Every skill
here is a scar.
Agent skills honed on real work. Each one is a short, self-contained rule set distilled from one concrete failure — written so an AI coding agent (or a human) can apply the lesson without the original context.
Not general advice. A scar.
It happened.
Every skill names the sanitized case it was distilled from — a check that passed against a stand-in, a merge that dropped a field, a green test that could never fail. No hypotheticals.
It generalizes.
No project or company detail survives. The lesson is stripped to its mechanism so it transfers to your codebase, your stack, your next incident.
It has an edge.
Each ends in a pre-flight checklist that fails loudly when a box is unchecked — a gate on "done," not a suggestion you can wave through.
If it reads like a blog post, it doesn't belong. If it reads like a checklist a tired engineer would thank you for at 3am, it does.
Thirty-one edges,
grouped by grind.
Each links to its SKILL.md — the full rule set, the sanitized case, and the pre-flight check.
Verify & prove
09 skillsVerify Through the Real Path
Before claiming something works, is done, safe, or fast — verify through the actual trigger, real data, and representative conditions, not a stand-in.
A direct-call check passed; the real hook ran from another working directory, never found the config, and silently never fired.
Prove the Test Can Fail
After writing a test, or before trusting a green one — make it fail on purpose once, and confirm new branches are reachable by the mocks.
A green end-to-end test stayed green after a load-bearing step was disabled — it was asserting on the wrong layer.
Measure the Delta, Not the Absolute
Judging whether your change is clean on a red or noisy baseline — prove it by stash-and-compare, not by which files appear in the failure list.
A red suite was about to be blamed on a diff; the identical command on the untouched base produced the same reds.
Test-Fixture Realism
Writing tests against a shared store or fabricated fixtures — make fixtures mirror data reality and assertions unable to pass trivially.
A fixture's hardcoded parent id made the join return nothing, and the test happily asserted on the empty result.
Know Your Aggregate Command's Scope
Before citing a test / lint / type-check / build script as proof — confirm what it actually runs, how it forwards args, and whether it caches.
A `--testPathPattern` was dropped by the wrapper, so the green came from the whole suite, served from cache.
Spike Falsification
Validating a third-party dependency (API, SDK, contract, protocol) before building on it — execute against the real deployed artifact and try to falsify your design assumptions, don’t just demo the happy path.
Research returned correct signatures; the deployed bytecode had 1-based indexing, and the "soulbound" token transferred.
Enumerate Artifacts, Not References
Writing or reviewing a completeness gate — enumerate the real artifacts and check each is referenced, rather than scraping references out of prose and checking each resolves; keep a separate bounded pass for truncation.
A gate scraped nineteen illustrative paths out of a document's prose and reported each MISSING, burying the two real findings.
Running Long Background Jobs
Launching or verifying a long-running / detached job, or reconciling a batch against a corpus other processes also write to.
A backfill's residual of 151 was read as 151 failures; only 43 were real, the rest had arrived mid-run while a hook committed underneath it.
Third-Party Tool Onboarding
Standing up a tool on a host that fails one of its declared constraints — one probe that works proves one layer, not the rule.
A pinned smoke test passed on an unsupported runtime, so the version floor was written off; the next unpinned install exited 0 with a build years out of date.
Plan & design
08 skillsPlan Cross-Encoding Review
Reviewing a plan or spec — catch the bug where one intent is encoded twice and the copies quietly disagree.
The prose promised a rollback on failed retry; the pasted code skipped it, and the implementer transcribed the code.
Confirm the Premise First
Designing when a choice depends on a technical property — state the ground truth (local vs remote, reversible vs not) before asking downstream questions.
A backend believed to run inference on-device was always remote — several data-exposure answers collapsed with the premise.
Audit Before You Build
Starting from a ticket, checklist, or spec — grep for what already exists first; trackers record conversations, not deliverables.
A milestone item was already ~90% shipped as a side effect; one grep for the route name turned "build" into gap-closing.
Inject Ambient Inputs
Writing logic that reads the clock, randomness, env, or handles — pass them in as parameters so the pure core tests with no mocking machinery.
Rules calling the clock would have needed fake timers in every test; passing the date in gave ~30 tests with no mocks.
Consistency Is Local First
Adding code to an existing module — match the nearest sibling's pattern; a repo-wide convention is the default only when the module has none.
Illustrative: applying the repo-wide convention would have made the new code the only outlier in a module that had settled on another way.
Validate the User's Proposed Mechanism
A user names a platform, tool, or library — treat it as a proposed mechanism; grep the artifact for disqualifiers before agreeing.
The requested serverless platform kills the long-lived `setInterval` workers the app depends on — one grep surfaced it.
Harness Config Audit
Applying an external write-up to a config you already run — the deliverable is a per-surface delta, not a restatement of the guide.
An improvised audit against an article found zero permission rules defined while the prompt gating unrestricted execution was off — and the article named a model id the install did not have.
Diff the Install Footprint
Deciding whether to adopt a tool that installs into a shared environment — read the config its installer writes and map every slot it claims onto whatever already holds it.
