Skills

Language-agnostic agent skills for git/GitHub workflows, code quality, and project tooling — with first-class JS/TS support. Each skill ships with modular, independently editable rules for deep, opinionated guidance.

Why These Skills

• Language-aware, JS/TS-first — Skills detect the project's language and adapt. The general workflow/audit skills work in any language; the ecosystem tooling (setup, deps, testing) is polyglot — JS/TS is the best-supported path, with Python and Go covered via per-language references/.
• Modular rules architecture — Each skill ships with standalone rule files in rules/ directories. Rules can be added, removed, or edited independently without touching the main skill logic.
• Opinionated audit workflows — Skills like security, github-actions, and refactor produce structured severity-graded reports, then auto-fix issues.
• Secret scanning built in — The commit, security, and setup skills enforce secret detection as a first-class concern (GitLeaks by default, TruffleHog accepted).
• Convention-aware — Skills detect your project's existing conventions (language, commit format, package manager, project structure, git host) and adapt automatically.

Skills

The skills ship as four themed collections, each installable as its own plugin (workflow@tartinerlabs, quality@tartinerlabs, security@tartinerlabs, tooling@tartinerlabs). Install the collections you need, then invoke skills through your agent's native skill or command interface — e.g. /workflow:commit in Claude Code.

workflow

Git and GitHub workflow skills — commits, branches, pull requests, issues, and CI actions.

Skill	Description
commit	Clean git commits with conventional commit detection and secret scanning
create-branch	Create and checkout a branch with naming validation and GitHub/GitLab issue linking
create-pr	Push branch and create a pull/merge request (GitHub or GitLab) with structured description and auto-assignment
github-actions	Create and audit GitHub Actions workflows with SHA pinning, permissions, and caching checks
github-issues	Create, update, query, and comment on issues (GitHub, or GitLab via glab)

quality

Code quality skills — refactoring, naming conventions, and project structure.

Skill	Description
refactor	Audit and refactor code for dead code, deep nesting, and design patterns (language-agnostic; TS/JS idiom rules for TS/JS files)
naming-format	Audit and fix filename and export naming conventions for consistency
project-structure	Audit project directory structure for colocation, grouping, and anti-pattern detection

security

Security skills — OWASP audits, secret scanning, and dependency supply-chain hardening.

Skill	Description
security	OWASP Top 10 security audit with secret detection and dependency vulnerability scanning
deps	Harden the dependency supply chain — detects the ecosystem (JS/TS, Python, Go) for pinning, vulnerability scanning, and CI gates

tooling

Project tooling skills — linting/formatting setup, testing, and documentation sync.

Skill	Description
setup	Set up the ecosystem's lint/format/git-hooks/secret-scanning toolchain — detects the language (JS/TS, Python, Go)
testing	Write and run unit/component tests — detects the language and test runner (JS/TS, Python, Go)
update-project	Update and maintain CLAUDE.md, AGENTS.md, README.md, agents, skills, and rules to match current project state

Migrating from the tartinerlabs plugin? The original all-in-one tartinerlabs plugin is deprecated but still published for a transition period. Install the collection plugins above and uninstall the monolith when ready — the skills are identical, only the namespace changes (e.g. /tartinerlabs:commit → /workflow:commit).

Xcode Skills

The separate xcode-skills collection contains seven skills authored by Apple and exported with xcrun agent skills export from Xcode 27.0 (build 27A5218g). The exported directory is published unchanged; Tartiner Labs maintains only the plugin wrapper and marketplace metadata outside it.

Skill	Description
adopt-c-bounds-safety	Adopt and debug the C bounds-safety language extension
audit-xcode-security-settings	Audit and enable security-oriented Xcode build settings
device-interaction	Verify apps on a device or simulator through screenshots and UI interaction
modernize-tests	Modernize XCTest and Swift Testing suites
swiftui-specialist	Apply Apple's SwiftUI best practices
swiftui-whats-new-27	Use SwiftUI APIs and migration guidance for SDK 27
uikit-app-modernization	Modernize UIKit apps for multi-window environments

Install the collection through its native plugin identity:

# Codex
codex plugin add xcode-skills@tartinerlabs

# Claude Code
claude plugin install xcode-skills@tartinerlabs

# Direct installer
pnpm dlx skills add https://github.com/tartinerlabs/skills/tree/main/xcode-skills

In Codex and Claude Code, skills use the xcode-skills:<skill-name> namespace. In Cursor, install xcode-skills from the tartinerlabs marketplace.

