Agent Skills for engineering teams: one repository, profiles by stack, installation in a single command.
Skills compatible with Claude Code, Codex, Cursor, Copilot, Gemini CLI, OpenCode and every other client that supports the Agent Skills format.
This is the part worth reading before the install command.
Every rule in here was paid for. Not collected from articles, not generated from a prompt: extracted from more than a year of shipping production software with coding agents — the reviews, the regressions, the things that were green and wrong, the corrections a human had to make twice. Across more than a dozen repositories and several stacks, in code that real users depend on.
That is the difference between a skill and a style guide. An agent already knows what a transaction is; what it does not know is that this pattern, in this situation, looks correct and silently is not — and that is the only thing worth spending context on.
The strongest rules came from independent convergence: when stacks that share no line of code arrive at
the same conclusion on their own, it gets promoted to core and installed everywhere, regardless of how
many are already there. There is no cap.
And nothing about where a rule came from ever ships with it — no incident, no customer, no person, no date. That one is enforced by a check that fails, not by good intentions.
Two ways in: what is in each profile, grouped by what you install, and every skill, one by one at the foot of the page, with the full description and the trigger of each. Both are generated from the skill frontmatter; the same index in machine-readable form is CATALOG.md and profiles.json.
Install from the directory — the repo is listed in the Agent Skills directory at
skills.sh/padosoft/skills: npx skills add padosoft/skills --list shows
what is inside, --skill <name> installs just one. Profiles (below) stay the recommended route.
# 1. the cross-project skills, valid on every project (few of them, to keep context light)
curl -fsSL https://raw.githubusercontent.com/padosoft/skills/main/scripts/install-profile.sh | bash -s -- core --global
# 2. the stack of the project you are working on (from the project folder)
curl -fsSL https://raw.githubusercontent.com/padosoft/skills/main/scripts/install-profile.sh | bash -s -- api devopsThe core profile installs the cross-project skills — the ones that stacks sharing no line of code
arrived at independently, which is what earns a place there. It starts with the router, which from
then on tells you by itself which skills are missing for the project you open, and the skill
creator, for when you want to add one. The rest are listed under
core in the index below. If you do not know which profile you need,
install core and ask the agent.
Windows (PowerShell):
irm https://raw.githubusercontent.com/padosoft/skills/main/scripts/install-profile.ps1 | iex
Install-PadosoftSkills core -Global44 skills across 10 profiles, grouped by what you install. A skill that belongs to two profiles appears in both. The complete list with descriptions is at the end; make catalog refreshes both.
| Skill | The rule | Scope |
|---|---|---|
padosoft-agent-instructions-sync |
A rule one agent knows and the others do not is worse than no rule. | global |
padosoft-atomic-invariants |
Either the invariant is recorded in the same atomic step that checked it, or it does not exist. | global |
padosoft-auth-hardening |
Identity is a set of doors, and hardening means none of them disagrees with the others. | global |
padosoft-contract-changes |
Changing a signature is editing everything that agreed to it. | global |
padosoft-crash-triage |
Never write a claim stronger than the evidence you actually have. | global |
padosoft-docs-match-code |
Every fact quoted from the code is verified against the code before merging. | global |
padosoft-environment-gating |
The answers are three, not two — a convenience defaults off, a protection defaults on. | global |
padosoft-evidence-boundaries |
Name the claim, then name what would prove it. | global |
padosoft-failure-visibility |
The caller must be able to tell success from failure, and a check that does not decide is not a check. | global |
padosoft-git-commit-integrity |
What git recorded is not always what you changed. | global |
padosoft-knowhow-harvest |
Harvest the rule, leave the story, and record what you decided so nobody mines it twice. | global |
padosoft-logging-discipline |
Keep the diagnosis, drop the data — and the log is not the only way data gets out. | global |
padosoft-security-baseline |
A control you cannot prove is a control you do not have. | global |
padosoft-skill-creator |
Skills that follow the spec and the repo conventions, and carry no provenance out with them. | global |
padosoft-skills-router |
Work out which skill is needed right now, and how to install it. | global |
padosoft-tenant-isolation |
The scope belongs to the key, not to the filter. | global |
padosoft-test-integrity |
A test that cannot fail is worse than no test. | global |
padosoft-verify-before-writing |
Never invent silently — ask, or record the doubt and report it. | global |
./scripts/install-profile.sh core --global| Skill | The rule | Scope |
|---|---|---|
padosoft-admin-interface |
A back-office screen is a filtered query with a chart on top, and four states that must all exist. | project |
padosoft-database-design |
The index, the key and the partition are part of the table's design, not a later fix. | project |
padosoft-frontend-testability |
The markup owes the test a stable anchor and an observable state. | project |
padosoft-i18n-hygiene |
A key is only unused once you have searched for every form it can be written in. | project |
padosoft-laravel-conventions |
Where the logic lives and what crosses which boundary, on any framework version. | project |
padosoft-laravel-scaffolding |
The code is the easy part — what gets forgotten is the wiring. | project |
padosoft-laravel-security-review |
Ten checks plus three rules whose cost is disproportionate to how easy they are to get wrong. | project |
padosoft-query-performance |
The code was written against the volume that existed then, and the volume moved. | project |
./scripts/install-profile.sh laravel| Skill | The rule | Scope |
|---|---|---|
padosoft-api-security-review |
Ten checks on an API change, each carrying the mistake that produces it. | project |
padosoft-edge-worker-security |
When two layers could enforce a control, each assumes the other does and nobody does. | project |
padosoft-frontend-testability |
The markup owes the test a stable anchor and an observable state. | project |
padosoft-hono-api-conventions |
Three layers one direction, typed context, bound SQL, and the mistakes that keep returning. | project |
padosoft-i18n-hygiene |
A key is only unused once you have searched for every form it can be written in. | project |
padosoft-openapi-spec-workflow |
A published contract other projects depend on — change it in every place, once. | project |
./scripts/install-profile.sh node| Skill | The rule | Scope |
|---|---|---|
padosoft-frontend-testability |
The markup owes the test a stable anchor and an observable state. | project |
padosoft-i18n-hygiene |
A key is only unused once you have searched for every form it can be written in. | project |
padosoft-mobile-security-review |
The bundle ships to every device and can be decompiled — everything follows from that. | project |
padosoft-react-native-conventions |
The rules that survived independently in two production apps. | project |
