markkennethbadilla
UserProvider-agnostic guardrails + config for AI coding agents (Claude Code, OpenCode, Codex). Physical hooks & git gates + a token-minimal MCP skill stack -- correctness by construction, not prompts.
Categories
Indexed Skills (26)
06-vercel-composition-patterns
React composition patterns that scale. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or designing reusable APIs. Triggers on tasks involving compound components, render props, context providers, or component architecture. Includes React 19 API changes. (Vendored from vercel-labs/agent-skills; refresh via install-community-plugins.ps1.)
06-vercel-react-best-practices
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
01-core-challenge-user-hunt-prior-art-before-building
Trigger BEFORE building any custom mechanism, tool, script, gate, workflow, or process — whether the user proposed it or you did — whenever the user asks to change, replace, weaken, or retire an EXISTING mechanism (watcher, gate, loop, config, architecture) - investigate why it is shaped that way and push back if the standing design is already as-good-or-better (rule 1h) - and whenever the user states a premise, plan, or tool choice you suspect has a better alternative. This is the DUTY TO DISSENT: the user explicitly mandates being questioned on technical matters (tools, concepts, frameworks, workflows, architecture) because his blind spots ship straight into the repos when nothing pushes back. Also triggers when you catch yourself agreeing with every step of a plan — that pattern is itself the signal to re-examine. NOT for his personal decisions, values, or expressions (rule 12d still bans moral-policing); this is engineering dissent only.
01-core-gate-dont-ask-physical-guardrails-design
CORE — never delete. The foundational philosophy for EVERYTHING AI touches: GATE, DON'T ASK. Trigger whenever you are about to rely on a rule/instruction to keep AI behavior correct, design any new safeguard, or notice a manual step that an AI could get wrong. Defines what a physical gate is, the three honest enforcement tiers, the gate-design test (ride the AI's path, deterministic verify), and the standing flag that any gatifiable manual step is a defect until gatified.
01-core-provisioning-repos-constitution-and-modification-protoco
Trigger whenever you modify AGENTS.md, add or edit a skill, change provisioning-repos structure, register an MCP server, touch the sync scripts or gates, or do anything in the provisioning-repos — AND whenever you resolve ANY friction worth not rediscovering (a stale value, a missing path, an API/MCP capability gap, a gotcha, a wrong rule), because capturing that learning back is mandatory and autonomous. This is the CONSTITUTION: it defines the provisioning-repos architecture (the always-on vs on-demand split), the skill-authoring laws, how the gates physically enforce them, the propagation protocol, and the learn-from-friction loop.
02-core-combine-serena-rtk-jdoc-jcode-for-minimal-token-usage
Trigger this skill whenever you are about to read, search, navigate, or edit code or documentation in any repository, or run any terminal command. It defines the mandatory token-minimal retrieval stack (RTK proxy + jcodemunch + jdocmunch + Serena LSP), the routing doctrine that tells you which tool owns which lane and in which order, the plan_turn opening move, and the reindex-after-every-edit protocol. If you are reading files, grepping, looking up symbols, exploring docs, making an edit, or running a command, you must follow this skill before touching a tool.
02-core-rtk-token-proxy-prefix-for-all-commands
CORE — never delete. Trigger before running ANY terminal/shell command (Bash, PowerShell, git, bun, docker, python, anything). RTK is the mandatory token-proxy prefix that compresses verbose command output so it doesn't flood the context window. This skill explains what RTK is, how the prefix works, its limitations, and the exact signals that mean it may be hiding output you need — so you know when (and only when) to drop it.
