Skill Library

Agent skills, subagents, personas, rules and workflows you can drop into a project. They work with Claude Code, Claude.ai, OpenAI Codex and ChatGPT. Each item is written for any project: the project-specific parts are {{PLACEHOLDERS}} in a Customize for your project section at the end of the file.

Install
How to run an agent team
Example session
What's in the catalog
Frontmatter schema
External skills

Install

The zip you downloaded is laid out for the target you picked at checkout.

Target	Where things go	Then
Claude Code	`.claude/skills/<slug>/SKILL.md`, `.claude/agents/<slug>.md`	Paste the routing snippet from `CLAUDE.md` into your project's `CLAUDE.md`. Skills load when their description matches; agents show up in `/agents`.
Claude.ai	one zip per skill	Upload each one under Settings → Capabilities → Skills.
Codex / ChatGPT	`.agents/skills/<slug>/SKILL.md` + `AGENTS.md`; `chatgpt/instructions.md`	Codex reads `AGENTS.md` and the skills folder. For a custom GPT, paste `instructions.md` into Instructions and upload the skill files as Knowledge.
Universal	`AGENTS.md` + `skills/`	Point your tool at `AGENTS.md`; copy `skills/` wherever it looks for skills.

Install paths change. If something doesn't load, check your tool's current docs.

After installing, search each file for {{ and fill in the placeholders. The most common ones:

Placeholder	Meaning	Example
`{{DOCS_DIR}}`	your docs folder	`docs/`
`{{WORK_ORDERS_DIR}}`	where work orders live	`docs/work-orders/`
`{{HANDOFFS_DIR}}`	standalone handoff notes	`docs/handoffs/`
`{{DESIGN_SYSTEM}}`	design system spec	`DESIGN.md`
`{{API_CONTRACT}}`	API reference	`docs/api-contract.md` or `openapi.yaml`
`{{DATA_SCHEMA}}`	data model reference	`docs/database-schema.md`
`{{VERIFY_COMMAND}}`	the check for a module	`npm run check`
`{{ADR_DIR}}`	decision records	`docs/adr/`

How to run an agent team

One agent doing everything forgets things, drifts out of scope and says "done" too early. A team is the same model working in roles. Each role has one job and passes its work on in writing.

1. Router: who owns this?

The agent-team rule is always loaded. It reads the ask and picks one owner from its routing table. If the ask is unclear or covers more than one area, it goes to eng-manager. If you only need to find where something lives, send a scout.

2. Work order: what exactly are we doing?

eng-manager writes a work order (work-order). It has a one-sentence goal, acceptance criteria, an out-of-scope list, story points, a touch list and the verify commands. Anything that isn't in the work order is out of scope. If a contract or architecture question comes up, tech-lead answers it first and records the decision as an adr. A hard call can go to decision-council.

3. Specialist: do only that.

The owner loads its skill (ui-ux-designer, design-system, api-contract or your own module roles) and builds what the work order describes, following engineer-mindset: make the smallest change that works.

4. Verify: prove it.

The verify subagent runs every check and quotes the real errors. qa-verifier writes PASS / FAIL / PENDING into the work order and checks off the acceptance criteria. If anything is red, the work goes back to the specialist. A check that wasn't run is never reported as green. Reviewers like ui-review, privacy-check and docs-drift-auditor run here too.

5. Handoff: leave a trail.

When the role changes or the session ends, write a handoff: what's done, what's not done, decisions that are locked, files touched, risks, the next 3 actions and the commands already run. The next agent starts from this note, not from memory. docs-scribe updates any docs the change made stale.

Example session

You: Add CSV export to the orders page.

Router (agent-team). This touches the UI and the API, so it goes to eng-manager.

Work order (eng-manager).

WO-20261113-orders-csv-export   SP: 5   Sprint: 2026-W46   Style: collaborative
Goal: Staff can download the filtered orders list as CSV.
Acceptance:
  - [ ] "Export CSV" button on Orders, respects current filters
  - [ ] GET /v1/orders/export streams CSV, max 50k rows, ERR_EXPORT_TOO_LARGE above
  - [ ] Export is written to the audit log (order.exported)
  - [ ] verify green
Out of scope: scheduled exports, Excel format
Owner: api role → ui role     Reviewers: ui-review, privacy-check

Tech lead. scout maps the orders list query and its callers. api-contract adds the export endpoint additively. audit-trail adds the order.exported action. One adr records "stream from the server, not built in the browser".

Specialists. The API role builds the endpoint, and its new error code goes in error-codes-registry. A handoff goes to the UI role. The UI role adds the button using design-system primitives and accessibility (a real <button> with a busy state that screen readers announce).