padosoft-rn-screen-scaffolding |
What breaks is never the code, it is the registration. | project |
./scripts/install-profile.sh react-native| Skill | The rule | Scope |
|---|---|---|
padosoft-email-html-builder |
HTML email that passes the deliverability checks on the first send. | project |
./scripts/install-profile.sh email| Skill | The rule | Scope |
|---|---|---|
padosoft-agent-host-boundaries |
The host decides what an agent may do, what gets recorded, and what any of it proves. | project |
padosoft-api-security-review |
Ten checks on an API change, each carrying the mistake that produces it. | project |
padosoft-durable-effects |
A queue moves work, not effects — claim the effect atomically before performing it. | project |
padosoft-edge-worker-security |
When two layers could enforce a control, each assumes the other does and nobody does. | project |
padosoft-hono-api-conventions |
Three layers one direction, typed context, bound SQL, and the mistakes that keep returning. | project |
padosoft-openapi-spec-workflow |
A published contract other projects depend on — change it in every place, once. | project |
padosoft-rag-ingestion-security |
The ingestion contract records what a document is, not where its authority comes from. | project |
./scripts/install-profile.sh api| Skill | The rule | Scope |
|---|---|---|
padosoft-payments-reconciliation |
Money is a ledger that has to balance, not a status field. | project |
./scripts/install-profile.sh payments| Skill | The rule | Scope |
|---|---|---|
padosoft-database-design |
The index, the key and the partition are part of the table's design, not a later fix. | project |
padosoft-durable-effects |
A queue moves work, not effects — claim the effect atomically before performing it. | project |
padosoft-query-performance |
The code was written against the volume that existed then, and the volume moved. | project |
padosoft-rag-knowledge-base |
A model may propose knowledge; only a human promotes it. | project |
./scripts/install-profile.sh data| Skill | The rule | Scope |
|---|---|---|
padosoft-ci-failure-triage |
The failed step says where the run stopped, not why — collect everything before diagnosing. | project |
padosoft-ci-workflow-gates |
A gate that cannot fail is not a gate. | project |
padosoft-cross-platform-scripting |
The ways a Windows workstation and a Linux runner disagree silently. | project |
padosoft-pr-review-triage |
A bot review is a list of candidates, not a task list. | project |
./scripts/install-profile.sh devops| Skill | The rule | Scope |
|---|---|---|
padosoft-agent-host-boundaries |
The host decides what an agent may do, what gets recorded, and what any of it proves. | project |
padosoft-ai-evaluation |
A number without a dataset version and a run identity is not a measurement. | project |
padosoft-rag-ingestion-security |
The ingestion contract records what a document is, not where its authority comes from. | project |
padosoft-rag-knowledge-base |
A model may propose knowledge; only a human promotes it. | project |
./scripts/install-profile.sh aiProfiles are declared in the frontmatter of each skill and collected in profiles.json,
generated by CI. The rule of thumb:
| Scope | What to install | Why |
|---|---|---|
Global (--global) |
The core profile only |
Every global skill loads its name and description into every session: keep them few and cross-cutting |
| Project | The stack of that repository (ai, api, data, devops, email, laravel, node, payments, react-native) |
Skills travel with the project, not with the machine |
| Never global | Narrow-domain skills (e.g. POS protocols) | They would trigger out of place everywhere |
Which skills a profile carries is in the index above; both that table and the
full list at the foot are regenerated by make catalog and verified by CI, so neither can drift from the
frontmatter.
Practical tip: commit .claude/skills/ into the project repository. Whoever clones it finds the right
skills with no onboarding, and without knowing this repo exists.
# by profile
bash scripts/install-profile.sh --list # available profiles and what they contain
bash scripts/install-profile.sh core --global # core profile, global installation
bash scripts/install-profile.sh api devops # two profiles, in the current project
bash scripts/install-profile.sh core --dry-run # print the commands without running them
# a single skill
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-email-html-builder
# from the directory listing (skills.sh/padosoft/skills)
npx skills add padosoft/skills --list # what the repo contains, without installing
npx skills add padosoft/skills --skill padosoft-skills-router # just one of them
# the whole catalog (not recommended: it installs what you do not need as well)
npx skills add padosoft/skills
# maintenance
npx skills update # update to the latest published version
npx skills list # what is installed and where
npx skills remove padosoft-email-html-builder # uninstallThe only prerequisite: Node.js 18+. No account, no sign-up.
The repo is also a marketplace: packages group the skills by profile, so you install what you need and Claude handles the updates.
claude plugin marketplace add padosoft/skills # once
claude plugin install padosoft-core@padosoft # cross-project skills
claude plugin install padosoft-api@padosoft # API package (security, Hono, OpenAPI)
claude plugin install padosoft-react-native@padosoft # React Native / Expo package
claude plugin install padosoft-laravel@padosoft # Laravel package
claude plugin install padosoft-email@padosoft # email package
claude plugin marketplace update padosoft # check for and download updatesInside a session, /plugin marketplace add padosoft/skills, /plugin install padosoft-email@padosoft and
/reload-plugins do the same. Do not install the same skill through the CLI and as a plugin: the agent
would see it twice.
The CLI does not reach the apps: there you upload a zip of the individual skill folder.
- Zip
skills/<skill-name>/. - Customize → Skills → "+" → Upload a skill.
- Code execution has to be enabled (Settings → Capabilities).
Codex reads skills from .agents/skills/ in the repository and from ~/.agents/skills/ for the user, and
picks up changes by itself. npx skills add already writes to the right path; alternatively, copy the folder
by hand.
skills/
├── .claude-plugin/marketplace.json # the packages installable in Claude Code
├── plugins/ # one manifest per package (core, api, devops, email, laravel,
│ # payments, react-native)
├── skills/ # one folder per skill, 33 of them
│ └── padosoft-<name>/
│ ├── SKILL.md # frontmatter + the rule; under 500 lines
│ ├── references/ # detail loaded on demand, when SKILL.md says to
│ ├── scripts/ # standard library only, distinct exit codes, --help
│ └── evals/queries.json # the queries that must, and must not, trigger it
├── scripts/
│ ├── install-profile.sh|.ps1 # per-profile installer
│ ├── build_catalog.py # generates CATALOG.md, profiles.json, the router catalog
│ │ # and both generated sections of this README
│ └── validate_plugins.py # manifest consistency and skill coverage
├── tests/ # catalog, profiles, installer, provenance gate, email linter
├── evals/ # activation queries for the descriptions
├── CATALOG.md · profiles.json # generated: never edited by hand
└── Makefile # make all
What every skill is and when it fires is at the foot of this page, generated from the frontmatter — the tree above deliberately does not repeat it.
The conventions are not something to memorise: padosoft-skill-creator
applies them, and it ships with the core profile.
