cc-skills

Get a second opinion from OpenAI Codex CLI on difficult debugging, code analysis, or architecture problems, run a code/diff review (finder or adversarial-refuter passes over a diff or working tree), run a security review/audit or verification of security-sensitive code (auth, input validation, crypto, secrets), diagnose a bug, fan a repetitive bounded sweep (N-unit migrations, test conversions, mechanical refactors) across parallel codex lanes (individual bounded changes and large net-new code stay on Claude — opus, fable only when the surface is very sensitive or error-prone), generate images (logos, mascots, banners, illustrations) with Codex's $imagegen skill, or offload rote throwaway work (one-off scripts, data munging) where code quality doesn't matter and nothing can go wrong. Use when reviewing code or a diff for defects, when auditing or verifying security-sensitive code, when diagnosing a bug, when stuck after multiple attempts, for a sweep of fully specified edits, when asked to generate an image,

Bootstrap or retrofit a new repository with proven agent docs, README and brand assets, Claude Code settings, ccx, capt-hook guards, tests, linting, CI, and release conventions. Supports Python packages and CLIs using uv, Click, pytest, ruff, and ty; Go CLIs using cobra, slog, Task, and golangci-lint; Swift packages and CLIs using SPM, Swift Testing, SwiftFormat, and SwiftLint; and synced-project SwiftUI iOS apps. Optional publishing covers Great Docs on GitHub Pages, trusted PyPI releases, and Homebrew releases for Go and Swift CLIs. Use when creating a repository from scratch, scaffolding a Python, Go, or Swift package, CLI, or iOS app, or applying these conventions to a young repository.

Open a pull request that reads like the repo's own maintainers wrote it — orient with `ccx vcs lane` and `ccx vcs guidelines`, learn the house style from a bot-filtered sample of recent human-authored merged PRs via a cached per-repo style card, calibrate register against a local wlm voice profile, run a politeness and standards-conformance pass with issue-first handling on repos the user does not own, write the title, body, and commit messages to the repo's own conventions, ship through `ccx vcs ship`, and hand the CI and bot-comment watch to a background pr-watcher agent. Use when opening, submitting, or contributing a pull request, drafting a PR title or body, contributing a change to an open-source repo, or shipping a branch as a PR.

Attach to an already-open pull request and iterate it until CI is green and the bots are quiet — poll checks, review verdicts, and bot comments through a Monitor on the bundled poll script, apply the fixes the failure itself determines (formatter output, single-resolution compile and type errors, stale lockfiles and snapshots, review suggestion blocks, bot nits naming the exact replacement), ship each through ccx vcs ship, and bring every real decision back with 2–4 concrete options. Four mechanical safety gates precede every edit and a per-PR state file caps attempts per check across restarts. The human-driven counterpart to open-pr's background watcher. Use when the user says "watch this PR", "fix CI on PR 123", "get the PR green", "address the review comments", or "why is CI failing on my PR", when driving a PR someone else opened, or when resuming a PR whose background watcher already reported.

Research-backed, provider-agnostic guidance for writing LLM prompts and agent instructions — positive framing, XML structure, contrastive examples, outcome-first agentic contracts, and provider tuning knobs. Use when writing or revising a system prompt, agent or tool instructions, a tool description, or few-shot examples; or when the user asks to improve a prompt.

Check a file (or piece of text) for LLM-generated prose tells using the slop-cop CLI and report the violations. Use when the user asks to "check/lint/scan this file for slop", "find LLM tells in <file>", "run slop-cop on <path>", or wants a violations report for a doc, README, blog post, PR description, or commit message. Report-only by default; offers to apply fixes if asked.

Generate an animated SVG terminal demo of a CLI using evp — write a .tape, render it, inspect the keyframes, and refine in a loop until it looks good. Use when the user asks to "make/record a terminal demo of <cli>", wants an "animated SVG/GIF demo of a command", a "VHS-style terminal recording", or a demo GIF/SVG for a README. Renders natively on Linux x86_64 and via Docker (linux/amd64) on macOS/ARM.

Run an assumptions-first architecture design and ship it as an interactive design doc. Ground truths land in a register with stable IDs, every design fork goes through a question round with a recorded escape hatch, an adversarial review attacks the middle draft, and every estimate is gated on a named spike. The deliverable is a registers.json-driven single-file HTML doc plus a generated PDF, written as a humble proposal that explains and asks for feedback. Use when asked to "write a design doc", "architecture proposal", "help me design <system>", "redesign <system>", "assumptions-first design", or to turn a systems discussion into a reviewable design document.

