skills

Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating browser actions.

Reviews and removes unsupported, non-idiomatic code and UI/design changes introduced on a branch. Use when implementing or reviewing a feature or fix before handoff.

Design principles for REST and GraphQL APIs in 2025. Enforces OpenAPI-first, versioning strategies, and standardized error responses.

Use the `fm` CLI (Apple Foundation Models) for on-device and Private Cloud Compute LLM inference on macOS. Use when the user wants to prompt, chat, serve, or count tokens with Apple's built-in foundation models. Also use for structured output generation (`fm schema`), checking model availability (`fm available`), or checking quota usage (`fm quota-usage`). Trigger on phrases like 'run fm', 'Apple Foundation Model', 'on-device LLM', 'Apple AI', 'fm respond', 'fm chat', 'fm serve', 'fm token-count', 'fm schema', or any task involving Apple's local AI models.

This skill should be used when the user asks to "trigger a build", "check build status", "watch a build", "view build logs", "retry a build", "cancel a build", "list builds", "download artifacts", "upload artifacts", "manage secrets", "create a pipeline", "list pipelines", or "interact with Buildkite from the command line". Also use when the user mentions bk commands, bk build, bk job, bk pipeline, bk secret, bk artifact, bk cluster, bk package, bk auth, bk configure, bk use, bk init, bk api, or asks about Buildkite CLI installation, terminal-based Buildkite workflows, or command-line CI/CD operations.

Buildkite CI/CD pipeline setup, migration, validation, hardening, and live pipeline management. Use when Codex needs to create, review, debug, or update Buildkite pipelines, .buildkite/pipeline.yml files, steps, queues, triggers, artifacts, annotations, secrets, OIDC, or deployment stages.

This skill should be used when the user asks to "write a pipeline", "add caching", "make this build faster", "show test failures in the build page", "add annotations", "only run tests when code changes", "set up dynamic pipelines", "add retry", "parallel steps", "matrix build", "add plugins", or "work with artifacts in pipeline YAML". Also use when the user mentions .buildkite/ directory, pipeline.yml, buildkite-agent pipeline upload, step types (command, wait, block, trigger, group, input), if_changed, notify, concurrency, or asks about Buildkite CI configuration.

Runs Buildkite CI builds against changes in the local working tree. Use when asked to run preflight or run CI.

CI/CD security hardening for supply chain, secrets, runners, and artifacts. Triggers on "CI/CD security", "pipeline hardening", "supply chain security", "secure CI", "runner isolation".

Quality gates, code review standards, static analysis policy, and merge criteria enforcement.

Inspect codebases w/ pygount: LOC, languages, ratios.

Rewrite a user-provided prompt into a clearer, outcome-first prompt before taking action. Use when the user asks to convert, optimize, improve, migrate, harden, or rewrite a prompt, or when they invoke $convert-prompt to turn a rough task request into an executable prompt with goals, constraints, output format, evidence rules, validation, and stop conditions.

Always-on delivery baseline for SWE/DevOps work (code review, quality gates, testing, CI/CD security, release discipline). Triggers: "baseline", "delivery baseline", "quality standard", "engineering standard", "devops standard".

Production-grade Docker/OCI image creation. Enforces security (non-root, SBOM), minimalism (multi-stage), and reproducibility (pinned versions).

Use the Figma MCP server for Figma URLs, node IDs, design-to-code implementation, and MCP setup or troubleshooting.

Designer-turned-developer who crafts strong UI/UX when a project needs visual direction without a strict mockup.

Use Gemini CLI in headless JSON mode for high-level codebase analysis, repo overviews, architecture reports, broad context gathering, unfamiliar codebase mapping, multi-file bug triage, dependency tracing, migration planning, cross-cutting reviews, and other tasks that benefit from Gemini's large context window. Use when a user asks to analyze or understand a codebase at a high level, explain main modules or flows, map a whole project, investigate a broad behavior across many files, or when local Grep/Glob or explore agents would require many passes. Fall back to explore agents when Gemini is unavailable, unauthenticated, quota-limited, privacy-sensitive, or when precise targeted search is enough.