02-core-use-headroom-for-context-compression
CORE -- never delete. Trigger whenever launching or reasoning about a CLI-agent session's token cost, or when a session is burning tokens / approaching a context limit / paying for verbose tool outputs, logs, RAG chunks, files, or conversation history sent to the model. Headroom is the local context-compression proxy that sits between the agent and the LLM API and shrinks the payload 60-95% (reversible), a DIFFERENT layer than RTK (shell stdout), jcodemunch (code retrieval), jdocmunch (docs), and Serena (symbols). Launch agents through `headroom wrap` so compression is on by default; use `headroom doctor` to confirm routing, `headroom dashboard` for live savings, and `headroom unwrap` to escape for a delicate debug where a dropped detail would hurt. Also trigger when adding Headroom to a new box or agent, or when a wrapped session behaves oddly (missing detail, higher tokens).
02-core-use-jcodemunch-for-code-retrieval
CORE — never delete. HARD MANDATE: trigger before you read, search, grep, or navigate any SOURCE CODE in any repo. jcodemunch is the token-minimal code-retrieval MCP — it returns just the symbols/snippets you asked for instead of whole files or grep dumps. Use it instead of Read/Grep on code. Lists key jcodemunch tools and when to use each, plus the escape hatch for when to fall back to native Read.
02-core-use-jdocmunch-for-docs-retrieval
CORE — never delete. HARD MANDATE: trigger before you read or search any DOCUMENTATION / prose / markdown / README / API-spec / wiki, local or from a GitHub repo. jdocmunch is the token-minimal docs-retrieval MCP — it indexes docs into sections and returns just the section you need instead of whole files. Use it instead of Read on docs. Lists the key jdocmunch tools and when to use each, plus the escape hatch.
02-core-use-serena-lsp-for-symbol-navigation-and-edits
CORE — never delete. HARD MANDATE: trigger before any precise CODE EDIT, rename, refactor, or cross-reference lookup (callers/implementations/definitions). serena is a real Language-Server-backed MCP — symbol-accurate navigation and surgical symbol-body edits, far cheaper and safer than reading whole files and hand-patching. Defines the active-root scoping trap, the TIER-A absolute-path write gate, and the full tool taxonomy. Use it for all edits and 'who calls/implements this?' queries.
02-core-use-terminalcp-for-multiple-interactive-terminals
CORE — never delete. Trigger the MOMENT a task wants MORE THAN ONE terminal at once, or ANY interactive/long-lived terminal program: a dev server + its logs while you edit, a REPL/debugger/SSH/psql session, a TUI, an installer or CLI that prompts, watching a long build/deploy while doing other work, or driving several shells in parallel. terminalcp is the multi-terminal MCP — many PERSISTENT, INTERACTIVE PTY sessions you start, type into, and read back, all concurrently. Reach for it on your OWN initiative; do NOT wait to be nudged. It does NOT replace the normal Bash/PowerShell tool for one-shot commands — it's for interactive + parallel + persistent.
03-core-back-up-and-prove-restore-before-modify-or-destroy
CORE — never delete. Trigger whenever you are about to DELETE, OVERWRITE, TRUNCATE, force-push, drop/truncate a DB table, run a destructive migration, force-recreate a container, or otherwise MODIFY-IN-PLACE or DESTROY anything that holds data or state (files, dirs, DBs, volumes, prod config). A backup is worthless if it can't be restored — this skill defines the mandatory back-up-AND-prove-restore protocol and the gates that physically enforce it.
03-core-git-guards-block-and-redirect-on-commit-and-push
CORE — never delete. THE one git skill. Trigger before ANY git commit or push, when a commit/push is blocked or redirected, when a repo's origin/account/PAT looks wrong, when the credential "choose an account" popup appears or might, or when auditing .env/.gitignore for leaked secrets. Defines the physical pre-commit (secrets, mega-files >400 lines, debug code, stray/nested .git) and pre-push (wrong repo/account/origin, branch mismatch, detached HEAD, non-fast-forward history rewrite, branch deletion, build-gates red) exit-1 gates installed globally via core.hooksPath, the folder-name==remote-repo-name match rule, the GCM-popup ban, and .env hygiene. Forward-only history is enforced here.