The fast way — with core installed, in an agent session:
"Let's create a skill for the Padosoft Laravel conventions"
The agent loads the meta-skill and walks you through it: gathering the know-how from the real source,
choosing profile and scope, scaffolding, writing the description and the body, evals, checks. The result is
a skill that passes make all.
The manual way — scaffolding from the command line:
python3 skills/padosoft-skill-creator/scripts/new_skill.py laravel-conventions \
--profiles laravel api --scope project --title "Padosoft Laravel conventions" --with-scriptsThis creates skills/padosoft-laravel-conventions/ with a pre-filled SKILL.md, references/,
evals/queries.json and the skeleton of a validator. It rejects unknown profiles and scope: global without
the core profile: the same rules as CI, applied before you write a single line. Then:
- Fill in the
descriptionand the body. Thedescriptiondecides whether the skill triggers: the meta-skill explains how to write it (concrete situations, explicit boundaries) and lists the mistakes that make it useless. make catalogregeneratesCATALOG.md,profiles.jsonand the catalog inside the router.- Add the skill to a package in
plugins/, otherwise it stays invisible to anyone installing from Claude Code and CI fails. make allhas to pass.- Try it in a fresh session on a real task: the corrections you end up making become the skill's gotchas. A single iteration of this kind changes the result a lot.
The frontmatter that decides the placement:
metadata:
profiles: laravel, api # one or more profiles
scope: project # project or global (global implies the core profile)Before the PR, the review checklist: it lists the symptoms and their cause ("the skill never triggers" → a description written from the skill's point of view instead of the user's; "the agent ignores a rule" → it sits in the references instead of the gotchas).
The point of this repository is not that it holds skills. It is that it holds them once.
A rule learned on one project — how a resolver hides an incomplete registration, why a mirror that only grants permissions is a slow leak, what a captcha does and does not buy — is worth the same on every other project. Left in the repository where it was learned, it is worth it to one. The registry is the mechanism that makes it worth it to all of them, and keeps it worth it as it improves.
Two layers, and they must not overlap.
| Holds | Lives | Changes | |
|---|---|---|---|
| The skill | the class of defect: what goes wrong, why, what prevents it | here, installed everywhere | once, for everybody |
| The local rule | the binding: the table, the helper, the path, the documented exception | in the project | when that project changes |
The failure mode of any shared catalogue is the second copy. Harvest a rule out of a repository, install the package back into it, and the rule now exists twice: the agent reads both, they cost context, and the day one improves they quietly disagree. So harvesting is only half of it — the other half is thinning the source to its binding, a short file that names the skill and keeps only what the general rule cannot know.
python3 scripts/harvest.py adopt --id <source> # which local files a skill now coversPrecedence is stated, so a disagreement is never silent. The skill is the default; a project may narrow it, add to it, or override it, and an override carries a written reason. A local rule that contradicts a skill without saying so means one of the two is out of date — and finding those is the most valuable thing an adoption pass does.
A new project starts with an empty rules folder. Install the profiles; write a local file the first time
the project needs to say something the general rule cannot know. An existing project is reconciled once,
repository by repository: install, thin what the ledger says is covered, leave what is not as candidates for
the next harvest, resolve the contradictions explicitly, and thin the derived instruction files for the
other agents too — otherwise you have created the disagreement that
padosoft-agent-instructions-sync exists to prevent.
Promotion to core is decided by evidence, not by seniority. A rule becomes global when stacks that
share no line of code arrive at it independently; harvest-status counts how many unrelated sources feed
each skill, and that count is the argument. There is no cap on how many global skills there may be — there
is a requirement that each one states its boundaries, because it loads into every session.
And nothing about where a rule came from ever ships with it. The sources are private and this registry is public: no dates, no customers, no people, no real tables or identifiers. That one is enforced by a check that fails, not by good intentions.
The catalogue is only worth what the repositories behind it have learned since last time. harvest.py
does the deterministic half of that — it reads a list of source repositories, finds their lessons files,
rule folders, internal skills and decision records, and prints what is new, changed or gone against a
ledger of what was already considered.
cp .harvest-sources.example.json .harvest-sources.json # once, then fill in your paths
make harvest # the work order
make harvest-status # pending, and what feeds each skill
python3 scripts/harvest.py adopt --id <source> # what to thin in that repository(No make on the machine? Every target is a one-line python3 scripts/harvest.py … command.)
The judgement half belongs to padosoft-knowhow-harvest: is this a rule or a note, would the agent get
it wrong without it, is it a class of defect or one project's instance — and then extend, create, promote
or reject. Every decision is recorded, rejections with their reason, because an undocumented rejection
is re-mined every six months.
covered requires naming the skill and rejected requires a reason; the scan never writes to the ledger,
so a session that dies half way does not mark everything as processed. Promotion to core is decided by
independent convergence — make harvest-status counts how many unrelated sources feed each skill, and
that count is the evidence.
Both .harvest-sources.json and .harvest-ledger.json are gitignored on purpose: a list of the
repositories you run is metadata about your business, and this one is public.
Issues and pull requests are welcome: a new skill, a fix to an existing one, or a profile for a stack that is
not covered yet. CONTRIBUTING.md has the criteria for choosing profile and scope — and
what really deserves a place in core. CI guesses nothing: it only checks that every skill declares its
placement, that the generated files are up to date and that no skill is left out of the packages.
Everything is written in English so that the skills are usable outside Padosoft too.
All 44 skills in alphabetical order: what each one says, and when it triggers. Generated from the frontmatter.
A back-office screen is a filtered query with a chart on top, and four states that must all exist.
padosoft-admin-interface · profiles: laravel · scope: project · version: 0.1.0
Triggers when — Use this skill when building or reviewing an admin/back-office screen with a Laravel API behind it and an interactive frontend in front — a filtered listing, a dashboard with KPI cards and charts, an expandable table, an export, an autosuggest on a foreign key — and whenever the user says a panel shows a spinner forever, an empty result is indistinguishable from a failure, a filter returns everything, an export times out, a chart redraws on top of itself, or asks for "the admin page for X". It gives the layer pipeline on the server, the data contract across the boundary, and the four states every screen owes its user. Do not use it for public storefront pages, for the security review, or for choosing a UI component library.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-admin-interface.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-admin-interfaceThe host decides what an agent may do, what gets recorded, and what any of it proves.
padosoft-agent-host-boundaries · profiles: ai, api · scope: project · version: 0.4.0
Triggers when — Use this skill when building or reviewing something that calls a model or hosts an agent — an LLM adapter, a tool-calling loop, an MCP server, a prompt-driven feature, a spend budget, a trajectory or replay store, a similarity or scoring threshold, an agent-generated artifact that a human is meant to approve. Also when the user reports a runaway bill, prompts or customer data ending up in logs or traces, an agent doing more than intended, a "confidence score" being treated as a decision, or generated output being accepted as evidence. Do not use it for prompt wording and model choice, for training or fine-tuning, or for building the skills themselves (padosoft-skill-creator covers that).
