Skills
Language-agnostic agent skills for git/GitHub workflows, code quality, and project tooling — with first-class JS/TS support. Each skill ships with modular, independently editable rules for deep, opinionated guidance.
Why These Skills
- Language-aware, JS/TS-first — Skills detect the project's language and adapt. The general workflow/audit skills work in any language; the ecosystem tooling (
setup,deps,testing) is polyglot — JS/TS is the best-supported path, with Python and Go covered via per-languagereferences/. - Modular rules architecture — Each skill ships with standalone rule files in
rules/directories. Rules can be added, removed, or edited independently without touching the main skill logic. - Opinionated audit workflows — Skills like
security,github-actions,tailwind, andrefactorproduce structured severity-graded reports, then auto-fix issues. - Secret scanning built in — The
commit,security, andsetupskills enforce secret detection as a first-class concern (GitLeaks by default, TruffleHog accepted). - Convention-aware — Skills detect your project's existing conventions (language, commit format, package manager, project structure, git host) and adapt automatically.
Skills
Install the plugin for your agent, then invoke skills through that agent's native skill or command interface.
Git
| Skill | Description |
|---|---|
| commit | Clean git commits with conventional commit detection and secret scanning |
| create-branch | Create and checkout a branch with naming validation and GitHub/GitLab issue linking |
GitHub
| Skill | Description |
|---|---|
| create-pr | Push branch and create a pull/merge request (GitHub or GitLab) with structured description and auto-assignment |
| github-issues | Create, update, query, and comment on issues (GitHub, or GitLab via glab) |
| github-actions | Create and audit GitHub Actions workflows with SHA pinning, permissions, and caching checks |
Code Quality
| Skill | Description |
|---|---|
| deps | Harden the dependency supply chain — detects the ecosystem (JS/TS, Python, Go) for pinning, vulnerability scanning, and CI gates |
| refactor | Audit and refactor code for dead code, deep nesting, and design patterns (language-agnostic; TS/JS idiom rules for TS/JS files) |
| security | OWASP Top 10 security audit with secret detection and dependency vulnerability scanning |
| tailwind | Audit and fix Tailwind CSS v4 anti-patterns for spacing, 8px grid, mobile-first, and GPU animations |
| testing | Write and run unit/component tests — detects the language and test runner (JS/TS, Python, Go) |
Project
| Skill | Description |
|---|---|
| setup | Set up the ecosystem's lint/format/git-hooks/secret-scanning toolchain — detects the language (JS/TS, Python, Go) |
| project-structure | Audit project directory structure for colocation, grouping, and anti-pattern detection |
| naming-format | Audit and fix filename and export naming conventions for consistency |
| update-project | Update and maintain CLAUDE.md, AGENTS.md, README.md, agents, skills, and rules to match current project state |
Xcode Skills
The separate xcode-skills collection contains seven skills authored by Apple and exported with xcrun agent skills export from Xcode 27.0 (build 27A5218g). The exported directory is published unchanged; Tartiner Labs maintains only the plugin wrapper and marketplace metadata outside it.
| Skill | Description |
|---|---|
| adopt-c-bounds-safety | Adopt and debug the C bounds-safety language extension |
| audit-xcode-security-settings | Audit and enable security-oriented Xcode build settings |
| device-interaction | Verify apps on a device or simulator through screenshots and UI interaction |
| modernize-tests | Modernize XCTest and Swift Testing suites |
| swiftui-specialist | Apply Apple's SwiftUI best practices |
| swiftui-whats-new-27 | Use SwiftUI APIs and migration guidance for SDK 27 |
| uikit-app-modernization | Modernize UIKit apps for multi-window environments |
Install the collection through its native plugin identity:
# Codex
codex plugin add xcode-skills@tartinerlabs
# Claude Code
claude plugin install xcode-skills@tartinerlabs
# Direct installer
pnpm dlx skills add https://github.com/tartinerlabs/skills/tree/main/xcode-skills
In Codex and Claude Code, skills use the xcode-skills:<skill-name> namespace. In Cursor, install xcode-skills from the tartinerlabs marketplace.
The guidance can be read by any compatible agent, but some workflows expect Xcode's agent runtime, including Xcode project tools, device interaction, or subagent support. Those workflows require Xcode or equivalent runtime capabilities.
