Loading...
Loading...
Found 40 Skills
Detects ESLint configuration and available commands in a repository. Returns structured JSON output designed for consumption by the quality-gates-linter agent. Checks for ESLint config files, extracts lint commands from package.json, Makefile, and CLAUDE.md, and provides command sources for the agent to read directly.
PostHog developer CLI and repo tooling reference. Use when the user mentions hogli, asks about repo CLI tools, bin scripts, Makefiles, how to run/build/test/lint, or any dev environment commands.
Manage `chronic` wrapper for suppressing noisy command output in shell commands. Use this skill proactively whenever: (1) Running shell commands that produce verbose output on success (builds, linters, formatters, tests, migrations, deploys), (2) A command wrapped in chronic is hiding output you or the user actually need to see, (3) Reviewing or writing Justfiles, Makefiles, CI scripts, or shell scripts that invoke build/check/lint/test commands. Chronic runs a command silently on success but shows full output on failure.
Lint Docker Compose files for Makefile-first deployment environments using .deploy.env.common + .deploy.env.<ENV_MODE>. Use when validating local/test/prod/custom compose files for image/build declaration, restart, healthcheck, logging, and external network settings.
MUST USE for anything related to mise, development tool versions, or dev environment setup. Triggers: (1) User mentions mise, mise.toml, .tool-versions, or mise commands like 'mise use', 'mise install', 'mise run'. (2) User wants to install, switch, pin, upgrade, or check versions of dev tools — node, python, go, ruby, java, rust, etc. — at project or global level, even without mentioning mise (e.g. 'set up node 22', 'what python version', 'upgrade go', 'check for outdated tools', 'configure dev environment'). (3) User wants to manage per-project environment variables via config files (e.g. 'add DATABASE_URL env var', 'set up env vars for different environments'). (4) User wants to define or run project tasks via mise (e.g. 'create a build task', 'run tests with mise'). Do NOT trigger for: Dockerfiles, package.json scripts, Makefiles, nvm/pyenv/rbenv commands, pip/npm package installation, git tags, CI/CD config, or deployment.
Create, edit, migrate, check, and inspect just/justfile runners. Use when changing justfiles, migrating Makefile/npm scripts to just, linting house-style justfiles, or discovering via just --list/--show/--dump. NOT for shell scripts (shell-scripter), shell conventions (shell-conventions), CI YAML (devops-engineer), Make mtime builds, Compose, or mise.
Use just for command running and task automation. Prefer Justfiles over Makefiles. Keep recipes simple - delegate complex logic to scripts rather than embedding in recipes.
Systematic GitHub Actions workflow authoring skill for AI coding agents. Analyzes repositories to determine project type, language ecosystem, and deployment targets, then generates production-grade CI/CD workflows with proper security hardening, caching, and optimization. Handles greenfield projects (no workflows exist), brownfield updates (modify, optimize, secure existing workflows), and workflow audits with workflow-specific guidance for each. Use when the user requests GitHub Actions workflows: CI pipelines, CD deployments, release automation, scheduled jobs, or any .github/workflows YAML authoring. Also use when existing workflows need auditing, optimizing, securing, or restructuring. Triggers on phrases like "set up CI", "add CI/CD", "GitHub Actions workflow", "release automation", "deploy on tag", "publish to npm/PyPI", "schedule a job", "cron workflow", "matrix build", "workflow.yml", "actions/checkout", "permissions", "harden this pipeline", "pin actions to SHA", "OIDC", "least privilege", "supply-chain", "audit my workflows", "speed up CI", or "cache dependencies". Triggers when creating or editing files under `.github/workflows/`, `action.yml`/`action.yaml` (composite or Docker actions), or `.github/dependabot.yml`. Triggers when the user mentions migrating from GitLab CI, CircleCI, Travis, Jenkins, Drone, or Buildkite to GitHub Actions. Do NOT use for non-GitHub CI systems (GitLab CI, CircleCI, Jenkins) unless the user is migrating TO GitHub Actions. Do NOT use for general bash scripting, Makefiles, or local-only build configuration.
Guidance for building Caffe from source and training CIFAR-10 models. This skill applies when tasks involve compiling Caffe deep learning framework, configuring Makefile.config, preparing CIFAR-10 dataset, or training CNN models with Caffe solvers. Use for legacy ML framework installation, LMDB dataset preparation, and CPU-only deep learning training tasks.
Estandariza proyectos personales y académicos con las convenciones de Jan Polanco Velasco: Python con uv/Astral (3.13+), src-layout, Ruff, pre-commit, Makefile, pytest, CONSTITUTION.md como fuente única de verdad, Conventional Commits, README con badges, licencia MIT, gobernanza GitHub (PR/issue templates, CI, Dependabot, labels), contexto para agentes (AGENTS.md, .opencode/, tgrep), identidad Git automática (includeIf; perfil Jan o perfil propio en macOS/Windows) y diagramas de arquitectura con Archify. Úsala al crear o estandarizar un repo, redactar un CONSTITUTION.md, configurar uv/Ruff/pre-commit/CI, añadir un Makefile o README, configurar la identidad Git automática, generar un diagrama con Archify, o conectar el proyecto a GitHub. Use when scaffolding a Python repository, writing a CONSTITUTION.md, setting up uv, Ruff, pre-commit or CI, configuring automatic Git identity, generating an Archify diagram, or standardizing a project.
Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses dependency confusion across npm, PyPI, and NuGet ecosystems where internal registry override allows an attacker to inject malicious packages that shadow private dependencies. Covers typosquatting techniques for popular packages, compromised package injection via maintainer account takeover or social engineering, and build system attacks through Makefile injection, setup.py install hooks, and npm postinstall scripts. Extends into CI/CD artifact tampering where build outputs are replaced or modified in transit, code signing abuse through stolen or self-signed certificates, upstream repository compromise via commit injection or force-push to trusted repos, and container image supply chain attacks including base image trojaning and registry confusion. Maps to MITRE ATT&CK T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools) and T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Integrates tooling such as confused for dependency confusion scanning and dependency-check for known vulnerable component detection. Each technique section provides reproducible proof-of-concept patterns, detection guidance for defenders, and engagement-safe execution notes for authorized red team operations.
Automake owns a Git-backed ratchet for safely improving a repository through separate optimizer and evaluator roles: it establishes a baseline, proposes and checks candidates, obtains an independent comparison against the current committed state, keeps accepted changes, and restores rejected ones exactly. It triggers when the request is to prepare or execute this bounded improvement workflow, draft or approve its role instructions, set limits or stop conditions, protect local files, initialize the baseline, or invoke `/automake`. It does not trigger when “automake” refers to the GNU build system, when the task is merely a Makefile target or normal bug fix, when the user only wants code review or an explanation, or when the request is generic branch reset or deleted-file restoration.