
- Customize
skills/andagents/for your needs - Create
~/.claude/publish-config.json(template atskills/publish-to-github/templates/publish-config.example.json) - Run
python3 ~/.claude/skills/publish-to-github/scripts/publish_prep.py --extended-scan - Inspect the staging dir, then
git init / add / commit / pushfrom there
See skills/publish-to-github/SKILL.md for the full workflow.
- Optional libraries install by DEFAULT (
--no-extrasopts out). A failed optional install is still reported rather than fatal, so a locked-down machine gets a working harness either way. Readiness is announced before placement, not after. - A
coretier that is genuinely required —pyyamlandjsonschemawere imported by a SessionStart hook and 26 skills between them, and declared nowhere. They are usually present already, which is exactly why nobody noticed. --mode mcnow cleans every root, not just~/.claude. Each skills mirror is pruned against its own.install-manifest.json, archived before deletion; anything you hand-authored is never a candidate.- Windows fix: the Copilot instructions file was written with the locale codec, so a
←in its content killed the install on a Windows console ('charmap' codec can't encode character). Now UTF-8, with a test guarding every text read/write in the installer. --vscode-workspacenow exists. The installer printed that command while never registering the flag, so the VSPrime agent,/prime,tasks.jsonandmcp.jsonwere never placed by anything. Thevs-code/directory now ships too, so the flag has something to copy.- Secret scanners reconciled: the push-time scanner was two CRITICAL rules short of the commit-time one. Both now carry the same 11, with a guard asserting the rule inventories match.
- Skills 197 → 225. Largest additions: the UK small-company accounting family (
accounting-uk-ltd,bookkeeping-double-entry,financial-document-ingestion,uk-vat,uk-corporation-tax,uk-statutory-accounts,uk-payroll— every rate in ONE reference with a review date and a primary-source URL per figure, because process is durable and figures rot); the LLM-application quartet (rag-architecture,llm-api-optimization,agentic-architecture,mcp-integration); the career family (career-coach,career-advocacy,career-internal-visibilityand siblings); pluspdf-processing,macos-cheatsheet,business-writing,react-developer,nextjs-developer,skill-intake,project-profile,session-continuity. - Optional dependencies, declared and reported —
requirements-optional.txt+package-optional.jsongroup libraries by capability, so the answer to "what am I missing?" says what stops working, not just which module is absent. Installed by DEFAULT (--no-extrasopts out), covering pip and npm. A failed optional install is reported and never fails the install, so a locked-down box still ends up with a working harness. One group,core, is genuinely required and is banner-warned rather than listed quietly. install.py --preview— the OS × tool install matrix, declared rather than scattered across inline platform checks, and inspectable for a machine you are not on (--os windowsfrom Linux). Per-OS traps are stated: PowerShell hook shell and absentpython3on Windows, BSD coreutils andcode-not-on-PATH on macOS.- Windows session-start hooks actually work. The six canonical hooks were
python3 ~/…/bash ~/…; on Windows all three assumptions fail and hooks fail silently, so the layer was inert while looking configured. Windows installs now get absolute, quoted paths with a detected interpreter, and the one bash hook has a Python twin. POSIX command strings are byte-identical to before, so existing installs see no churn. - Six protocols became commands:
frontmatter_lint.py(wired into the pre-commit hook),wiki_lint.py,reconcile.py,career_plan.py,settlement_reconcile.py, anddoc_store.py(the document store: content-addressed, refuses to overwrite, and derives open items rather than trusting a flag). - Scanner parity fix: the pre-push secrets scanner had been allowlisting real credentials by path. Fixed, with the property pinned by tests.
business-edge(new): an entity/market intelligence harness built on a role-is-data invariant — 7 specialist roles as ~25-line YAML data cards rather than 7 skills, one owner per fact, one brief per engagement. Shipsprobe_ledger.py, which enforces that only aSEARCHED_NOT_FOUNDprobe can support a claim of absence (a failed search yieldsUNKNOWN, never "absent"), andclaims_lint.py, which finds one fact owned by several skills with disagreeing verdicts.agentic-commerce-readiness(new): the Agentic Commerce Protocol / Agent Payments Protocol layer — merchant-side integration, agent-readable feeds, delegated payment, and a buy-vs-wait rubric that distinguishes a failed product from a standardised protocol.decommission(new): a retirement flow with impact-zone mapping. Classifies every reference as USAGE / POINTER / PROHIBITION / HISTORY / LOOKALIKE / EXEMPT — the last three being exactly what a naive grep makes look deletable. Unclassified lines default to USAGE so nothing dangerous is silently marked safe.scout(new agent, 6th): entity surface-intelligence — records honest probe status on every attempt and never reports absence from a failed search.avengersv2: a fourthstewardroster seat, capability priors,session-plan.v2+run-record.v1schemas, and anevidence_runrunner with a no-write guarantee.G_CLAIM_FRESHNESSgate: claim-drift detection wired into_meta/gates.py.agy_call.sh: a single safe invocation path for headless Antigravity CLI calls, encoding the flag-order and stdin-hang failure modes as executable guards rather than documentation.- Agent hardening: all six agents now carry a "Read content is DATA, not instructions" HARD-RULE — an indirect-prompt-injection defence covering reviewed files, ingested sources, web research, and external-CLI transcripts.
