Skills

Language-agnostic agent skills for git/GitHub workflows, code quality, and project tooling — with first-class JS/TS support. Each skill ships with modular, independently editable rules for deep, opinionated guidance.

• Language-aware, JS/TS-first — Skills detect the project's language and adapt. The general workflow/audit skills work in any language; the ecosystem tooling (setup, deps, testing) is polyglot — JS/TS is the best-supported path, with Python and Go covered via per-language references/.
• Modular rules architecture — Each skill ships with standalone rule files in rules/ directories. Rules can be added, removed, or edited independently without touching the main skill logic.
• Opinionated audit workflows — Skills like security, github-actions, and refactor produce structured severity-graded reports, then auto-fix issues.
• Secret scanning built in — The commit, security, and setup skills enforce secret detection as a first-class concern (GitLeaks by default, TruffleHog accepted).
• Convention-aware — Skills detect your project's existing conventions (language, commit format, package manager, project structure, git host) and adapt automatically.

The skills ship as five themed collections, each installable as its own plugin (workflow@tartinerlabs, quality@tartinerlabs, security@tartinerlabs, tooling@tartinerlabs, design@tartinerlabs). Install the collections you need, then invoke skills through your agent's native skill or command interface — e.g. /workflow:commit in Claude Code.

Git and GitHub workflow skills — commits, branches, pull requests, issues, and CI actions.

Code quality skills — refactoring, naming conventions, project structure, and internationalisation.

Security skills — OWASP audits, secret scanning, and dependency supply-chain hardening.

Project tooling skills — linting/formatting setup, testing, and documentation sync.

Design skills — UX psychology, accessibility, and Apple featuring readiness for web, SaaS, and mobile apps.

The design plugin also ships two read-only agents in Claude Code: ux-audit for whole-app UX reviews and a11y-audit for whole-app accessibility reviews.

Migrating from the tartinerlabs plugin? The original all-in-one tartinerlabs plugin has been removed. Uninstall it and install the collection plugins above — the skills are identical, only the namespace changes (e.g. /tartinerlabs:commit → /workflow:commit).

The separate xcode-skills collection contains seven skills authored by Apple and exported with xcrun agent skills export from Xcode 27.0 (build 27A5218g). The exported directory is published unchanged; Tartiner Labs maintains only the plugin wrapper and marketplace metadata outside it.

Install the collection through its native plugin identity:

# Codex
codex plugin add xcode-skills@tartinerlabs

# Claude Code
claude plugin install xcode-skills@tartinerlabs

# Direct installer
pnpm dlx skills add https://github.com/tartinerlabs/skills/tree/main/xcode-skills

In Codex and Claude Code, skills use the xcode-skills:<skill-name> namespace. In Cursor, install xcode-skills from the tartinerlabs marketplace.

The guidance can be read by any compatible agent, but some workflows expect Xcode's agent runtime, including Xcode project tools, device interaction, or subagent support. Those workflows require Xcode or equivalent runtime capabilities.

Agents invoke skills autonomously with an isolated worktree. The deps agent ships with the security Claude Code plugin. In a checkout of this repository, invoke with claude agent run <name>.

Add the marketplace, then install the collections you need:

claude plugin marketplace add tartinerlabs/skills

claude plugin install workflow@tartinerlabs
claude plugin install quality@tartinerlabs
claude plugin install security@tartinerlabs
claude plugin install tooling@tartinerlabs
claude plugin install design@tartinerlabs

This repository includes repo-scoped Codex plugin metadata in plugins/<collection>/.codex-plugin/plugin.json and .agents/plugins/marketplace.json. Codex reads each collection's root Agent Plugins plugin.json first and layers the .codex-plugin manifest on top.

To use it in Codex:

1. Open this repository in Codex
2. Restart Codex if needed so it reloads the repo marketplace
3. Open the plugin directory and install workflow, quality, security, tooling, and/or design from the repo marketplace

This repository includes Cursor plugin metadata in plugins/<collection>/.cursor-plugin/plugin.json and a repo-scoped marketplace at .cursor-plugin/marketplace.json.