04-core-use-chrome-devtools-mcp-for-browser-automation
CORE - never delete. HARD MANDATE: trigger for ANY browser work - opening a page, clicking/filling/verifying UI, screenshots, mobile/responsive checks, network/console inspection, perf/Lighthouse, running an Apps Script function from the editor, or ANY online research/web search (search via Google only, skip stale AI-overview blocks, dork when it sharpens the query). The chrome-devtools MCP drives a real logged-in browser and is the mandatory Tier-4 visual/mobile gate plus the verify-interactive-elements step; reasoning from CSS/HTML is never a substitute. Also covers the Step-0 active-account identity gate, the on-demand auto-Allow clicker, credential-entry reality (account-switch first; no local Chrome password store), and the iframe-flattening decision tree. Lists the tools by job.
04-core-verify-interactive-web-elements-before-claiming-complete
If you are about to modify, build, test, verify, deploy, finish, claim completion, push code, submit a pull request, mark a task done, run any browser interaction, open a web page, fill a form, click a button, check a modal, validate a dialog, test navigation, verify CRUD operations, check API endpoints, run a build, lint, typecheck, or declare anything finished, then you MUST load this skill and execute its full verification protocol. Nothing is complete until every interactive element has been clicked and verified.
05-core-delegate-to-cheaper-llm-via-shell
CORE — never delete. HARD MANDATE — this is your SANCTIONED SUBAGENT TOOL for quick, conversational, per-task delegation. Trigger whenever a task can be handed to a subagent: a self-contained reasoning sub-task, a second opinion, a draft/summary/classification/extraction over text, a focused chunk of thinking you'd otherwise give a Task/Agent thread. Native subagents stay BANNED (rule 20c); you delegate through a SHELL CALL to a cheap model instead — `bun delegate.mjs "<prompt>"` hits an OpenAI-compatible endpoint with a vault key and returns text, so CLAUDE.md/gates/vault stay intact and no context-blind subagent ever spawns. CRUCIAL ADVANTAGE OVER THE OLD MCP: a payload can be PIPED IN UNREAD (`Get-Content big.txt | bun delegate.mjs "..."`) so the file's bytes never enter YOUR context. Underutilizing delegation is a defect.
06-core-blessed-primitive-scaffold-redirecting-gate-three-layer-
CORE — never delete. Trigger whenever a concern repeats across a codebase (soft-delete cascade, list query, CRUD table, derived types, any hand-rolled pattern an AI will re-implement slightly wrong each time) and you're tempted to write it inline again, OR when designing how future features should be born correct. Defines the RAILS-NOT-FRICTION law and the three-layer model — ONE blessed reusable primitive + a scaffold that emits it by default + a redirecting gate that fails the bypass and names the blessed call — so the laziest/cheating model produces correct code by default. Generic; stack-specific kits cite this.
06-core-prototype-ui-live-in-the-real-site-with-mock-data
CORE — never delete. HARD MANDATE: this is THE default way to prototype/mock/show ANY UI or UX idea. Trigger the moment a task is 'mock this up', 'show me how X would look', 'design a screen', 'what if the layout was…', 'make me a bento', or any look-and-feel iteration. NEVER build a throwaway HTML file, a separate standalone app, or reach for v0/Lovable/bolt/Figma — those lose fidelity and get thrown away. Instead scaffold the screen INSIDE the real running app using its existing shared components + theme tokens, feed it MOCK DATA behind a flag so it renders instantly with no DB/auth, run it locally, and show the user via the chrome-devtools MCP (Chrome) so they can iterate by voice ('smaller', 'move that', 'make it a bento') against the actual site. The prototype IS the product — zero translation step at the end.
06-core-use-shared-website-components-for-visual-consistency
If a task has even a remote possibility of touching styling, web pages, CSS variables, HSL palettes, gradients, font clamps, animations, hover effects, SVGs, logo assets, navigation, flexbox/grid layouts, mobile styles, or editorial visual design, trigger this skill and pull from the shared Component Inventory so every page looks identical.