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-agent-host-boundaries.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-agent-host-boundariesA rule one agent knows and the others do not is worse than no rule.
padosoft-agent-instructions-sync · profiles: core · scope: global · version: 0.1.0
Triggers when — Use this skill whenever a file that instructs a coding agent is created, changed or deleted — CLAUDE.md, AGENTS.md, a rule or skill folder, a Copilot instructions file, a Gemini or Cursor or Codex configuration — in a repository where more than one agent is used. Also when the user says one agent follows a rule the others ignore, that a convention was applied by one tool and not another, that an instructions file was truncated, or asks how to keep the instruction files aligned. It gives the one-source-many-targets contract, the per-target limits that force a transformation, and the checks that catch a target left behind. Do not use it to write the content of a rule, nor to build a skill for publication (padosoft-skill-creator covers that).
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-agent-instructions-sync.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-agent-instructions-syncA number without a dataset version and a run identity is not a measurement.
padosoft-ai-evaluation · profiles: ai · scope: project · version: 0.1.0
Triggers when — Use this skill when measuring whether a model-backed feature works — building or changing an evaluation harness, a golden dataset, a metric, a scoring report, a regression gate on prompt or model changes. Also when the user asks how to know a prompt change made things better, how to stop a model upgrade silently regressing, what to put in a test set, how to score free-form output, or wants red-team coverage. It covers datasets and reports as versioned artifacts, the isolation an evaluation run needs, cohorts, and what must never leak into a report. Do not use it to write application tests (padosoft-test-integrity), to choose a model, or to design prompts.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-ai-evaluation.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-ai-evaluationTen checks on an API change, each carrying the mistake that produces it.
padosoft-api-security-review · profiles: api, node · scope: project · version: 0.3.0
Triggers when — Use this skill before committing or reviewing any change to an HTTP API that touches routing, auth middleware, settings or config endpoints, logging and telemetry, SQL, error handling, response shaping, client IP, rate limits or an outbound fetch — and whenever the user asks for a security review, an audit, or says an endpoint "seems public", "returns too much" or "leaks something": it runs ten checks with ready grep pre-screens (auth on every mutating route, ownership from the authenticated id, no secrets or PII in responses, bound SQL, fail-safe env gates, resource caps, redacted logs, downstream injection, no trust from caller input, supply chain) and blocks the commit on each violation. Do not use it for infrastructure hardening (WAF, DNS, firewall) or for dependency CVE triage.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-api-security-review.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-api-security-reviewEither the invariant is recorded in the same atomic step that checked it, or it does not exist.
padosoft-atomic-invariants · profiles: core · scope: global · version: 0.1.0
Triggers when — Use this skill whenever code enforces something that must hold only once or only so many times — a single-use code or coupon, a nonce, a rate or quota limit, "the first one wins", a stock reservation, an idempotency key, a state transition that must happen once — and whenever the user reports that two requests both succeeded where one should have failed, a coupon was redeemed twice, a job ran twice, or a counter drifted under load. It checks that the read and the write of the invariant live in one atomic step and that a constraint backs the rule where it matters. Do not use it for general transaction design, for retry policy, or for distributed consensus.
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-atomic-invariants.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-atomic-invariantsIdentity is a set of doors, and hardening means none of them disagrees with the others.
padosoft-auth-hardening · profiles: core · scope: global · version: 0.1.0
Triggers when — Use this skill when building or reviewing anything to do with who a user is and how long they stay that way — login, registration, password reset or change, email change, invitations, sessions, API tokens, second factor, logout, remember-me, a captcha on a form. Also when the user reports credential stuffing, an account enumeration finding, a session that never expires, a password change that did not log other devices out, a lockout that never fires, or asks what a new application needs before it opens to the public. It gives the control, the reason it is shaped that way, and the ways each one is commonly present but ineffective. Do not use it for authorisation and ownership (padosoft-tenant-isolation) or for the whole security posture (padosoft-security-baseline).
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-auth-hardening.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-auth-hardeningThe failed step says where the run stopped, not why — collect everything before diagnosing.
padosoft-ci-failure-triage · profiles: devops · scope: project · version: 0.1.0
Triggers when — Use this skill when a test or a job is red in CI and somebody wants to know why — "the pipeline is red", "test X fails only in CI", "it passes locally", "the browser test is flaky", "fix the failing check on the PR". It is the procedure for collecting the complete evidence before forming a hypothesis: the full run log rather than the failed-step extract, every artifact, the application logs from the same window, and the correlation between them, ending in a classification — test defect, application defect, environment defect, or genuinely flaky — and a fix that names a file and a line. Do not use it to design the workflow (padosoft-ci-workflow-gates), to write the tests (padosoft-test-integrity), or to debug something failing in front of you locally.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-ci-failure-triage.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-ci-failure-triageA gate that cannot fail is not a gate.
padosoft-ci-workflow-gates · profiles: devops · scope: project · version: 0.3.0
Triggers when — Use this skill when writing or reviewing a CI workflow or a gate that guards a merge — a GitHub Actions file, a required check, a validator script, a secret scan, a branch or tag ruleset — and whenever the user says a check went green without checking anything, a workflow did not start, a label does not trigger the run, CI minutes are being burned on every push, a required check cannot run before merge, or a rule can be bypassed. It covers what actually makes a gate a gate, the trigger and permission semantics that silently replace your defaults, and the cost tiering. Do not use it to design deployment pipelines, to pick a CI provider, or to debug a failing application test.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-ci-workflow-gates.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-ci-workflow-gatesChanging a signature is editing everything that agreed to it.
padosoft-contract-changes · profiles: core · scope: global · version: 0.3.0
Triggers when — Use this skill when something other code depends on is about to change shape — a method or function signature, a parameter added, removed, reordered or retyped, a return type, an overridden method, an interface, an event payload, a schema, a response contract, a default value. Also when the user reports a signature-incompatibility error, a caller broken after a refactor, a child class that no longer matches its parent, a fixture failing after a schema was tightened, or asks how to change an API without breaking consumers. It gives the search that finds every dependent, the classification that says what is breaking, and the rule that the whole change lands together. Do not use it for designing an API from scratch, for versioning a public package, or for database migrations (padosoft-database-design covers those).