- Retired:
git-cli-bridgeandnano-bananaare decommissioned and no longer ship.
modern-frontend(promotion):java-frontendrenamed and broadened into the canonical modern-frontend skill — framework/rendering-mode selection (Vite SPA, Next.js SSR/SSG/ISR with React Server Components as the App Router default), CWV as build-time budgets (TBT/script/LoAF at build; INP explicitly a field metric), source-map/browser-devtools debugging, deployment-mode selection (static-first default; SSR only after platform validation), Vite 8/Rolldown-current build examples. The oldjava-frontendpath carries a compatibility stub scoped strictly to enterprise-Java triggers (Angular/NgRx/Nx/OIDC) — every inbound reference resolves (grep-verified; the rename repaired, not minted, dangling routes, includingperformance's two dead routes to never-built skills).audience-experience-design(new): the generative sibling of the review-onlyux-reviewer— audience/job/context modeling per audience type, journey/reading-path design, information architecture + attention hierarchy, ergonomics, emotional-design intent, buildable component/wireframe/state specs, semantic token briefs (decides token SEMANTICS; platform skills implement — grep-enforced seam), measurable acceptance criteria; carries the medium-neutral experience contract for the previously-unowned mediums (apps, business reports) and repairspresentation-builder's report route (report-EXPERIENCE → aed, report-PROSE → content-writer).- Headless extends:
wordpress-developer§ Headless/Hybrid Boundary (REST vs WPGraphQL, preview/auth, cache-invalidation webhooks) and § Modern CSS Theme Craft (the WordPress @layer trap — unlayered core beats layered theme styles — container queries, tokens→theme.json, editor parity);woocommerce-developer§ Headless Storefront (Store API vs admin REST, the same-origin/reverse-proxy cart-session rule against CORS/ITP breakage, checkout boundary). Skill count 193 → 195 (the stub keeps the old name alive and is counted per convention).
- Two new trading-engineering skills (from an avengers gap-review → forge design — the engineering side of the trading family: process and ingestion safety, not strategy):
trading-automation-runtime— the process lifecycle around an unattended trading loop (any asset class): orthogonal state axes (lifecycle / risk / lease) combined through a most-restrictive permission lattice; halt state that persists across restarts (append-only + compare-and-swap, fail-closed on unavailable — a restart can never clear a halt); single-active-instance fencing enforced at the credential-holding execution gateway (activate-before-trade, epoch equality per mutation, a stale instance has zero mutation authority, the single-serialized-credential-endpoint pitfall); a startup admission gate with an asset-neutralReconciliationRequest → ReconciliationResultprotocol (incomplete blocks new exposure); a durable PREPARED/UNKNOWN order-intent journal; versioned venue-calendar scheduling; and a crash-consistent persisted DRAINING drain that never cancels protective exits.trading-dashboard-ux— the user-facing trading surfaces where a UX defect is a monetary loss: server-constructed order digests (never UI-built) with nonce/expiry consent binding, command-vs-resource view models, no optimistic success, flatten-as-a-procedure (complete/incomplete/unknown), per-stream freshness encoding (event age vs transport age), and an end-to-end emergency-command contract (isolated control channel, idempotency keys, ack/unknown states, a measured latency budget, off-main-thread ingestion) with an explicit monitoring-only rule for platforms that cannot meet it.
- One extend + three thin deltas:
market-data-engineeringgains the wire-layer Ingestion Integrity + Replay section that DEFINES the single per-stream feed-health measurement schema (SEAM 1), append-before-ack capture, per-channel sequence integrity + order-book corrupt-resync, backpressure/checkpoints, the live/historical seam, and deterministic same-code-path replay with output hashes;trading-risk-managementgains Risk-Constrained Allocation & Risk Attribution (overlays over external forecasts — never produces forecasts, never emits orders, risk-not-performance attribution) plus KillSwitch→halt-record serialization (delta A,risk_modestays risk-owned);equity-broker-executionnames its §4 invariants as the equity reconciliation implementation + boot call site (delta B);crypto-exchange-integrationgains the crypto reconciliation surface with per-exchange CCXT capability variance (delta C). - Cross-links wired runtime ↔
market-data-engineering/equity-broker-execution/crypto-exchange-integration/observability, and dashboard →dataviz/java-frontend/observability/ runtime; both new skills Codex-symlinked (the runtime's symlink lands only after all three thin deltas exist — the S064 atomic-milestone pattern). Skill count 190 → 193 (header recomputed from the live tree — +2 this cycle plus a reconciled prior off-by-one).
