will-wright-eng/skills

Browse this collection on skills.sh, including per-skill security audits.
Install
This command uses the vercel-labs/skills CLI to implement skills in this repo.
Update
Updates all installed skills; pass a name to update one (bunx skills update design-readiness). The CLI has no version pinning — update re-fetches whatever is at the head of each source repo — so review the diff after updating.
Skill Self-Containment
Every skill in this repo installs standalone. Cross-skill file references (../other-skill/DOC.md) are an antipattern: the skills CLI installs skills individually (--skill , skills use, direct skill URLs) with no dependency resolution, so a link into a sibling skill directory dangles unless the whole repo happens to be installed. Shared docs are instead vendored into each skill that needs them, marked with a provenance comment ( ). Vendored copies are updated by re-copying their source, never by editing in place.
Security Scanning
Pull requests that add or modify a skill run cisco-ai-skill-scanner over the changed skills in static mode (YAML/YARA rules plus behavioral dataflow, no LLM). The scan workflow posts the results as a PR comment and fails on HIGH or CRITICAL findings. bash scripts/scan_skills.sh [skill...] reproduces the scan locally; the policy is scripts/skill-scanner-policy.yaml. Static rules miss semantic risks such as the indirect-prompt-injection exposure the skills.sh audits flag, so treat a clean scan as a floor, not a verdict.
Original Skills
Autoresearch
Three sequential skills for adding a verifiable autonomous experiment loop to a git repository, generalized from karpathy/autoresearch.
After install, invoke them in order: autoresearch-method → autoresearch-verify → autoresearch-program. Once program.md is generated, hand it to a fresh agent session and the loop runs from there.
| Skill | Purpose |
| --- | --- |
| autoresearch-method | Explain the methodology and evaluate whether the current repo is a good fit. |
| autoresearch-verify | Build a repo-specific verifier script with light (per-candidate metric) and heavy (integrity matrix) modes. |
| autoresearch-program | Generate program.md at the repo root — the operating directive a fresh agent session uses to run the loop. |
Design & Documentation
Self-contained skills covering the design-doc lifecycle: verify a design before building, distill what was built into ADRs, and keep the domain glossary sharp. Each writes only on explicit confirmation.
| Skill | Purpose |
| --- | --- |
| design-readiness | Audit a design/implementation/proposal doc for consistency with the codebase, ADRs, and CONTEXT.md, plus completeness of definition, then interview through drift fixes and open design decisions — interview answers are the approval, so the revised doc is applied once findings are resolved. |
| distill-adrs | Distill existing implementation docs (plans, design docs, RFCs) into ADRs — extracts candidate decisions, verifies each against the code, and confirms them one at a time before writing. |
| create-context | Build or refine a CONTEXT.md glossary — explores the codebase for candidate domain terms, then confirms each term, relationship, and ambiguity one at a time before writing. |
Refactoring
| Skill | Purpose |
| --- | --- |
| anneal | Carve a god module into stable and volatile pieces along evidence from git history — hotspot ranking via the hc CLI (raw-git fallback when absent), a three-axis autopsy of the target file, a seam-by-seam interview, and a strangler-fig migration plan with a measurable baseline. |
| prune-comments | Aggressively delete comment narration that restates the code — including "pseudo-why" comments whose reason is already visible and step-heading comments over blocks — and condense verbose why-comments and doc comments to terse technical language; doubt resolves toward deletion. Scoped to the diff against a base branch by default (path sweep on request), optionally driven under a target comment ratio, never touching semantic comments (directives, pragmas, license headers) or genuine why-comments, and modifying comments only: never code, never markdown. |