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-contract-changes.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-contract-changesNever write a claim stronger than the evidence you actually have.
padosoft-crash-triage · profiles: core · scope: global · version: 0.1.0
Triggers when — Use this skill when a crash, a freeze or an error from real users has to be turned into a fix — a report from a crash reporter, an application-not-responding event with a thread dump, a stack trace from a minified or bundled artifact, an exception group in an error tracker. Also when the user says an issue is back, asks which release introduced it, wants a stack symbolicated, or asks what to write in the fix when nothing could be reproduced. It gives the order of collection, how to attribute a frame honestly, how to classify from the code rather than the message, and the grade of proof every sentence in the diagnosis has to carry. Do not use it for a failing test or a red pipeline (padosoft-ci-failure-triage) or for a bug you can reproduce in front of you.
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-crash-triage.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-crash-triageThe ways a Windows workstation and a Linux runner disagree silently.
padosoft-cross-platform-scripting · profiles: devops · scope: project · version: 0.1.0
Triggers when — Use this skill when writing or reviewing a script that has to run in more than one place — a developer's Windows machine and a Linux CI runner, a Makefile, a validator, a hook, a release script — and whenever the user says it works locally but fails in CI (or the reverse), a command reported success while the step failed, a path is not found on one platform only, a dotfile is invisible, a file with an accented name is skipped, or a regex misses lines on one checkout. It covers exit-code propagation, path and case semantics, interpreter discovery and how not to parse another tool's human output. Do not use it to choose a scripting language, for container or deployment configuration, or for CI workflow design.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-cross-platform-scripting.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-cross-platform-scriptingThe index, the key and the partition are part of the table's design, not a later fix.
padosoft-database-design · profiles: data, laravel · scope: project · version: 0.1.0
Triggers when — Use this skill when writing or reviewing a migration or a table design — adding a table or a column, choosing indexes, deciding a primary key, partitioning a large table, adding a JSON column, planning for growth. Also when the user reports a slow query blamed on a missing index, a migration that fails because a table or column already exists (or does not), an index that is never used, a table too big to purge, or asks how to index a query they are about to write. It covers index selection and redundancy, the composite-prefix rule, covered indexes, partitioning constraints, JSON columns, and the guard clauses a migration needs to be re-runnable. Do not use it for writing the queries themselves (padosoft-query-performance), for ORM conventions, or for choosing a database engine.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-database-design.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-database-designEvery fact quoted from the code is verified against the code before merging.
padosoft-docs-match-code · profiles: core · scope: global · version: 0.1.0
Triggers when — Use this skill when writing or reviewing documentation that quotes the code — a README, a CLAUDE.md or AGENTS.md, a SKILL.md, an ADR, an onboarding guide, an API doc — and whenever the user reports that a documented command, column, env var or flag does not exist, that setup instructions fail on a clean machine, that the docs describe an older behaviour, or asks to document a feature. It checks the quoted facts against migrations, models, config, command signatures and routes, and prefers a generated or pointed-to source over a copied snippet. Do not use it for writing style, for choosing a docs platform, or for translating existing documentation.
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-docs-match-code.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-docs-match-codeA queue moves work, not effects — claim the effect atomically before performing it.
padosoft-durable-effects · profiles: api, data · scope: project · version: 0.2.0
Triggers when — Use this skill when work leaves the request and happens later — a background job, a queue, a worker, a webhook consumer, a scheduled task, a retry — and whenever the user reports that something ran twice, that a job was processed by two workers, that a retry charged or sent a second time, that a cancelled job still reported success, that a worker hung or exited with a late error, or that a job vanished. It covers lease and fencing semantics, exactly-once effects, terminal states, cancellation, and what a durable queue needs that an in-memory one does not. Do not use it to choose a queue technology, to tune throughput or worker counts, or for request-scoped transactions (padosoft-atomic-invariants covers those).
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-durable-effects.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-durable-effectsWhen two layers could enforce a control, each assumes the other does and nobody does.
padosoft-edge-worker-security · profiles: node, api · scope: project · version: 0.1.0
Triggers when — Use this skill when code runs at the edge in front of an origin — a Cloudflare Worker or equivalent that proxies, renders or caches on behalf of a backend. It covers who owns a control when two layers could implement it, cross-site request forgery validated at the edge, the two-hop client-address model, header forwarding and what must never reach the origin, private caching and key design, cross-origin policy, cookies, server-side rendering at the edge, secrets and bypass tokens, and edge rate limiting. Also when the user says a request is blocked and nobody knows by which layer, a header is being spoofed, a cached page showed another user's data, a bypass works with only a user agent, or asks whether a control is really on. Do not use it for the origin application's own review, for CDN configuration, or for edge performance tuning.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-edge-worker-security.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-edge-worker-securityHTML email that passes the deliverability checks on the first send.
padosoft-email-html-builder · profiles: email · scope: project · version: 1.1.0
Triggers when — Use this skill whenever the user creates, fixes, converts or reviews an HTML email (welcome, transactional, newsletter, DEM, ESP template) or asks to test it on Mailtrap or MailUp, even when they do not explicitly say "HTML", "template" or "deliverability": it produces table-based emails with minimal inline CSS, an aligned text/plain part, one-click List-Unsubscribe, and validates them with the included linter down to 0 errors, targeting SpamAssassin spam <= 0.1 and HTML Check with no warnings outside the baseline. Do not use it for copywriting without code, for configuring DNS/SPF/DKIM or for managing lists and bulk sends.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-email-html-builder.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-email-html-builderThe answers are three, not two — a convenience defaults off, a protection defaults on.
padosoft-environment-gating · profiles: core · scope: global · version: 0.1.0
Triggers when — Use this skill whenever a branch behaves differently depending on the environment — debug output, error detail, a profiler or diagnostic endpoint, a permissive security header, a seed, an auth mock, a provider in test mode, a destructive command guard, a feature flag keyed on the deployment. Also when the user reports that a development behaviour appeared on the live site, that stack traces or query dumps are visible to users, that a staging box behaves like a laptop, or that an environment check did not match. It replaces the two-valued check with the three answers that actually exist, and picks the default from what the branch does. Do not use it for CI workflow configuration, for secret management, or for choosing a deployment topology.