The guidance can be read by any compatible agent, but some workflows expect Xcode's agent runtime, including Xcode project tools, device interaction, or subagent support. Those workflows require Xcode or equivalent runtime capabilities.

Agents

Agents invoke skills autonomously with an isolated worktree. Invoke with claude agent run <name>.

Agent	Description
deps	Autonomous supply chain hardening — runs the deps skill in an isolated worktree and outputs a structured summary

Installation

Claude Code Plugin

Add the marketplace, then install the collections you need:

claude plugin marketplace add tartinerlabs/skills

claude plugin install workflow@tartinerlabs
claude plugin install quality@tartinerlabs
claude plugin install security@tartinerlabs
claude plugin install tooling@tartinerlabs

The deprecated all-in-one plugin remains installable as tartinerlabs@tartinerlabs during the transition period.

Codex Plugin

This repository includes repo-scoped Codex plugin metadata in plugins/<collection>/.codex-plugin/plugin.json and .agents/plugins/marketplace.json.

To use it in Codex:

1. Open this repository in Codex
2. Restart Codex if needed so it reloads the repo marketplace
3. Open the plugin directory and install workflow, quality, security, and/or tooling from the repo marketplace

Cursor Plugin

This repository includes Cursor plugin metadata in plugins/<collection>/.cursor-plugin/plugin.json and .cursor-plugin/marketplace.json.

For local development, install the plugin with Cursor's plugin flow or copy the repository into Cursor's local plugin directory:

mkdir -p ~/.cursor/plugins/local
ln -s "$(pwd)" ~/.cursor/plugins/local/tartinerlabs

The shared skills/ directory is exposed to Cursor directly. Claude-specific hooks are intentionally not declared in the Cursor manifest.

Skills

Install all skills:

pnpm dlx skills add tartinerlabs/skills

Install a single skill:

pnpm dlx skills add tartinerlabs/skills/commit

Install a subset for specific workflows:

# Git and GitHub workflow skills only
pnpm dlx skills add tartinerlabs/skills/commit
pnpm dlx skills add tartinerlabs/skills/create-branch
pnpm dlx skills add tartinerlabs/skills/create-pr
pnpm dlx skills add tartinerlabs/skills/github-issues

# Security-focused subset
pnpm dlx skills add tartinerlabs/skills/security
pnpm dlx skills add tartinerlabs/skills/commit
pnpm dlx skills add tartinerlabs/skills/setup

Context7

Note: The Context7 skills channel has been retired — ctx7 skills install is deprecated upstream and stops working in the next major ctx7 release, with no successor command for installing skills from a repository. Context7 remains a documentation source; for these skills, use skills.sh or one of the plugin channels above.

OpenCode

Note: The OpenCode plugin has been retired — OpenCode's TypeScript plugin system differs too much from the manifest-based Claude Code/Codex/Cursor plugins to maintain alongside them, and the repository no longer carries a JS/TS toolchain (npm dependencies are a supply-chain surface this repo deliberately avoids). OpenCode users can install the skills directly via skills.sh, which copies them into OpenCode's skill discovery directories.

Plugin Metadata

Plugin manifests are hand-maintained under plugins/<name>/, one per channel, with .release-please-manifest.json as the shared version source. See AGENTS.md for the layout and CONTRIBUTING.md to contribute.

Architecture

Skills use a modular rules pattern, with per-language guides loaded on demand. Each skill directory contains:

skills/<name>/
  SKILL.md          # Skill definition with frontmatter; detects the language and routes
  rules/            # Independent, editable rule files (universal checks + the JS/TS path)
    some-rule.md    # Severity, examples, fix instructions
  references/       # Per-language guides, loaded only when that language is detected
    python.md       # e.g. the Python path for setup/deps/testing
    go.md           # e.g. the Go path

agents/<name>.md    # Optional Claude Code agents that invoke skills autonomously

For the polyglot skills (setup, deps, testing), SKILL.md detects the project's language from its manifest and loads only the matching guide — JS/TS lives in the first-class modular rules/, and other ecosystems live in references/<lang>.md, so a JS project never loads Go content.

This means you can:

• Customise a rule's severity or examples without forking the skill
• Add project-specific rules by dropping a new .md file in rules/, or a new language by adding references/<lang>.md
• Remove rules you disagree with

License

Tartiner Labs-authored content is licensed under the MIT License. The xcode-skills/ collection contains Apple-authored material exported from Xcode and is published with attribution without modification.