Agentic Coding Patterns

August 20, 2026 · View on GitHub

Community-maintained patterns, prompts, skills, agent instructions, workflows, and lessons learned for responsible agentic coding.

Status: Active development | License: CC0-1.0 | Repo: https://github.com/GSA-TTS/agentic-coding-patterns

Agentic Coding Ecosystem

This repository is part of a three-repo ecosystem:

Repo	Purpose	When to Use
Quickstart	Get running	First day setup, SBX + USAi config
Playbook	Do it right	Repo setup, standards, best practices
Patterns (you are here)	Share & learn	Community patterns, lessons learned

This is the collaboration hub. Share what's working, learn from others, and help build a community knowledge base.

Quick Reference

I want to...	Go to
Use a pattern	Browse INDEX.yaml or skills/, prompts/, workflows/
Contribute a pattern	Read CONTRIBUTING.md → Copy template → Run `make validate`
Integrate with AI tools	See AI Agent Integration Guide
Security issues	See SECURITY.md — direct fixes preferred
Run validation locally	`make setup && make validate`

Purpose

This repository is a community space for sharing reusable patterns, workflows, and lessons learned.

Behavioral standards live in the Playbook (don't duplicate them here)
Environment setup lives in the Quickstart
Community patterns and lessons live here

Content here is a starting point for reuse and review — it's community knowledge sharing.

What Belongs Here

✅ Reusable skills for common tasks (code review, documentation, testing)
✅ Prompt templates for planning, implementation, review
✅ Agent instruction patterns (AGENTS.md examples)
✅ Multi-step workflows
✅ Lessons learned from real usage
✅ Tool-specific examples (OpenCode, Claude, Copilot, Cursor)

What Does NOT Belong Here

❌ Secrets, credentials, API keys, tokens
❌ PII (Personally Identifiable Information)
❌ CUI (Controlled Unclassified Information)
❌ Internal URLs or system details
❌ Customer data or operational details
❌ Uncited compliance claims

Repository Structure

agentic-coding-patterns/
├── skills/              # Reusable procedures (code review, testing, documentation)
├── prompts/             # Standalone prompts for specific tasks
├── agents/              # Agent instruction patterns (AGENTS.md)
├── workflows/           # Multi-step end-to-end processes
├── lessons-learned/     # Community experiences and retrospectives
├── templates/           # Templates for creating new patterns
├── examples/            # Tool-specific integration examples
├── schemas/             # JSON Schemas for validation
└── docs/                # Documentation and guides

Quick Start

For Contributors

# Clone the repo
git clone https://github.com/GSA-TTS/agentic-coding-patterns.git
cd agentic-coding-patterns

# Install dependencies
make setup

# Optional: Install pre-commit hooks (recommended for regular contributors)
make install-hooks

# Validate content
make validate

# Generate INDEX.yaml
make generate

# Run tests with coverage report
make coverage

Note: Pre-commit hooks are opt-in. Use make install-hooks to enable automatic checks on commit. CI enforces all checks regardless of local hook installation.

For Users

Human users:

Browse available patterns in INDEX.yaml or by directory

Use the pattern discovery CLI:

# Search by tag
python scripts/search_patterns.py --tag security

# Filter by status (e.g. experimental — the default for new patterns).
# Note: `recommended` is populated only via the peer-review promotion gate
# (see docs/security-skill-promotion-checklist.md); no patterns are promoted yet,
# so `--status recommended` currently returns nothing.
python scripts/search_patterns.py --status experimental

# Combined filters
python scripts/search_patterns.py --tag security --tool opencode

Copy pattern directory to your project
Adapt frontmatter and content to your needs
Review and test before production use

AI agents:

Parse INDEX.yaml for pattern discovery (see AI Agent Guide)
Use the CLI for filtering: python scripts/search_patterns.py --json --tag <tag>
Filter patterns by type, status, tags, and portability flags
Read frontmatter to understand input/output contracts
Validate against prohibited_content before using

INDEX.yaml structure:

schema_version: "1.0"
repo: GSA-TTS/agentic-coding-patterns
patterns:
  skills: [{id, path, title, status, type}, ...]
  prompts: [...]
  agents: [...]
stats:
  total_patterns: <N>

Content Status Levels

Status	Meaning	Use When
`experimental`	New, untested in production	Exploring, testing
`recommended`	Proven useful, peer-reviewed	Production use
`deprecated`	Superseded by newer pattern	Migration only

Default for new contributions: experimental

A curated set of skills for security review and secure authoring. Every skill declares categories: [security], which triggers extra governance: a required human review, a deny-by-default tool/network/write/script policy, and explicit risk_tier. Policy authority lives in the playbook — this pack references it rather than restating it.