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-environment-gating.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-environment-gatingName the claim, then name what would prove it.
padosoft-evidence-boundaries · profiles: core · scope: global · version: 0.3.0
Triggers when — Use this skill when something is being declared done, safe, covered or production-ready and you need to know what actually proves it: a release or compliance gate, a security or DR claim, a "CI is green so we can ship", a "the job succeeded", a "the tests pass so it works", a coverage or mutation number, a signed artifact, an integration verified against an emulator or a mock. It names the claim, names what would prove it, and finds the gap where a cheaper artifact was accepted in place of the expensive one. Do not use it to write tests (padosoft-test-integrity), to build a CI workflow (padosoft-ci-workflow-gates), or to debug a failing check — this is about whether a passing one means anything.
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-evidence-boundaries.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-evidence-boundariesThe caller must be able to tell success from failure, and a check that does not decide is not a check.
padosoft-failure-visibility · profiles: core · scope: global · version: 0.3.0
Triggers when — Use this skill whenever code can fail and the caller has to find out — a write to disk or storage, an external call, a catch block, an endpoint that returns a body, a fetcher, a renderer, a chart that reduces an array — and whenever the user says something "silently did nothing", data disappeared without an error, a request returned 200 but the page is empty, a job later died on something that was reported as accepted, or a retry loop never fires. It covers the two halves of the same bug: an ignored return value, and a success status served over a failure. It also covers the decision trace, for when nobody can reconstruct why a user got the outcome they got. Do not use it for what goes inside a log line (padosoft-logging-discipline) or for retry and timeout policy.
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-failure-visibility.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-failure-visibilityThe markup owes the test a stable anchor and an observable state.
padosoft-frontend-testability · profiles: laravel, node, react-native · scope: project · version: 0.1.0
Triggers when — Use this skill when writing or reviewing user-interface markup or components — a page, a form, a modal, a list, a widget, a screen — in a project that has end-to-end tests or will have them. Also when the user says a test broke after a purely visual refactor, that a test waits on a timer, that a selector depends on a generated class name, that a test cannot tell loading from empty, or asks how to make the interface testable. It gives the locator hierarchy the markup has to support, the eight contract rules, and the observable states every asynchronous action owes its test. Do not use it to write the tests themselves (padosoft-test-integrity), to design the interface, or to pick a testing framework.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-frontend-testability.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-frontend-testabilityWhat git recorded is not always what you changed.
padosoft-git-commit-integrity · profiles: core · scope: global · version: 0.2.0
Triggers when — Use this skill right after committing, and whenever something that works locally is missing or wrong everywhere else: a file you are certain you added is not in the repository, CI cannot find a module that exists on your machine, a colleague gets a whole-file diff from a one-line change, a review shows changes nobody made, or a generated file keeps coming back modified. It verifies what git actually recorded — git add -A skips ignored files in silence, and without a .gitattributes the line endings of whoever committed end up in the index — and gives the correct fix for each, which is never git add -f. Do not use it for merge conflicts, rebasing, branch strategy, or writing commit messages.
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-git-commit-integrity.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-git-commit-integrityThree layers one direction, typed context, bound SQL, and the mistakes that keep returning.
padosoft-hono-api-conventions · profiles: node, api · scope: project · version: 0.2.0
Triggers when — Use this skill when writing or reviewing code in a Hono API on Bun — a new endpoint, a middleware, a repository or a SQL query — and whenever the user works on a controller/repository/query layer, types a Hono context, adds a paginated or localized list, or hits a symptom like "the type of c.get is any", "it returns null instead of an empty list", "page 1 skips records", "sometimes the translation is missing" or "the middleware types don't line up": it applies the three-layer architecture, the typed-context and middleware-factory patterns, and the recurring mistakes that cost the most. Do not use it for the security review of an endpoint (padosoft-api-security-review) nor for OpenAPI spec changes.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-hono-api-conventions.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-hono-api-conventionsA key is only unused once you have searched for every form it can be written in.
padosoft-i18n-hygiene · profiles: laravel, node, react-native · scope: project · version: 0.1.0
Triggers when — Use this skill when working on a translation catalogue — adding a string, auditing for unused or missing keys, replacing hardcoded text, aligning locales, checking plural forms. Also when the user says a label shows as a raw key in the interface, that a language is missing strings, that the translation files have grown full of things nobody uses, that a text was never translated, or asks to clean up the localisation. It gives the search that actually finds a key's usages, the rule for deleting one safely, what counts as user-visible text, and the invariants a catalogue has to keep across every locale. Do not use it to choose a localisation library, to translate the copy itself, or for date and number formatting performance.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-i18n-hygiene.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-i18n-hygieneHarvest the rule, leave the story, and record what you decided so nobody mines it twice.
padosoft-knowhow-harvest · profiles: core · scope: global · version: 0.2.0
Triggers when — Use this skill to turn what other repositories have learned into skills — a periodic harvest of their lessons files, rule folders, internal skills, decision records and security docs, deciding for each finding whether it updates an existing skill, becomes a new one, or is deliberately left alone. Also when the user says "check the repos for new rules", "harvest the know-how", "what changed since last time", asks how to keep the catalogue current, wants to know whether something was already considered, or asks what to do with the local rules a skill now duplicates. It covers the work order, the judgement that turns a finding into a rule, the promotion criterion, and the ledger that stops the same material being mined twice. Do not use it to write a single skill from scratch (padosoft-skill-creator) or to audit an existing one.
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-knowhow-harvest.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-knowhow-harvestWhere the logic lives and what crosses which boundary, on any framework version.
padosoft-laravel-conventions · profiles: laravel · scope: project · version: 0.4.0
Triggers when — Use this skill when writing or reviewing Laravel/PHP code — a controller, a FormRequest, a service, a job, a migration, an Eloquent query, a model event, a queued or bulk operation — and whenever a symptom shows up: a controller that grew into the business logic, an N+1 found in the logs, a bulk command that runs out of memory, a job that retries something it should not, a soft-deleted row reappearing in a count, a model event that fires on a mass update and does not. It applies to any Laravel version: the rules are about the shape of the application. Do not use it for a security review (padosoft-laravel-security-review), for what goes in a log (padosoft-logging-discipline), or for infrastructure and deployment.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-laravel-conventions.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-laravel-conventionsThe code is the easy part — what gets forgotten is the wiring.
padosoft-laravel-scaffolding · profiles: laravel · scope: project · version: 0.1.0
Triggers when — Use this skill when adding something new to a Laravel application — an endpoint, a controller, a service, a CRUD backend, a queued job, a test — "make me the API for X", "add the CRUD for Y", "I need a service that does Z" — and whenever a piece added earlier is half-wired: a route that answers 404, a policy that is never called, a request class that validates nothing because the controller reads all(), a job that is dispatched but has no queue configured. It lists the files each piece touches, in order. Do not use it to review existing code (padosoft-laravel-conventions) or for the security review.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-laravel-scaffolding.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-laravel-scaffoldingTen checks plus three rules whose cost is disproportionate to how easy they are to get wrong.
