# Agent Skills

Complete agent skill fleet for Mosaic Stack. 101 skills across 12 domains — coding, business development, design, marketing, writing, orchestration, document generation, Vue/Vite ecosystem, and more. Platform-aware — works with both GitHub (`gh`) and Gitea (`tea`) via our abstraction scripts.

This tree lives in the monorepo (`packages/mosaic/framework/skills/`) and ships inside the framework package; it is no longer a separate repository.

## Security Audit

All skills were reviewed on 2026-02-16. Findings:

| ID    | Severity      | Skill                  | Issue                                                           | Action                                                                                         |
| ----- | ------------- | ---------------------- | --------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| C-001 | **CRITICAL**  | `vercel-deploy`        | Uploads entire project to external endpoint via `curl`          | **REMOVED**                                                                                    |
| C-002 | **ANNOTATED** | `docx`, `pptx`, `xlsx` | LD_PRELOAD shim compiles C at runtime to hook `socket()`        | Security warnings added — legitimate sandbox workaround, should never activate on Docker Swarm |
| W-001 | WARNING       | `using-superpowers`    | Forces aggressive auto-loading via `<EXTREMELY-IMPORTANT>` tags | Awareness only — review before enabling                                                        |
| W-002 | WARNING       | `mcp-builder`          | Can connect to arbitrary MCP servers                            | