agent-skills

3D scene work in the browser — a scaffolder that emits a self-contained Three.js scene as one HTML file (CDN import, OrbitControls, three-point lighting, grid, and your chosen primitives laid out), plus the design discipline for making 3D scenes that don't look like tutorial demos. No build step; open the file in a browser.

Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations.

Fires real HTTP requests and validates responses against expectations — status code, JSON field values (dot-notation paths), latency budget, content-type — with stdlib urllib, no requests library, no curl subprocess. Use to verify endpoints from CI or an agent session, smoke-test a deploy, or prove an API behaves as documented before building on it.

Automates macOS apps via AppleScript and URL schemes — Notes, Reminders, Maps, Mail, Calendar, Terminal, Shortcuts, Contacts, Photos, App Store search, and Phone. Runs locally through osascript with no API keys and no network for the AppleScript operations. Each app's scriptability is honestly assessed; non-scriptable apps (VoiceMemos, Passwords, Find My, Activity Monitor, App Store listing) are documented with their real limitations rather than faked.

Takes screenshots of any macOS app window, the full screen, or an interactive region using the native screencapture command — zero dependencies. Capture a browser, Notes, a desktop agent app, or anything with a window. Use for visual QA evidence, app-state documentation, or "show me what X looks like right now".

Initialize a concise per-project working agreement for GPT-6 Astra sessions - identity gate, instruction priority, pre-authorized safe commands, done-definition. Use when a user working with Astra wants a lean behavioral agreement distinct from repo AGENTS.md.

Read-only reconnaissance pass over an unfamiliar codebase, system, or feature area to surface hidden risks before any code is written. Use when starting work in unfamiliar territory, before a risky change, or when the user says "blindspot pass", "what am I missing", or "scan for risks".

Generates a categorized changelog skeleton from conventional commits since a tag or ref — Added/Changed/Fixed/Documentation/Internal sections with scope annotations preserved. Deterministic; the agent writes prose, this provides the honest skeleton from git history itself.

A linter for AI answers that separates grounded, hedged, and bare factual claims — surfacing the unverified hard assertions most likely to be hallucinations. Use as a self-check gate before an agent ships a reply, or in CI over saved transcripts.

Strict, ice-cold code review protocol — nothing is assumed, everything is questioned, every claim requires evidence. Reviews a diff or change set across correctness, security, error handling, API contracts, performance, and test integrity, with mandatory severity ratings and a no-rubber-stamp rule. The LLM-driven review pass that diff-review's mechanical checks cannot do.

Flags newly written comments and docstrings in files or diffs so an agent must justify or remove them — BDD markers, lint/type directives, license headers, shebangs, and TODO/FIXME markers auto-pass. A standalone CLI port of oh-my-opencode's comment-checker hook, usable by any agent or CI without the OMO harness.

Audit an AI agent's per-turn context window like a cost center — rank what actually eats tokens (system prompt, skills, memory, tool schemas, gate code) and fail CI when the agent gets fatter. Use when token costs climb on a long-running autonomous agent or you suspect context bloat.

Parses a crontab, expands every schedule into concrete values, explains each job in plain words, and flags invalid lines, impossible schedules, and over-frequent jobs. Crontab syntax is write-only for most humans; this makes it readable. Stdlib-only, deterministic.

Use when writing, reviewing, refactoring, or modernizing CSS/Tailwind with source-validated patterns for resets, box sizing, focus styles, centering, aspect ratios, selectors, layout, modern CSS, progressive enhancement, older-pattern modernization, MDN Baseline support buckets, user-preference media queries (reduced motion, contrast, forced colors, reduced transparency), container size and style queries, @property, popovers, View Transitions, custom highlights, scroll-state queries, text-box trim, and typed attr().

Claude-grade visual design outside Claude Code — distinctive web/UI design direction, poster and canvas art philosophy, and a 10-theme styling library, portable to any agent that reads SKILL.md. Use when building or restyling a UI, landing page, poster, slide deck, static art piece, or any artifact that must not look AI-generated.

Fast mechanical review pass over a unified diff before a human or agent reads it. Flags debug output left in production paths, TODO/FIXME/HACK markers added by the change, trivial test assertions that prove nothing, and deleted tests. Chains sibling gates (secret-gate, comment-checker) so one command runs the entire mechanical layer. Deterministic, stdlib-only, reads a unified diff from stdin.

Extracts plain text from office and web documents with zero dependencies — docx, pptx, xlsx, html, markdown, and plain text, using only Python's stdlib (zipfile + xml.etree). No LibreOffice, no python-docx, no network. PDF delegates to pdftotext when installed, reporting honestly when it is not. Use when an agent needs to read, summarize, or compare documents without installing document tooling.

Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a CONTEXT.md, or recording or editing an ADR.