padosoft-laravel-security-review · profiles: laravel · scope: project · version: 0.2.0
Triggers when — Use this skill before committing or reviewing a change to a Laravel application that touches a model's fillable or guarded, a Blade template printing unescaped, raw SQL, a file upload, a route exempted from CSRF, a shell call, a redirect built from input, an id coming from the request, an audit trail, or an AI/LLM call — and whenever the user asks for a security review or an audit, or says an endpoint returns somebody else's data or an error shows SQL to the user. It runs ten checks with ready pre-screens plus ownership, audit integrity and error-leak rules. Do not use it for API-side (padosoft-api-security-review) or mobile (padosoft-mobile-security-review) work, nor for infrastructure hardening.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-laravel-security-review.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-laravel-security-reviewKeep the diagnosis, drop the data — and the log is not the only way data gets out.
padosoft-logging-discipline · profiles: core · scope: global · version: 0.3.0
Triggers when — Use this skill whenever code writes to a log or builds an error message for a user — a catch block, an exception handler, a logger call, telemetry, a debug line added while hunting a bug — and whenever the user says a log is noisy or useless, an error message shows SQL or a stack trace, a support ticket contains data it should not, or asks what is safe to log. It gives what must never reach a log or a screen, what to keep so the log stays diagnosable, and where the redaction goes in each stack, which is not the same place. Do not use it to choose a logging library or to configure log shipping, retention or dashboards.
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-logging-discipline.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-logging-disciplineThe bundle ships to every device and can be decompiled — everything follows from that.
padosoft-mobile-security-review · profiles: react-native · scope: project · version: 0.1.0
Triggers when — Use this skill before committing or reviewing a change to a React Native / Expo app that touches secrets or API keys, token storage, a WebView, a deep link or an external URL, TLS and certificate pinning, a dev/mock/debug surface, or an AI/LLM call — and whenever the user asks whether something can go in the bundle, in an EXPO_PUBLIC_ variable or in MMKV, or asks for a mobile security review or an audit. It runs the checks with their pre-screens and, for a finding whose enforcement lives outside the repository, states the severity conditionally instead of guessing. Do not use it for API-side security (padosoft-api-security-review), store review rejections, or MDM and device fleet policy.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-mobile-security-review.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-mobile-security-reviewA published contract other projects depend on — change it in every place, once.
padosoft-openapi-spec-workflow · profiles: api, node · scope: project · version: 0.2.0
Triggers when — Use this skill when changing a shared OpenAPI contract that other projects consume — adding or editing a field, an endpoint or a response schema in a spec package, or bumping and publishing it — and whenever the user says the mock and the real API disagree, a client method is missing a new parameter, the generated document fails to build, or a consumer broke after a spec release: it walks the places that must stay in sync (schema, mocks and per-tenant overrides, endpoint, client, tests), the changeset and version bump, and the build-and-call verification loop. Do not use it to implement the endpoint in the API that serves it (padosoft-hono-api-conventions) nor for its security review.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-openapi-spec-workflow.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-openapi-spec-workflowMoney is a ledger that has to balance, not a status field.
padosoft-payments-reconciliation · profiles: payments · scope: project · version: 0.2.0
Triggers when — Use this skill when money moves: a checkout or capture, a refund, a chargeback, a payout, a subscription renewal, a promotion or loyalty redemption, a usage or token bill. Also when the user reports that totals do not add up, that a customer was charged twice, that a refund exceeded the payment, that a payout cannot be tied to orders, that a promotion went over its cap, or that a payment request timed out and nobody knows whether it went through. It checks the state machine, the arithmetic that has to close, and the boundary between what the provider owns and what you own. Do not use it to integrate a specific provider's SDK, for PCI scope decisions, or for pricing and tax strategy.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-payments-reconciliation.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-payments-reconciliationA bot review is a list of candidates, not a task list.
padosoft-pr-review-triage · profiles: devops · scope: project · version: 0.1.0
Triggers when — Use this skill when a pull request has comments from an automated reviewer — GitHub Copilot, Codex, CodeRabbit, Advanced Security — and the user wants them processed: "copilot review", "the bot comments on the PR", "address the review", "fix the Codex findings", or simply "there are 14 comments on PR 212, sort them out". It reads every bot comment, sorts them into must-fix / worth-fixing / negligible / bot-is-wrong, gets the categorisation approved before touching code, applies only the approved fixes, replies to each comment on GitHub, and proposes a new project rule when the bot found a real bug the project checks would have missed. Do not use it for a human reviewer's comments, for a single comment, or to write the code review itself.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-pr-review-triage.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-pr-review-triageThe code was written against the volume that existed then, and the volume moved.
padosoft-query-performance · profiles: data, laravel · scope: project · version: 0.1.0
Triggers when — Use this skill when writing or reviewing code that reads or writes the database in volume — a listing, an export, a report, a cron or queued job that walks a table, a recalculation of a denormalised table, an endpoint that got slow as the data grew. Also when the user reports N+1 queries, a job exhausting memory, a paginated page that gets slower the deeper it goes, a timeout on a large table, or asks how to process a few hundred thousand rows. It covers access patterns, the volume thresholds that change the technique, keyset pagination, existence checks, and recalculating without leaving a window of emptiness. Do not use it for index and table design (padosoft-database-design) or for tuning the server itself.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-query-performance.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-query-performanceThe ingestion contract records what a document is, not where its authority comes from.
padosoft-rag-ingestion-security · profiles: ai, api · scope: project · version: 0.1.0
Triggers when — Use this skill when content is brought into a corpus that a model will read — a connector to a document store, a mailbox, a ticket system, a wiki, an upload, a crawl — and whenever the question is who may see what came in. Also when the user reports that an assistant surfaced a document somebody should not have seen, asks how to mirror the source's permissions, worries about content written by outsiders reaching a tool call, or needs personal data kept out of an index. It covers the ingestion contract, permission mirroring that fails closed, authorship provenance, the indirect-injection chain, and redaction before embedding. Do not use it for choosing an embedding model, for retrieval quality, or for the shape of the corpus itself (padosoft-rag-knowledge-base).
