Skills
Agent skills I actually run, refined over time. Download one as a ready to install package, or read the instructions and use them anywhere.
- Agents Playbook
Backend Practices
Language-agnostic standards for endpoints, services, handlers, queue consumers and background jobs, built on the premise that the API contract is the product and the network fails partially. Covers HTTP semantics, schema validation at the boundary, the error contract, layering, transactions and concurrency, idempotency, resilient calls with timeouts and retries, background work, caching, observability and testing. It specifically guards against two outage-grade mistakes that look fine in review: dispatching a job inside a transaction, and an HTTP client with no timeout. Ships with a review checklist for server diffs.
View skill → - Agents Playbook
Database Practices
Schema, query and migration standards for relational databases (PostgreSQL, MySQL, SQL Server, SQLite), with a section on non-relational stores. Written for the reality that migrations run against production while it serves traffic: column types and constraints as the last line of defense, indexing, query performance, keyset pagination, lost-update prevention, and zero-downtime migrations through expand/contract, batched backfills and a deliberate procedure for destructive changes. Its safe-versus-dangerous operation list prevents table-locking outages, and it catches the batch loop that silently skips half its rows. Ships with a review checklist for schema and query diffs.
View skill → - Agents Playbook
Frontend Practices
Framework-agnostic UI standards that load the moment an agent touches a component, page, form or client state, whether or not anyone asked for best practices. Built on four principles (the UI is a function of state, every async operation has four states, the browser already does this, users are on worse devices than you) and covering component boundaries, where each kind of state belongs, effect cleanup, forms, accessibility, performance, layout shift, design tokens and routing. Every rule is imperative, scoped to a trigger and paired with its cost, and a condensed review checklist ships alongside for auditing a UI diff.
View skill → - Agents Playbook
Git Practices
Commit, branching and collaboration standards that treat history as a communication medium rather than a backup log, and the commit as the unit of revert, review and bisect. Covers atomic commits, what a message must say and why, branching models, the never-rewrite-published-history rule, merge versus squash versus rebase, force-push safety, pull request size and review, what belongs in a repository, recovery with reflog, bisect and revert, tags and branch protection. Loads before every commit, PR, rebase or conflict resolution, and ships with a pull request review checklist.
View skill → - Agents Playbook
Playbook Builder
The skill that makes the Agents Playbook yours. It reads your repository first (topology, stack, real test and lint commands, CI, commit conventions as practised, existing agent instructions), then asks only the two or three questions no amount of reading can answer: what "done" means here, which parts of the codebase are dangerous, and what looks wrong but is deliberate. The result is a CLAUDE.md written as an ordered gate pipeline, from tracked issue through triage, design, implementation, review and an explicit commit and push authority boundary, to closing the loop. Each gate names a real tool, has a checkable exit condition and says what happens when it cannot close, so "you skipped Gate 5" becomes a precise complaint. It targets 20 to 40 real rules, never restates what tooling already enforces, and delivers a draft with every assumption marked.
View skill → - Prompting
Power Prompt
Turns any request into a self-contained, paste-anywhere prompt built to current prompt engineering standards, then keeps refreshing it as the conversation reveals more context.
View skill → - Agents Playbook
Security Practices
Defensive security standards that trigger whenever work touches auth, permissions, user input, uploads, secrets, tokens, PII or dependencies, even when security is never mentioned, because the highest-impact bugs arrive inside ordinary feature work. Covers authentication and sessions, object-level authorization and multi-tenant scoping, every injection class (SQL, XSS, command, path, template, deserialization, SSRF), file uploads, secrets, transport and browser headers, audit logging, data protection and supply chain. Grounded in fail-closed, least-privilege, never-roll-your-own-crypto principles, with a review checklist for a dedicated security pass.
View skill →