Prevents production crashes from environment variable drift. Compares a deployed .env against .env.example to find missing required keys, present-but-empty required keys, undeclared extra keys, and placeholder values left in the deployed file. Use before every deploy, in CI, or when onboarding a new environment — the

Generates a working Manifest V3 browser extension skeleton — manifest.json, background service worker, content script, and popup — valid on first load in Chrome/Edge/Firefox with no npm and no bundler. Refuses to overwrite an existing directory. Use when starting any browser extension instead of writing boilerplate.

Find overlap and dead weight in a Python gate layer by extracting AST fingerprints, generating an overlap matrix, and failing CI when redundant gates or too many gates are detected.

Help address review/issue comments on the open GitHub PR for the current branch using gh CLI; verify gh auth first and prompt the user to authenticate if not logged in.

Use when a user asks to debug or fix failing GitHub PR checks that run in GitHub Actions; use `gh` to inspect checks and logs, summarize failure context, draft a fix plan, and implement only after explicit approval. Treat external providers (for example Buildkite) as out of scope and report only the details URL.

MUST USE whenever a task needs a commit or git-history investigation. Covers atomic commits, staging, commit-message style, rebase, squash, fixup/autosquash, blame, bisect, reflog, git log -S/-G, and questions like who wrote this or when was this added. Do not use for ordinary code edits unless the user asks for git work.

Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.

Drive Herdr, a terminal workspace manager for AI coding agents, from any agent client (Claude Code, Codex, pi/senpi, Gemini, OpenCode, Kimi, Grok, Cursor, Hermes, and more). Covers the entire surface - workspaces, tabs, panes, agent lifecycle, worktrees, remote machines, integrations, config, and the 103-method socket API - so a client can build terminal layout, start and prompt sibling agents, read their output, wait on state changes, and coordinate parallel work. Use when the user mentions Herdr or when panes, tabs, sibling agents, or a persistent terminal session must be inspected or controlled.

Semantic diff between two JSON documents reported by JSON path — added, removed, changed with old/new values, recursing nested objects and comparing arrays positionally. Use when `diff` on JSON is useless (key reordering, formatting noise), for config drift checks, API response comparison, or CI gates on expected output.

Set a 1.0-10.0 engineering working-mode dial - tunes agency, collaboration, assumption budget, decision ownership, questioning, verification, and security posture from fast prototype to maintainer-grade. Use when the user mentions "Linus Level", "LL <n>", asks to set rigor/strictness/maintainer mode, calibrate agent autonomy or coworker mode, or distinguishes prototype vs production / established-codebase / mission-critical work.

Groups a log file's errors by pattern and ranks offenders — normalizes volatile tokens (timestamps, UUIDs, IPs, paths, numbers) so "connection refused to db-01" and "db-99" count as one problem seen N times. Handles both level-tagged logs (ERROR/WARN/INFO) and exception-style stack logs (DaemonError:, Traceback). Offline, stdlib-only, deterministic.

Record a place where the code forced a deviation from the agreed plan. Use mid-implementation whenever reality contradicts the plan, or when the user says "log this deviation". The log feeds future planning and the merge quiz.

Configure a Language Server (LSP) for a specific language so editor/agent tooling — diagnostics, go-to-definition, find-references, rename — works. Use when you need to: configure LSP, lsp setup, set up or install a language server, fix 'no LSP server configured' / 'server not installed', choose between servers (basedpyright vs pyright vs ty vs ruff), or wire .codex/lsp-client.json / .opencode/lsp.json. 언어서버 설정. Routes by file extension to references/<language>/README.md for the exact builtin server, per-OS install commands (macOS/Linux/Windows), config snippets for both config files, initialization options, alternatives, and troubleshooting. Ships scripts: detect-lsp.ts (scan a project for languages + each server's install/config status) and verify-lsp.ts (run a real diagnostics roundtrip). Covers typescript, python, go, rust, c/c++, java, kotlin, c#/razor, swift, ruby, php, dart, elixir, zig, lua, bash, yaml, terraform, haskell, julia.

Pre-merge comprehension gate that quizzes the USER on the riskiest parts of the branch diff. Use before merging or opening a PR, or when the user says "merge quiz", "am I ready to merge", or "quiz me on this diff".

Drafts, revises, and audits reader-first technical and product documentation. Use when working on developer docs, procedures, release notes, technical explanations, help-center content, or UI copy where clarity, source fidelity, accessibility, or global readability matters. Do not auto-apply it to marketing, legal, academic, fictional, or personal writing unless the user explicitly requests this style.

Network diagnostics with only the stdlib socket/ssl modules — port checks (connect-based, not SYN-scan), DNS resolution, TLS certificate expiry with day budget, and HTTP latency sampling. The "is it up, is it reachable, is the cert about to die" triage without nmap, dig, or openssl.

Extracts the unresolved commitments, deferrals, decisions, and open questions from a conversation transcript into a small JSON ledger — so a different surface (a cron job, a trigger, a fresh session) can pick them up instead of dropping them. Use to hand off context across surfaces, or to gate a session/thread handoff on how much is left open.

Analyzes an exported portfolio CSV for concentration risk, asset-type allocation drift, and gain/loss. Reads a file you exported yourself (no login, no network, fully offline and deterministic) and warns when any single position or asset class exceeds your stated limits. Covers stocks, crypto, ETFs, and any asset type you label.

