development-standards

Apply implementation standards only when a task requires changes to code, tests, dependencies, build configuration, shell scripts, or CI. Do not invoke for diagnosis or advice without code changes, documentation-only work, or chat.

Jump to install

Repository: trailofbits/codex-config
Last source activity: September 1, 2026 at 20:32
Detected SKILL.md language: English
Stars: 21
Forks: 0

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/trailofbits/codex-config --skill development-standards

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

8 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

fix-github-issue

Implement a GitHub issue end to end: research, branch, code, verify, review, push, open a pull request, and update the issue. Use when asked to fix or implement a specific GitHub issue.

2026-09-01

install-codex-config

Install or update this organization's Codex configuration from repo-local files into the user's Codex home. Use when asked to set up, install, update, bootstrap, or sync this Codex configuration, including the global AGENTS template, config.toml, hooks, rules, MCP servers, profile templates, and bundled skills.

2026-09-01

merge-dependabot-prs

Discover, evaluate, and optionally merge open Dependabot pull requests with dependency-aware ordering and post-merge verification. Use when asked to process or merge Dependabot PRs for a repository.

2026-09-01

View all from this repository

Development Standards

Routing

Read only the references that match files in scope:

Python source, tests, pyproject.toml, or Python lockfiles: references/python.md

JavaScript, TypeScript, package.json, or Node lockfiles: references/node-typescript.md

Rust source, Cargo.toml, or Cargo.lock: references/rust.md

Go source, go.mod, or go.sum: references/go.md

Shell scripts: references/shell.md

GitHub Actions workflows or action metadata: references/github-actions.md

For mixed changes, load each matching reference and no others. Skip them for documentation or advisory tasks.

Code

Create a shared utility only after the same pattern occurs in multiple places.

Prefer explicit control flow and cohesive modules. Simplify or justify long, complex, deeply nested functions and interfaces with many positional parameters.

Use the standard library or an existing dependency when it fits. Before adding or upgrading a dependency, verify its supported release and compatibility, inspect the lockfile, and follow the project's pinning and supply-chain policy.

Fail with the operation, relevant input or state, and a useful next step; do not swallow errors.

Delete commented-out code. Comments should explain constraints or surprising behavior.

Testing

Test behavior rather than implementation details. Cover boundaries, malformed and empty input, failures, and intentional error paths.

Mock only slow, non-deterministic, or external boundaries.

For a regression or important invariant, confirm the test fails against the faulty behavior.

Fix warnings caused by the change. If a warning cannot be removed safely, use the narrowest valid suppression and explain it.

name	development-standards
description	Apply implementation standards only when a task requires changes to code, tests, dependencies, build configuration, shell scripts, or CI. Do not invoke for diagnosis or advice without code changes, documentation-only work, or chat.