The config a framework's init wizard writes held nine hooks, four on events already owned; its feature list netted to three things not already running.
Change safely
05 skillsGrep the Blast Radius
Changing a shared contract (flag, column, type, endpoint) — the retired name is your consumer index; grep the whole workspace and run cross-boundary suites.
A shared union gained a member; a sibling package's exhaustive `switch` lost exhaustiveness while the editor's tests stayed green.
Diff Each Side Against the Merge Base
Resolving a merge or rebase conflict — markers show where git gave up, not the full delta; auto-merge silently drops fields.
Auto-merge dropped struct fields present on both the base and one side, with nothing appearing between the conflict markers.
Verify Absence Claims
Acting on a "none exists / not found" claim, especially from delegated research — re-grep it; absence is only as good as the search pattern.
Research said no shared implementation existed; grepping the operation instead of the function name found six inline copies.
Negative-Invariant Testing
Protecting a "never does X" constraint — a behavioural test can't see an unused capability; assert structurally on the mechanism's existence.
A "never holds custody of funds" property had no test — nothing exercises custody, so nothing behavioural could go red.
Safe Data Export
Exporting sensitive or large data into a path inside a git tree — make the destination uncommittable and verify it (gitignore first, then git check-ignore + git status) before the data exists on disk.
A memory dump carrying an email address, an org name and handles was aimed inside a public repo before any ignore rule existed.
Diagnose & review
05 skillsRead the Real Failing Call
Hardening against a failure mode — instrument the real failing call before and after, because a plausible hypothesis is not a diagnosis.
Timeout-and-retry was built for a two-thirds failure rate; the real cause was a context dump drowning the prompt.
Manufacture Review Independence
Reviewing your own work (author == reviewer) — replace lost independence with scoped parallel passes and adversarial re-reads of the source.
Two reviewers split High vs Low on the same fact; the deciding evidence sat in a module outside both their scopes.
A Findings List Is Not a To-Do List
Acting on a review or audit list — re-read each item's disposition and bucket them; some are marked no-fix, some need a human decision.
Illustrative: "fix the rest" nearly implemented several items the review had explicitly marked as requiring no change.
Scan Generated Files for Artifacts
Reviewing or signing off a file an agent wrote with a tool — grep its head and tail for leaked harness residue (stray tags, fence fragments, content past EOF); passing tests don't cover non-code bytes.
An approved markdown file compiled and tested clean, then shipped with a leaked tool-call closing tag in its tail.
macOS Malware Triage
Checking a running machine for compromise — an improvised host sweep reads the same whether it was thorough or not.
A "scan my Mac" check improvised from recall reported clean — the two root-only checks it skipped were never named in the output.
Author & distill
04 skillsDistill the Scar
Turning a real failure into a reusable skill — capture the scar, extract one transferable invariant, write it in the anatomy, and gate it with the validator. The method that forged every skill here, made repeatable.
Nineteen skills existed and the method behind them did not — a contributor handed only the log could not produce a twentieth.
Name the Boundary Between Siblings
Adding or renaming a skill that will sit beside others — keyword coverage makes it findable, not pickable; grep your trigger words against the installed set and write a reciprocal boundary line into both files.
A whole-repo security-audit skill shipped beside a per-file one; both matched "security audit", neither named the other.
A Memory Is Not a Trigger
A stored memory, a recalled note, a session-start banner, a description-matched skill — the agent reads them, it doesn't run them. If an action must fire every session, gate it with a deterministic hook or forced invocation, not a note you hope gets recalled.
A must-do named in both a recalled memory and a startup banner went undone all session — nothing in the loop executed it.
Publish an OSS Repo
Publishing a repo, or auditing one that has working code but still reads as neglected — signal maintenance with a canonical (machine-detected) license, tagged releases, topics, and CI that enforces the artifact's contract, each verified through the platform's own API.
A hand-written licence summary made GitHub display "Other", and several version bumps had no tag or release behind them.
Same shape,
every time.
One folder, one SKILL.md. Plain Markdown, so any agent that can load a system prompt can use it — the plugin auto-discovery is the only Claude Code-specific part.
-
frontmatter
name + description
The description carries the trigger phrases, so a skill-aware agent surfaces the right skill when the situation matches.
-
the rule
The core rule
One paragraph. The whole lesson, stated once, before any elaboration.
-
where it lands
When this fires
The kind of work the rule belongs to, then the situation twice — the failure it was distilled from, and one more shape it takes elsewhere.
-
the cases
Checks
Each rule paired with the sanitized real case it came from — the scar that earned it.
-
the gate
Pre-flight check
The checklist that gates "done" and fails loudly when a box is unchecked.
Install
Two ways in. The plugin gives you auto-discovery; the manual copy is just folders.
Claude Code plugin
Add the marketplace, then install the plugin — all 31 skills come with it. Run both inside Claude Code.
Manual copy
Each skill is a self-contained folder in the Claude Code skill layout. Copy one, or all of them.