coding-agent-skill-library

Use when reviewing code before merge to assess correctness, tests, maintainability, security and user impact.

Use when reviewing plans, recommendations, prioritisation, risk registers, retrospectives or agent outputs for judgement distortion from cognitive bias — not for checking whether an argument's premises validly support its conclusion.

Use when evaluating whether premises in plans, ADRs, reviews, security justifications or agent recommendations validly support their conclusions — for logical fallacies, not judgement distortion from cognitive bias.

Use when a coding agent needs robust problem solving, explicit decomposition, alternative-path exploration, program-aided reasoning, ReAct loops, or self-correction.

Use when generated code, plans, tests, prompts or architecture need critique, repair and verification before completion; especially for coding tasks requiring self-review, test-driven repair or quality gates.

Identifies risks, scores likelihood and impact, selects treatment, assigns owners and review cadence. Use when building or updating a risk register, treating agent autonomy risks, or deciding mitigate, transfer, accept or avoid.

Identifies assets, trust boundaries, threats and mitigations for systems and agents. Use when designing security-sensitive features, reviewing attack surface, or planning abuse-case tests.

Applies WCAG 2.2 AA-aligned accessibility checks to interfaces, forms, dashboards and components. Use when building or reviewing any user-facing UI, content, or agent supervision screen.

Designs interfaces for supervising, approving, steering and auditing AI agent actions with evidence and uncertainty surfaced. Use when building agent workflows, approval gates, or audit surfaces.

Governs AI models through inventory, purpose, risk tier, approval, monitoring, drift, kill-switch and retirement. Use when introducing, changing or operating models in production or agent workflows.

Designs HTTP/service APIs with OpenAPI, resource models, authZ, versioning, deprecation and contract tests. Use when defining or evolving service APIs, not dataset or event contracts.

Mandatory immutable baseline applying an Asimov-inspired hierarchy of AI safety laws. Use when at every session start and before any other skill, plan, routing decision, tool use, or material edit. Also known as apply_laws_of_AI.

Applies behaviour-driven development with business-readable scenarios linked to executable acceptance tests. Use when defining externally visible behaviour, acceptance criteria, or user-facing workflows before implementation.

Use when verifying browser-based behaviour with Chrome DevTools, including DOM state, console output, network activity and performance evidence.

Models stable business capabilities, levels, ownership, maturity and heatmaps. Use when mapping organisational abilities, decomposing strategy, or assigning capability ownership.

Derives business concepts and relationships from capabilities, value streams and processes. Use when linking business architecture artefacts to information concepts for data modelling.

Assesses current and target maturity, gaps, risks and roadmap priorities. Use when prioritising capability improvement or planning architecture roadmaps.

Designs CDC and streaming ingestion from operational sources to event streams. Use when capturing database changes, replicating operational data, or building source-to-stream pipelines.

Use when designing or changing build, test or deployment automation that needs explicit safety, permissions and verification.

Designs cloud landing zones, tenancy, shared services and network or identity boundaries. Use when defining platform foundations for multiple workloads rather than a single application solution.

Identifies business concepts, entities and relationships without premature physical design. Use when starting data architecture or aligning business language with information models.

Use when a task needs the right repository, file and document context assembled without unnecessary noise.

Defines producer-consumer contracts for schema, semantics, quality, compatibility and operations. Use when formalising API, event, or dataset agreements between teams.

Defines ownership, policies, quality rules, controls, monitoring and remediation. Use when establishing data governance, quality SLAs, or remediation workflows.

Designs batch, API, event, CDC, semantic and file-based integration patterns. Use when connecting systems, choosing integration styles, or resolving interoperability gaps.

Designs lifecycle, retention, archival, deletion, legal hold and disposal controls. Use when defining data retention policies, archival strategy, or compliant deletion.

Tracks source-to-target lineage, transformation history, evidence, ownership and provenance. Use when documenting data flows, audit trails, or impact analysis for changes.

Designs actionable data product dashboards for quality, lineage, validation, quarantine and operations. Use when building data-ops, quality, or lineage dashboards.

Designs governed, domain-owned, discoverable and reusable data products. Use when packaging datasets as products, defining ownership, or reviewing product readiness.

Designs classification, access, masking, privacy, entitlement and sensitive-data controls. Use when securing shared data, defining privacy controls, or classifying datasets.

Applies domain-driven design with bounded contexts, aggregates, and ubiquitous language. Use when modelling complex business domains, defining boundaries, or protecting invariants.

Use when retiring an old path, replacing a legacy behaviour or moving users to a new interface or workflow.

Maintains consistent, accessible design systems using tokens, components and documented patterns. Use when creating or evolving a shared UI component library or design tokens.

Use when a change needs durable documentation, an architecture decision record or maintainership guidance.

Uses DevOps Research and Assessment delivery metrics (classic Four Keys plus rework rate) to improve delivery performance without gaming metrics. Use when measuring deployment frequency, lead time, change failure rate, recovery time, or rework rate.

Applies DRY to remove harmful duplication while avoiding misleading abstraction. Use when refactoring repeated knowledge, schemas, validation rules, or agent instructions.

Reviews integration designs against EIP, reliability, security and operability criteria. Use when validating architecture decisions, message topologies, broker configs or implementation plans.

Use when measuring coding-agent quality, regression risk, latency, cost, reliability, safety, drift, or production performance.

Designs event-driven systems with asynchronous flows, brokers, producers, consumers and contracts. Use when architecting asynchronous, decoupled, or event-first systems.

Governs event ownership, classification, metadata, lineage, quality and lifecycle. Use when governing shared event catalogues, schemas, or stream ownership.