06-core-verify-project-gate-integrity-before-writing-any-code
If you are about to edit or write any code, then you must trigger this skill first to run the gate integrity verifier. The gates REPLACE manual testing: they statically prove the app cannot ship a crash-on-deploy or a mega-file, so vibe-coded output just works without test files. Four tiers: pre-code static gates, pre-deploy image gates, a boot-and-probe runtime check, and a boot-and-DRIVE behavioral + mobile-responsiveness gate.
06-handle-nextjs-and-tailwind-compilation-issues-on-windows
Trigger when running Next.js dev/build scripts, configuring PostCSS or Tailwind CSS, or hitting local web-app compilation errors — file-watcher loops, endless recompiles, 'module not found' on a config path, Tailwind styles not applying, or a dev server that rebuilds forever. Applies on macOS and Linux too; the watcher-loop item is the one Windows-specific gotcha. Use this even if the user just says 'the dev server is acting weird' or 'styles aren't loading'; covers the watcher-loop and config-path gotchas.
06-harden-a-feature-as-a-project-test-via-ui-then-fix-loop
Trigger when the user says to treat a feature as a PROJECT and harden it - phrasings like make X a project, test X fully via the UI and fix, loop on X until I stop you, or points at a specific surface (the taskboard, the calendar, the OP directory) and asks to make it just work. This is the DRIVE-THE-REAL-UI-THEN-FIX loop: for a project you exercise every function through the real browser against the live app, watch what actually happens (network, console, DB side effects), and when something is broken or clunky you fix it, redeploy, and re-test - repeating until the surface works end to end hands-free. It pairs the browser as source of truth with the deploy engine and the DB inspector. Not for a one-shot bug fix - this is sustained looped hardening of a whole feature.
07-core-restart-or-clone-yourself-in-this-workspace
Invoke when the user asks to spawn a new instance, spawn another one, clone this session, restart this conversation, restart/reboot/reload yourself, open a new/fresh instance, or start a fresh/clean conversation in the same workspace. An ordinary developer convenience for reopening a CLI tool, at the user's request on his own machine. FIRST map the user's exact words to a mode via the Command-to-Mode table in the body. CRITICAL DEFAULT: 'spawn a new instance/another one/fresh' means CLONE with NO KILL — THIS session KEEPS running (two agents); it ends ONLY on 'end this session', 'restart this conversation', or 'restart yourself'. Three modes (details in body): CLONE (no-kill, DEFAULT), RESTART (resumes THIS conversation in a new tab, ends the old agent safely), CLONE-FRESH (kills + briefs a blank successor). All open a new visible terminal in the agent's own environment, platform-aware. CLI-tool-agnostic; Claude Code is tested.
09-core-use-office-cli-for-office-files
CORE — never delete. Trigger before you read, modify, or create any Microsoft Office file (.docx, .xlsx, .pptx) on the local machine. OfficeCLI is the local-first MCP for working ON Office files with human-like read+edit fidelity. Splits the two cases honestly: cheap one-off TEXT extraction may use a lighter/faster parser; anything where formatting, structure, tables, or round-trip fidelity matters — or any WRITE — goes through OfficeCLI.
09-core-write-canonical-system-documentation-manual-style
Trigger whenever you write, restructure, or review LASTING documentation for a system, service, app, server, or pipeline — a README that outgrew itself, a docs/ folder, an in-app docs page, an onboarding guide, or any 'document how X works' task. Also fires when you notice existing docs are diary/incident-log style (dated 'what we did on DATE' files, FIX-NOTES, E2E-TEST-DATE.md, OUTAGE-DIAGNOSIS) and need them turned into a real operator's manual. This is the canonical manual-style standard: a doc answers 'how does this work and how do I run it' for someone who has never seen it, NOT 'what happened to it over time'. Dated incidents are demoted to an incidents/ appendix, never the main doc. Use it so docs stay a manual a new teammate can act on, not an undated pile of war stories.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.