Remove AI-generated code smells (slop) from branch changes or an explicit file list. Locks behavior with regression tests FIRST, then runs categorized cleanup via parallel `deep` agents in batches of 5, then verifies with quality gates. Covers 10 slop categories including performance equivalences, excessive complexity (object annotations, if/elif variant chains), and oversized modules (250+ pure LOC with mandatory modular refactoring). MUST USE when the user asks to "remove slop", "clean AI code", "deslop", "clean up AI-generated code", "remove AI slop", or wants to clean up AI-generated patterns from recent changes. Triggers - "remove ai slops", "clean ai code", "deslop", "cleanup AI generated", "remove AI slop", "clean up AI-generated code", "strip slop", "ai-slop cleanup".

Scores a resume's structure, quantified impact, and ATS keyword coverage against a job description. Reads markdown or plain text (convert PDF/docx first with doc-reader) and checks contact info, standard sections, quantified bullet ratio, action-verb openers, weak phrases ("responsible for"), and — given a JD — which required keywords are missing. Offline, deterministic, no LLM needed.

Grades the HTTP security headers of a URL — HSTS, Content-Security-Policy, framing protection (X-Frame-Options/frame-ancestors), X-Content-Type-Options, Referrer-Policy, and cookie Secure/HttpOnly flags — with an A-F letter grade and per-header pass/warn/fail. Stdlib-only fetch, no browser.

Blocks credentials from entering code, diffs, or agent output. Scans files or a unified diff for known key formats (AWS, GitHub, OpenAI/Anthropic-style, Slack, GCP, private keys, JWTs, assigned passwords) plus high-entropy assigned strings — offline, stdlib-only, no gitleaks binary. Use as a pre-commit gate on agent-written diffs, before pasting config into a session, or in CI.

Scores on-page SEO for HTML files — title length, meta description, single h1, image alt text, canonical link, Open Graph tags, and html lang. Reads a saved HTML file or stdin (from curl), fully offline and deterministic, no Lighthouse or browser needed. Use before publishing any page, in CI on static builds, or when auditing a site without spinning up a browser.

Carries work context between AI agent clients. Reads session logs from every installed client's native store (Claude Code JSONL projects, Codex rollout JSONL, OpenCode SQLite, Gemini CLI chats), and produces a portable handoff briefing — what was asked, what was done, files touched, last state — so a session in one client can continue work started in another. Use when switching clients mid-task ("bring everything I worked on in Codex into this Claude session"), resuming after days away, or auditing what any client did recently.

Generates a RULE.md from a project's AI-session history by extracting every moment the human corrected the agent — "no, never use jwt", "always run tests first", "we use sessions not tokens". The highest-leverage context file a project can have is the one built from its own history of mistakes. Reads Claude Code, Codex, and OpenCode stores (same conventions as session-handoff), fully offline.

Security-scans third-party agent skills before you trust them. A SKILL.md is executable authority — agents follow it with your credentials and filesystem. Detects prompt-injection patterns (instruction overrides, concealment directives), data-exfiltration signatures (sensitive paths + network sends), and dangerous script patterns (pipe-to-shell, eval-on-download) in any skills directory. Offline, deterministic, stdlib-only.

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

Find declared-but-unused skills, tools, or plugins by cross-referencing an inventory (SKILL.md files or a name list) against real usage logs, and fail CI when the dead weight grows past a budget.

Optimizer that refines and professionalizes AI agent skills through real usage — saves tokens, eliminates redundancy, and tightens instructions so skills cost less to run. Learns from mistakes, reviews quality, and improves over time. Observes skill execution in the current conversation, analyzes up to four sources (conversation friction, file diffs, user feedback, static diagnostic) plus accumulated lessons, and proposes concrete improvements to the target skill's SKILL.md. Works with Claude Code and compatible SKILL.md-based agent frameworks. Use after executing any skill: `/skill-optimizer [name]` or `/skill-optimizer` to auto-detect. `--review` processes accumulated lessons.

Finds the right skills for your workload from the catalogue. Queries catalogue.json (generated from the actual skills/ directory, never hand-maintained) by persona, family, keyword, or tag, and outputs matching skills with install commands. Use it to answer "what should I install for X" without reading every SKILL.md.

Discovers custom skills across every AI provider install on the machine — Claude Code, Codex, OMO, gjc, OpenCode, Gemini, Cursor, Factory, and plugin caches — and unifies them into one universal directory (symlinks by default) so any SKILL.md-reading agent can use all of them. Reports provenance, dedupes by name and resolved path, and surfaces cross-provider conflicts.

Finds the recurring charges (subscriptions) hiding in a bank or credit-card CSV, tells you the true monthly and yearly cost, and flags the ones that look forgotten — a free trial that started charging, or a service that quietly kept billing after you stopped using it. Reads a statement you exported yourself; no bank login, no third-party service, fully offline and deterministic.