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-rag-ingestion-security.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-rag-ingestion-securityA model may propose knowledge; only a human promotes it.
padosoft-rag-knowledge-base · profiles: ai, data · scope: project · version: 0.1.0
Triggers when — Use this skill when designing or changing the corpus a model retrieves from — the document store, the chunk table, identifiers, statuses, the promotion of knowledge into it, the graph of relations between documents. Also when the user reports that a document could not be deleted, that the same file was indexed twice, that retrieval grounds answers on an outdated or unreviewed page, that two projects collided on an identifier, or asks how a model should be allowed to write into the knowledge base. It covers the idempotency anchor, canonical typing, the human gate on promotion, trust ordering at retrieval, and the delete path. Do not use it for permissions and ingestion trust (padosoft-rag-ingestion-security) or for choosing an embedding model.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-rag-knowledge-base.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-rag-knowledge-baseThe rules that survived independently in two production apps.
padosoft-react-native-conventions · profiles: react-native · scope: project · version: 0.1.0
Triggers when — Use this skill when writing or reviewing React Native / Expo code — a screen, a component, a Zustand store, a React Query hook, a FlashList, a Reanimated animation, a navigation change, a tablet layout — and whenever a symptom like these shows up: "Maximum update depth exceeded", a list that jumps or overlaps while scrolling, an animation that starts but leaves the state wrong, a value that is stale right after being set, a colour that is unreadable in dark mode, a translation missing in one language only. It applies the conventions and the recurring mistakes distilled from two production apps. Do not use it for mobile security (padosoft-mobile-security-review), for what goes in a log (padosoft-logging-discipline), or for native module and build configuration.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-react-native-conventions.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-react-native-conventionsWhat breaks is never the code, it is the registration.
padosoft-rn-screen-scaffolding · profiles: react-native · scope: project · version: 0.1.0
Triggers when — Use this skill when adding a new screen, component or data-fetching hook to a React Native / Expo app — "make me a screen for X", "add a component that shows Y", "I need the hook for this endpoint" — and whenever something added earlier is half-wired: a screen whose title shows the raw key, a route that exists in one app of the monorepo but not the other, a component not exported from its barrel. It lists every file a new piece touches, in order, so nothing is left half-registered. Do not use it to review existing code (padosoft-react-native-conventions) or for native modules and build configuration.
Where it goes — installed in the project that needs it, not globally. Folder: skills/padosoft-rn-screen-scaffolding.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-rn-screen-scaffoldingA control you cannot prove is a control you do not have.
padosoft-security-baseline · profiles: core · scope: global · version: 0.1.0
Triggers when — Use this skill when deciding what security an application must have — starting a new project, taking one to production, preparing for an audit, a penetration test or a customer questionnaire, planning a hardening backlog, or answering "are we secure enough?". Also when the user asks which controls are missing, what to do first, how to prove a control exists, or wants a new service to start at the same level as an existing one. It walks the control domains, separates what the framework gives you from what you must build, and turns a finding into a control that holds for future code. Do not use it to review a specific diff — the per-stack review skills do that — nor to run a scanner or write a threat model for one feature.
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-security-baseline.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-security-baselineSkills that follow the spec and the repo conventions, and carry no provenance out with them.
padosoft-skill-creator · profiles: core · scope: global · version: 0.2.0
Triggers when — Use this skill when creating, editing or reviewing an Agent Skill of the padosoft/skills repository, when the user wants to turn a recurring workflow, a checklist or a set of guidelines into a reusable skill, or when they ask where a skill belongs (profile, scope, package) or why the repo CI is failing on catalog, profiles or manifests: it guides the whole creation with scaffolding, the Padosoft conventions and the automated checks. Do not use it to write the technical domain content (that is the job of the skill you are creating) nor to install existing skills (padosoft-skills-router handles that). It also keeps the provenance of the work — dates, customers, people, ids, credentials — out of anything that gets published.
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-skill-creator.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-skill-creatorWork out which skill is needed right now, and how to install it.
padosoft-skills-router · profiles: core · scope: global · version: 0.1.0
Triggers when — Use this skill when the user asks which Padosoft skills exist, which ones to install for the current project or stack, or how to update or remove them, and also when you are about to work on a company stack (Laravel, Node/Hono/Workers, React Native/Expo, HTML email, API, payments) and no skill covering that stack is installed: it points to the right skill and gives the exact install command. It does not replace the stack skills and does not do their technical work for them.
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-skills-router.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-skills-routerThe scope belongs to the key, not to the filter.
padosoft-tenant-isolation · profiles: core · scope: global · version: 0.1.0
Triggers when — Use this skill when more than one organisation, customer, workspace or project shares a system, and whenever a boundary between them is being written or reviewed: a scoped query, a list endpoint, an update or delete, a background job, a cache or storage key, an idempotency key, a provisioning or admin route. It also applies when the user reports that one account can see or overwrite another's data, that a count or a page leaks records, that a job ran for the wrong tenant, or that a legacy record is visible to everyone. It checks that the scope is carried by the key and re-checked at every boundary, not applied as a filter on the way out. Do not use it for authentication or login flows, for role and permission design inside a single tenant, or for database sharding and capacity work.
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-tenant-isolation.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-tenant-isolationA test that cannot fail is worse than no test.
padosoft-test-integrity · profiles: core · scope: global · version: 0.2.0
Triggers when — Use this skill when writing or reviewing a test, and whenever a suite is suspicious: a test that passes whatever the code does, one that went green without the fix, an ordering test that never fails, a suite that passes alone and fails in sequence or in a different order, a flaky test blamed on CI. It checks that the body exercises what the name promises, that ordering assertions are strict, that global state is restored, that a failure-path test actually fires the failure, and that the assertion could fail at all. Do not use it to choose a test framework, to design a test strategy or coverage targets, or to debug a failing application bug.
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-test-integrity.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-test-integrityNever invent silently — ask, or record the doubt and report it.
padosoft-verify-before-writing · profiles: core · scope: global · version: 0.1.0
Triggers when — Use this skill whenever an agent is about to write something it has not verified — a call to a helper whose signature it inferred from the name, an enum case that sounds plausible, a config key, a column, a file path mentioned in a plan but never opened, a docblock explaining a mechanism nobody read, a commit message asserting what the code does. Also when the user says the agent invented an API, hallucinated a method, confidently described behaviour that does not exist, or asks how to stop it happening. It gives the rule (ask, or log the doubt — never the silent third option), what must be verified, and how autonomous mode changes the answer without removing the obligation. Do not use it for verifying facts about the outside world, for prompt engineering, or for reviewing code somebody else wrote.
Where it goes — installed globally with the core profile: it applies to every project. Folder: skills/padosoft-verify-before-writing.
npx skills add https://github.com/padosoft/skills/tree/main/skills/padosoft-verify-before-writing