Governance model: docs/security-skill-governance.md
Agent routing (which skill for which trigger): docs/AI-AGENT-GUIDE.md
Taxonomy: categories is a closed vocabulary (see schemas/skill.schema.json); security is the axis that gates this pack.

Skill	Risk	Use it for
`secure-code-review`	moderate	Reviewing a code change or diff for vulnerabilities
`agentic-actions-auditor`	high	Auditing a GitHub Actions workflow for unsafe triggers/privilege
`least-privilege-review`	moderate	Checking permissions/`GITHUB_TOKEN` scope for over-grant
`untrusted-input-boundary-review`	moderate	Prompt-injection / trust-boundary analysis of untrusted input
`backdoor-review`	high	Hunting for backdoors, auth bypass, hidden persistence
`dependency-analysis`	moderate	Supply-chain / dependency vulnerability assessment
`compliance-claim-checker`	low	Verifying a FedRAMP/NIST compliance claim against evidence
`incident-evidence-review`	high	Postmortem / incident evidence-discipline review
`safe-shell-script-author`	moderate	Authoring a shell script that must pass the unsafe-shell scanner

Human-review gate: security skills are human_review_required: true. An agent may apply one, but promotion experimental → recommended and any change to a security skill require human sign-off — see the human-review gates.

Executive Technical Explainer Skills

A set of communications skills for explaining software development, agentic coding, and security controls to executive / non-engineering audiences — accurately, without hype, and without making an engineer wince at the inaccuracies. They are evidence-grounded: security and process claims cite the playbook and quickstart as ground truth, and they preserve the honest limits (the sandbox is isolation, not a perfect guarantee; the precise secrets caveat; the agent cannot approve or merge its own work).

Skill	Use it for
`technical-concept-translator`	Explaining one concept (PR, sandbox, agent vs. model vs. harness, AGENTS.md, secret) to an executive
`software-delivery-explainer`	Showing where agents act and where the human control points are in the delivery process
`agentic-value-analyst`	Framing organizational value without hype; evidence-labeled claims, defensible metrics

These compose into the design-artifact workflow's technical-explainer profile. Any team can use them independently of a leadership-briefing use case — they are a reusable capability for turning technical material into accurate executive explanations. Reference material (an executive concept library, six audience profiles, and evidence/measurement guidance) ships alongside the skills.

Contributing

See CONTRIBUTING.md for full guidelines.

Quick version:

Use a template from templates/
Fill in frontmatter (all required fields)
Write clear, reusable content
No secrets, PII, or CUI
Run make validate before commit
Submit PR with review checklist

Safety Requirements

All patterns MUST:

Define prohibited_content in frontmatter
Use placeholders for environment-specific values
Pass sensitive term scanning
Include human review checklist

See docs/safety-guidance.md for details.

Validation

make validate    # Run all validators
make test        # Run tests
make ci          # Full CI check

Tool Compatibility

Patterns track compatibility via portability frontmatter:

opencode: OpenCode SKILL.md format
cursor: Cursor .cursorrules
claude_projects: Claude Projects
chatgpt: ChatGPT custom instructions
generic_llm: Generic LLM prompting

License

This repository is released under CC0-1.0 (public domain). Content is provided as-is with no warranties.

Getting Help

Questions: Open a GitHub issue or start a discussion
Browse docs: See docs/ for guides
Improvement ideas: Open an issue or submit a PR
Relationship to other repos: See docs/repository-ecosystem.md

Development Setup

Pre-commit Hooks

This repository uses pre-commit hooks for code quality and security:

# Install pre-commit (if not already installed)
pip install pre-commit

# Install the git hook scripts
pre-commit install

# (Optional) Run against all files
pre-commit run --all-files

Hooks configured:

gitleaks — Secret detection (critical for example code)
ruff — Python linting and formatting with security rules
markdownlint-cli2 — Markdown formatting
Pattern validation — Frontmatter schema validation
Basic hygiene — YAML/JSON/TOML validation, trailing whitespace, etc.

GitHub Actions security scanning (CI, not a local hook):

zizmor runs in CI via .github/workflows/zizmor.yml on workflow-file changes — it is intentionally not a local pre-commit hook. You can also run it manually:

zizmor .github/workflows/

Install locally (optional): cargo install zizmor or brew install zizmor.

See .pre-commit-config.yaml for full configuration.