Agents
Agents invoke skills autonomously with an isolated worktree. Invoke with claude agent run <name>.
| Agent | Description |
|---|---|
| deps | Autonomous supply chain hardening — runs the deps skill in an isolated worktree and outputs a structured summary |
Installation
Claude Code Plugin
claude plugin install tartinerlabs/skills
Codex Plugin
This repository includes repo-scoped Codex plugin metadata in plugins/tartinerlabs/.codex-plugin/plugin.json and .agents/plugins/marketplace.json.
To use it in Codex:
- Open this repository in Codex
- Restart Codex if needed so it reloads the repo marketplace
- Open the plugin directory and install
tartinerlabsfrom the repo marketplace
Cursor Plugin
This repository includes Cursor plugin metadata in plugins/tartinerlabs/.cursor-plugin/plugin.json and .cursor-plugin/marketplace.json.
For local development, install the plugin with Cursor's plugin flow or copy the repository into Cursor's local plugin directory:
mkdir -p ~/.cursor/plugins/local
ln -s "$(pwd)" ~/.cursor/plugins/local/tartinerlabs
The shared skills/ directory is exposed to Cursor directly. Claude-specific hooks are intentionally not declared in the Cursor manifest.
Skills
Install all skills:
pnpm dlx skills add tartinerlabs/skills
Install a single skill:
pnpm dlx skills add tartinerlabs/skills/commit
Install a subset for specific workflows:
# Git and GitHub workflow skills only
pnpm dlx skills add tartinerlabs/skills/commit
pnpm dlx skills add tartinerlabs/skills/create-branch
pnpm dlx skills add tartinerlabs/skills/create-pr
pnpm dlx skills add tartinerlabs/skills/github-issues
# Security-focused subset
pnpm dlx skills add tartinerlabs/skills/security
pnpm dlx skills add tartinerlabs/skills/commit
pnpm dlx skills add tartinerlabs/skills/setup
Context7
pnpm dlx ctx7 skills install /tartinerlabs/skills --all --universal
OpenCode
Note: The OpenCode plugin is currently in Beta and might not work.
Add to opencode.json:
{
"$schema": "https://opencode.ai/config.json",
"plugin": ["@tartinerlabs/skills"]
}
Plugin Metadata
Plugin manifests are maintained manually on purpose.
Each plugin lives in its own plugins/<name>/ wrapper holding the three per-channel manifests plus a skills symlink; both plugins/tartinerlabs/ and plugins/xcode-skills/ use this identical shape, and every marketplace references its plugins as ./plugins/<name>.
- Codex metadata lives in
plugins/tartinerlabs/.codex-plugin/plugin.jsonand.agents/plugins/marketplace.json - Claude metadata lives in
plugins/tartinerlabs/.claude-plugin/plugin.jsonand.claude-plugin/marketplace.json - Cursor metadata lives in
plugins/tartinerlabs/.cursor-plugin/plugin.jsonand.cursor-plugin/marketplace.json - Antigravity metadata lives in
plugins/tartinerlabs/.antigravity-plugin/plugin.json - The separate Xcode collection is wrapped by
plugins/xcode-skills/, which links to the untouchedxcode-skills/export package.json.versionis the shared source of truth across plugin manifests; semantic-release syncs manifest versions during release
Architecture
Skills use a modular rules pattern, with per-language guides loaded on demand. Each skill directory contains:
skills/<name>/
SKILL.md # Skill definition with frontmatter; detects the language and routes
rules/ # Independent, editable rule files (universal checks + the JS/TS path)
some-rule.md # Severity, examples, fix instructions
references/ # Per-language guides, loaded only when that language is detected
python.md # e.g. the Python path for setup/deps/testing
go.md # e.g. the Go path
agents/<name>.md # Optional Claude Code agents that invoke skills autonomously
For the polyglot skills (setup, deps, testing), SKILL.md detects the project's language from its manifest and loads only the matching guide — JS/TS lives in the first-class modular rules/, and other ecosystems live in references/<lang>.md, so a JS project never loads Go content.
This means you can:
- Customise a rule's severity or examples without forking the skill
- Add project-specific rules by dropping a new
.mdfile inrules/, or a new language by addingreferences/<lang>.md - Remove rules you disagree with
Skill Format
Each skill is a directory with a SKILL.md file following the Agent Skills spec.
License
Tartiner Labs-authored content is licensed under the MIT License. The xcode-skills/ collection contains Apple-authored material exported from Xcode and is published with attribution without modification.
No comments yet
Be the first to share your take.