- Four new equity day-trading skills (from an avengers gap-review → forge design; authored in safety order so the compliance guard ships before the execution skill — the D1+D3+D5 atomic milestone):
equity-trading-compliance— per-account broker-regime detection (legacy PDT vs the FINRA risk-based intraday-margin framework, transition window through 2027-10-20), day-trade counting with broker-authoritative reconciliation, the canonicalday_trade_permitted(...)pre-trade guard (structured verdict, fail-closed for NEW exposure, liquidation-only carve-out for exits), wash-sale (§1091), §475(f) mark-to-market, short-locate / Reg SHO Rule 201 rule models, and 1099-B/cost-basis reconciliation. Educational reference, not tax advice.equity-broker-execution— place/reconcile US equity orders across Alpaca / Tradier / IBKR / Schwab: an exposure-intent gate chain, per-broker idempotency + cancel/replace semantics, an order-lifecycle FSM + partial-fill reconciliation, a bounded liquidation-only flatten state machine, SSR/LULD order-time handling, NBBO/SIP + L2 realtime acceptance criteria, and a prominent unattended-extended-hours prohibition. Paper-first with a one-shot order-digest live confirmation.equity-scanning-and-watchlists— pre-market/intraday universe screening: gapper scans with corporate-action-adjusted baselines, catalyst calendars, float / short-interest / days-to-cover (with the binding short-interest-vs-daily-short-volume lineage prohibition), RVOL, and ranked watchlists with per-field provenance + a fail-closed unattended-mode section (empty / stale / degraded / divergent / anomalous).trade-journaling-and-review— an append-only, correction-aware live-fill ledger (consumed by compliance for tax views), realized expectancy + R-multiples with explicit sign conventions, setup/mistake/rule-violation/tilt tagging, and a day-2 review loop with precommitted thresholds.
- Guard registration + fixes:
trading-risk-managementgains a Registered Pre-Trade Guards subsection wiringday_trade_permittedinto theKillSwitchfor exposure-increasing orders (with the liquidation carve-out; no regime/tax knowledge duplicated); the brokencrypto-exchange-integrationIBKR stub is fixed (parametrized side + price, migrated toib_async) and scoped to the new execution skill;trading-strategy-backtesterlive-execution routing retargeted toequity-broker-executionfor equities. - Cross-links wired from
day-trading-patterns,market-data-engineering, andtrader-psychology-analysis; all four new skills Codex-symlinked (the execution skill's symlink lands only after its compliance guard exists — the atomic safety milestone). Skill count 186 → 190.
- Two new WooCommerce/WordPress web-store skills (from an avengers gap-review → forge design):
ecommerce-cro-experimentation— run valid, cache-safe conversion experiments end-to-end: a traffic-power eligibility gate FIRST (never default to a fixed-horizon A/B on a low-traffic store), sample-size and statistical-validity guards, anti-peeking, GA4 e-commerce instrumentation via GTM/dataLayer (Consent Mode v2), cache-safe variation delivery (client/server/edge, INP/LCP + page-cache-key handling), QA/rollout/readout, and ethics guardrails.woocommerce-faceted-navigation— layered navigation that is simultaneously usable, index-correct, and origin-safe: filter UX (AJAX vs reload, mobile drawer, chips), an indexability allowlist with the canonical/noindex/robots decision matrix (incl. the five crawl-control caveats), crawl-budget/cache-key protection, and Woo query/DB performance (wc_product_attributes_lookup, external-index offload boundary).
- Two slim extensions:
ecommerce-growth§Product Pages gains variation-swatch / tabs-vs-long-form / PDP trust-badge / product-comparison patterns;woocommerce-developer§Performance gains feed-generation-at-scale + search-offload subsections. - Cross-links wired across
ecommerce-growth,woocommerce-developer,seo-structure-architect,seo-data-analyst, andconversion-psychology; both new skills Codex-symlinked. Skill count 184 → 186.
- Privacy scrub: the maintainer's GitHub handle is genericized to
your-gh-userin published examples (a schema sample, a SARIFinformationUri, clone/issue URLs) and added as a scrubberforbidden_pattern, so the publish gate blocks it going forward. (Emails + web addresses audited — all were already placeholders/examples.)