Official GitHub CLI (gh) automation for PRs, Issues, Actions, and Repos.

Git workflow skill for commits, rebases, history search, and branch cleanup. Use for commit, rebase, squash, blame, or history questions.

Create, inspect, trigger, and monitor Jenkins CI/CD workflows on the user's Jenkins server instead of running substantial build/test/deploy work on the local Mac. Use when Codex is asked to set up Jenkins workflows, write Jenkinsfiles, move local commands to CI, trigger or monitor Jenkins jobs, inspect Jenkins agents/labels/plugins, or run build/test/package/release automation remotely through Jenkins.

Manage issues, projects & team workflows in Linear. Use when the user wants to read, create or updates tickets in Linear.

macOS administration hardening for baselines, compliance, patching, and configuration management. Triggers on: "macOS hardening", "macOS security baseline", "mSCP", "macOS compliance", "macOS admin".

Build, run, and debug Maestro UI automation for Android, iOS, and Web. Use when Codex needs to install or verify Maestro, create or refactor Maestro flow YAML files, organize a `.maestro` workspace, record flows, run tests locally or in CI, configure tags/hooks/workspace config, or diagnose flaky Maestro selectors and flow logic.

Debug Node.js via --inspect + Chrome DevTools Protocol CLI.

Safely interact with 1Password from agent workflows using a service account token and the 1Password SDK. Use when Codex needs to load OP_SERVICE_ACCOUNT_TOKEN, resolve 1Password secret references, inject credentials into commands, upload secrets to CI/CD tools, use SSH keys without printing them, or read/write items in an agent-scoped vault without exposing secret values.

Author and review OpenCode plugins that live in `.opencode/plugins/` or are loaded from npm packages. Use when deciding plugin vs custom tool, wiring plugin hooks or plugin-provided tools, setting up plugin dependencies, or verifying local and npm-loaded OpenCode plugin behavior. Prefer `opencode-sdk-builder` for Node or Bun app integrations built with `@opencode-ai/sdk`, and prefer `opencode-server-integrations` for raw HTTP integrations against `opencode serve`.

Build or review Node.js and Bun integrations that use `@opencode-ai/sdk` to control OpenCode programmatically. Use when wiring embedded or attached SDK clients, managing sessions and prompts, handling structured output or event streams, or validating a JS/TS integration against a local OpenCode instance. Prefer `opencode-plugin-author` for behavior that runs inside OpenCode as a plugin, and `opencode-server-integrations` for non-SDK or polyglot HTTP integrations against `opencode serve`.

Build and verify integrations against the OpenCode HTTP server exposed by `opencode serve`, including raw OpenAPI-style requests, SSE event handling, polyglot clients, and remote or headless setups. Use when integrating over HTTP directly instead of the SDK, when wiring non-Node clients, or when attaching tools to a running OpenCode backend. Prefer `opencode-sdk-builder` for Node/Bun work with `@opencode-ai/sdk`, and `opencode-plugin-author` for behavior implemented as OpenCode plugins.

Debug Python: pdb REPL + debugpy remote (DAP).

Enforces the 2025 Python stack. Replaces legacy tools (pip, flake8, isort) with modern, fast equivalents (uv, ruff). Mandates strict type hints.

DevOps release management for planning, versioning, deployment strategies, rollback, and change control. Triggers: "release management", "deployment strategy", "rollout plan", "rollback plan", "release checklist".

Throwaway experiments to validate an idea before build.

4-phase root cause debugging: understand bugs before fixing.

TDD: enforce RED-GREEN-REFACTOR, tests before code.

Strategic testing for modern stacks. Combines high-speed Unit Testing (Vitest) with reliable E2E (Playwright). Bypasses implementation-detail testing.

Enforces 2025 strict TypeScript standards. Focuses on type safety at runtime (Zod), strict compiler options, and advanced type gymnastics only when necessary to prevent bugs.

Write implementation plans: bite-sized tasks, paths, code.