Mint and stash the Apple release credentials a signed-app repo needs — a Developer ID Application signing certificate (local CSR, portal upload via agent-browser-with-cookies, full-chain .p12) and an App Store Connect notary API key — verify the identity actually signs, then push both into 1Password and the repo's GitHub secrets. Use when a signed-app release (release-app.yml / wrap-daemon-bundle) needs MACOS_SIGN_P12 / MACOS_SIGN_PASSWORD / MACOS_NOTARY_* filled, when renewing an expiring Developer ID cert, or when setting up notarization for a new signed macOS app. macOS; you must be signed in to developer.apple.com as the Account Holder.

Use when writing or revising project documentation of any kind — a README, docs-site landing page, tutorial, quickstart, how-to guide, reference page, API doc, cheat sheet, examples catalog, limitations or FAQ page, or changelog — and when consolidating, auditing, or rebuilding a whole docs set. Applies the Diataxis framework (one mode per page), a technical-builder voice, runnable code-sample rules, the conversion skeleton for READMEs and landing pages (a pain-naming opener, one live get-started path with a real-run demo, use cases that show observed behavior, an agent block), standalone-README design, consolidation by rewriting (parallel per-page audits with defects and gems, an explicit merge map with per-page verdicts, alias frontmatter, a link retarget sweep), honesty gates that test docs claims against the real package (reflection gate, extract-and-run, regenerated CLI output, parity-gated demos), findability rules (task-phrased headings, a narrative home for every task), delegated-prose work orders (ve

Run AUTHENTICATED agent-browser automation against one or more sites by reusing your existing local browser login — stream those sites' cookies straight out of the local browser store (one Touch ID tap via the `cookiesync` CLI and its resident daemon) into a fresh agent-browser session, then do the task. Use when a browser task needs you to be logged in (dashboards, gated pages, account settings, an app that calls a separate API host, "do X on <site> as me", "use my session/cookies") and the user is already signed in via their desktop browser. macOS; authorized local use on the user's own machine.

Choose the right surface before delivering anything to the human — plain prose, AskUserQuestion, a static Artifact page, or a live cc-present board — and present instead of dumping walls of text. Use when about to deliver findings, a review, a report, a comparison, a plan, or a set of options; when the user says "show me", "present this", or "which one"; or at any moment the response is about to exceed a screen of structured text.

Create or non-destructively refresh a fancy GitHub profile README — the special <username>/<username> public repo that renders at github.com/<username>. Driven by real GitHub data (repos, stars, pinned items, languages, releases, recent activity), never invented; marker-delimited sections stay fresh via a committed cron updater, flattery gates hide numbers that don't impress, and the default "fancy" intensity adds an AI banner (dark/light), snake animation, and cron Actions. Use when asked to "make my GitHub profile fancy", create/update/refresh a profile README, set up the github.com/<me> page, or work on the <username>/<username> repo.

Headless refresh for a gh-profile-managed profile repo — rewrite the summaries sidecar (.github/profile-summaries.json) from real commit and release data so the activity and shipped sections carry one-line summaries, re-render the marker sections, refresh prose when activity warrants it, and push one commit. Use when running inside the profile repo's scheduled Claude workflow (profile-claude-refresh.yml) or when asked to refresh profile summaries.

Headless refresh of a Claude-maintained summaries sidecar in a consumer repo — read the repo's summaries config (.github/summaries.config.json), gather raw material per group via the config's recipes, rewrite the sidecar whole with reuse-before-rewrite, then run the config's render command so the consumer's lines pick up the one-line summaries. Use when running inside a consumer repo's scheduled Claude workflow or when asked to refresh a summaries sidecar; consumer skills (e.g. /gh-profile:refresh) wrap this with repo-specific steps.

Generate project images — mascot logos, README banners (dark/light variants), GitHub social-preview cards, and arbitrary illustrations — via the OpenAI Images API, compressed locally to under 1 MiB. Use when asked to generate a logo, mascot, banner, hero image, social card, brand images, or any illustration for a repo, docs site, or profile; also invoked by repo-bootstrap and gh-profile for their image phases.