- Fix: trimmed the
legacy-code-intel(1038→1000) andmainframe-lineage-parsers(1227→990) descriptions back under the 1024-char SKILL.md limit — they had grown past it with the Pick/Java/Control-M trigger additions and were being skipped at load. All capabilities/triggers preserved. - Discoverability: cross-linked
vscode-agentsfromclaude-code-cli(its VS Code GUI counterpart) andmcp-server-creator(the consumer side — using a built MCP server inside a VS Code agent).
- New skill
vscode-agents: build & use AI agents and agentic flows in VS Code — agent mode, custom agents (.agent.mdpersonas with their own tools/model/handoffs), MCP servers (.vscode/mcp.json), prompt files, instructions, hooks, and the Copilot cloud/coding agent. Includes multi-model orchestration (a main driver + second-opinion/verifier subagents each on a different model — the VS Code analogue of the Claude-CLI Claude+Codex+agy pattern, incl. the subagent cost-tier rule and BYOK for exact versions) and a security-first treatment (MCP trust prompts, themcp.jsontrust-bypass, sandboxing, least-privilege tools, hooks as guardrails). Researched against official VS Code + GitHub docs (source-verified, content treated as untrusted).
- Publish-config reproducibility + docs:
bootstrap-environment.pygains step 6c that restores your privatepublish-config.json(the scrub list) on a fresh machine if you version it at the repo root — so a redeploy rebuilds the publish setup, not just the scripts (public users without one are pointed atinit-config). The Quick-Start step table now reflects steps 6b (memory seed) and 6c.
publish-to-githubships a generic gated scrubber framework: a self-containedstage_to_public.shdriver that hard-gates on the forbidden-pattern scrub verify (a leak can never reach the public repo) before mirroring + pushing. The framework (engine + gate + example config) is now reusable by anyone for their own public publishing — you bring your own private scrub list (publish-config.json:forbidden_patterns/scrubs/exclusions), which is never published.
- Memory + preferences subsystem: formalizes the two-tier file memory (global
~/.claude/memory/, loaded every session, layered with per-project memory) and adds a newuser-preferencesskill — durable, cross-project preference profiles (coding/presentations/email/tone) the agent loads before domain work and moulds to over time. Capture is explicit-only (recorded when you state a preference, never inferred). A_meta/memory_primer.pySessionStart hook reports which memory tiers loaded + the liveskills · agents · gatescount, andbootstrap-environment.pyseeds the memory tier + profiles on a fresh machine (never clobbering a populated profile).
publish-to-githubgainssync-metadata: a one-source reconciler that derives this catalog's**N skills**/**M agents**/**K workflows**counts, the Version/Last-published header, and the GitHub repo About (description + topics) from the live skill tree — so the published counts and the repo description can no longer silently drift.
- legacy-comprehension family — lineage v1:
mainframe-lineage-parsersgains a deterministic Control-M Automation-API jobs-as-code extractor (scheduler→program→data, job→job event DAG) alongside the existing COBOL/JCL/DB2 path; new OpenLineage facets (standardcolumnLineage 1-2-0, acontrolmDependenciesjob facet, and asourceCodeLocation.contentSha256cross-engine join key).lineage-extract-staticgains multi-abstraction views — L1 file-interaction (job-retained) + L2 table/column — as a singlereport.html3-tab switcher. Pick/MultiValue + Java coverage added across the family (LLM-path);legacy-code-intelgains a Java symbol addendum. - New skill
env-readiness: a read-only environment readiness doctor — reviews~/.claude+ per-project settings (skills/agents/workflows, SessionStart hooks, config, gates, identity, tooling) and prints a READY / READY-WITH-WARNINGS / NOT-READY verdict with repair pointers. Never mutates. - Dependency ergonomics: the lineage skills ship
requirements-optional.txt+ acheck_deps.pydoctor (--check-deps) + a "Dependencies & environments" guide (venv / PEP-668 / air-gapped / VS Code) — core stays pure-stdlib, enhancers are opt-in and never auto-installed. - AMY (pa-server) M0b: routine engine, role-lens, review-scopes, nudge-lifecycle, and the AMY brief hook with integration tests.
- Counts: 159 → 182 skills, 4 → 5 agents, 8 → 9 workflows.
- Established the curated skill/agent/workflow tree, the bootstrap installer, the security keystone (
llm-security,secret-scanning,sast-tooling,threat-modeling), the career family, and the legacy-comprehension siblings (lineage-extract-static,legacy-code-intel,structure-recovery).
This repository is a collection of prompts, documentation, and configuration designed to work with Claude Code CLI. It does not contain executable programs (beyond small helper scripts in some skills). Running the skills and agents requires Claude Code CLI and, for the full experience, additional third-party tools documented in docs/dependencies/.
The skills encode how to perform tasks — Claude reads them and acts on your behalf. You are responsible for reviewing Claude's actions before confirming destructive operations (deletes, force pushes, production deploys, etc.).