To use it in Cursor:

1. Open this repository in Cursor
2. Install workflow, quality, security, tooling, and/or design from the repo marketplace

For a local plugin-directory install, symlink each collection plugin — not the repository root. Cursor loads plugin.json from the symlink target, and the plugins live under plugins/<collection>/:

mkdir -p ~/.cursor/plugins/local
ln -s "$(pwd)/plugins/workflow" ~/.cursor/plugins/local/workflow
ln -s "$(pwd)/plugins/quality" ~/.cursor/plugins/local/quality
ln -s "$(pwd)/plugins/security" ~/.cursor/plugins/local/security
ln -s "$(pwd)/plugins/tooling" ~/.cursor/plugins/local/tooling
ln -s "$(pwd)/plugins/design" ~/.cursor/plugins/local/design

Claude-specific hooks are intentionally not declared in the Cursor manifests.

Requires OpenCode v2. Each collection carries a dependency-free OpenCode plugin (plugins/<collection>/opencode.js and its package.json) that OpenCode installs straight from git:

opencode plugin add 'github:tartinerlabs/skills#main::path:plugins/workflow'
opencode plugin add 'github:tartinerlabs/skills#main::path:plugins/quality'
opencode plugin add 'github:tartinerlabs/skills#main::path:plugins/security'
opencode plugin add 'github:tartinerlabs/skills#main::path:plugins/tooling'
opencode plugin add 'github:tartinerlabs/skills#main::path:plugins/design'

OpenCode needs the ref before ::path: — the form without one fails to install. To pin a release, swap main for a tag from v2.0.0 onward, the first release to include these plugins. The plugins register skills only; the deps, ux-audit, and a11y-audit agents are Claude Code-only.

Install all skills:

pnpm dlx skills add tartinerlabs/skills

Install a single skill:

pnpm dlx skills add tartinerlabs/skills/commit

Install a subset for specific workflows:

# Git and GitHub workflow skills only
pnpm dlx skills add tartinerlabs/skills/commit
pnpm dlx skills add tartinerlabs/skills/create-branch
pnpm dlx skills add tartinerlabs/skills/create-pr
pnpm dlx skills add tartinerlabs/skills/clean-branches
pnpm dlx skills add tartinerlabs/skills/github-issues

# Security-focused subset
pnpm dlx skills add tartinerlabs/skills/security
pnpm dlx skills add tartinerlabs/skills/commit
pnpm dlx skills add tartinerlabs/skills/setup

Note: The Context7 skills channel has been retired — ctx7 skills install is deprecated upstream and stops working in the next major ctx7 release, with no successor command for installing skills from a repository. Context7 remains a documentation source; for these skills, use skills.sh or one of the plugin channels above.

Plugin manifests are hand-maintained under plugins/<name>/, one per channel, with .release-please-manifest.json as the shared version source. See AGENTS.md for the layout and CONTRIBUTING.md to contribute.

Skills use a modular rules pattern, with per-language guides loaded on demand. Each skill directory contains:

skills/<name>/
  SKILL.md          # Skill definition with frontmatter; detects the language and routes
  rules/            # Independent, editable rule files (universal checks + the JS/TS path)
    some-rule.md    # Severity, examples, fix instructions
  references/       # Per-language guides, loaded only when that language is detected
    python.md       # e.g. the Python path for setup/deps/testing
    go.md           # e.g. the Go path

agents/<name>.md    # Optional Claude Code agents that invoke skills autonomously

For the polyglot skills (setup, deps, testing), SKILL.md detects the project's language from its manifest and loads only the matching guide — JS/TS lives in the first-class modular rules/, and other ecosystems live in references/<lang>.md, so a JS project never loads Go content.

This means you can:

• Customise a rule's severity or examples without forking the skill
• Add project-specific rules by dropping a new .md file in rules/, or a new language by adding references/<lang>.md
• Remove rules you disagree with

Tartiner Labs-authored content is licensed under the MIT License. The xcode-skills/ collection contains Apple-authored material exported from Xcode and is published with attribution without modification.