Verify. verify reports that typecheck, lint, tests and build pass, with 41 tests passing. ui-review finds one blocking issue: Export.tsx:18 hardcodes #2563eb, which should be color="primary". The UI role fixes it and verify passes again. privacy-check reports the fixtures are CLEAR.

Handoff and close. qa-verifier records PASS and docs-scribe updates the API contract. eng-manager closes the work order.

What's in the catalog

Category	Items
Workflow	`agent-team`, `agent-directives`, `work-order`, `handoff`, `release`
Roles	`eng-manager`, `tech-lead`, `ui-ux-designer`, `qa-verifier`, `docs-scribe`, `engineer-mindset`
UI	`ui-hig`, `design-system`, `accessibility`, `motion`
Engineering	`package-choice`, `api-contract`, `error-codes-registry`, `debug`, `audit-trail`
Thinking	`flowchart`, `decision-council`, `adr`
Subagents	`scout`, `verify`, `ui-review`, `docs-drift-auditor`, `privacy-check`

Plus external skills from Cloudflare, Trail of Bits, Anthropic, Supabase, Vercel, obra/superpowers and Playwright (see External skills).

Frontmatter schema

Every item is a folder:

<slug>/
  SKILL.md        # frontmatter + instructions
  flow.mmd        # Mermaid flowchart of how it runs
  references/     # optional extra docs the skill links to

Subagents (type: agent) use the same SKILL.md filename in the catalog. The packer writes them out as .claude/agents/<slug>.md. Their body is the agent's system prompt.

---
name: work-order                 # = folder slug; lowercase, hyphens
description: >-                  # when to use it, written as triggers. Agents read this to decide.
  Write or update a work order … Use whenever a task is accepted …
type: workflow                   # skill | agent | persona | rule | workflow
category: workflow               # workflow | roles | ui | engineering | thinking | subagents
tags: [planning, scope]
does: One line, what it does.    # card summary
looksFor:                        # triggers / signals, shown as chips
  - a task accepted with no written scope
outputs:                         # what it produces
  - "{{WORK_ORDERS_DIR}}/WO-YYYYMMDD-short-slug.md"
pairsWith: [agent-team, eng-manager]   # suggestions in the cart
requires: [handoff]              # auto-added to the cart
platforms: [claude, codex, chatgpt]
# agents only:
tools: Bash, Read, Grep, Glob    # Claude agent tool allowlist
model: sonnet                    # sonnet | opus | haiku | inherit
audit:
  source: original | universalized from a private production project's agent setup
  author: trueorfalse.dev
  license: MIT
  importedAt: "2026-11-13"
  lastVerified: "2026-11-13"
  changes: What we changed from the source.
  privacyScan: pass | fail
  hasScripts: false
---

Field	Required	Notes
`name`	✅	Must equal the folder name.
`description`	✅	Starts with what it does, then "Use when …". This is the trigger.
`type`	✅	`skill` teaches a technique, `persona` is a role to act as, `rule` is always on, `workflow` is a multi-step procedure, `agent` is a subagent with its own tools and model.
`category`	✅	One of the six above.
`tags`	✅	Free-form, used by search.
`does`	✅	One line, no period needed.
`looksFor`	✅	2–5 signals.
`outputs`	✅	Files or artifacts it produces.
`pairsWith`	✅	Slugs; may be empty.
`requires`	✅	Slugs that must ship with it; may be empty.
`platforms`	✅	Subset of `claude`, `codex`, `chatgpt`.
`tools`, `model`	agents	Claude subagent format.
`audit`	✅	Provenance, shown on the item page and in `manifest.json` / `ATTRIBUTION.md`.

External skills

external/<slug>.yaml maps the best public skills. Nothing from them is copied into this catalog. The packer fetches each one at its pinned commit.

name: workers-best-practices     # upstream skill name
type: skill
does: …
looksFor: [ … ]
category: engineering
source: https://github.com/<owner>/<repo>/tree/<commit>/<path>
repo: https://github.com/<owner>/<repo>
path: skills/workers-best-practices
author: Cloudflare
license: Apache-2.0
pinnedCommit: <40-char sha>
mode: bundle                     # bundle = ships in the zip with its LICENSE; link = "Get it from source"
hasScripts: false                # true → "contains scripts, review before use" badge
platforms: [claude, codex, chatgpt]
verifiedAt: "2026-11-13"
notes: …                         # license caveats, script warnings

bundle: the license allows redistribution (MIT, Apache-2.0, CC-BY-SA when unmodified). The zip includes the upstream LICENSE, and the skill is credited in ATTRIBUTION.md.
link: the license is missing or unclear. The card says "Get it from source" and nothing is copied.
hasScripts: true: the skill ships code that runs. Read it before you use it.

Every item, ours and external, lists its source, author, license, pinned version, what we changed and its privacy scan in manifest.json and ATTRIBUTION.md inside the zip.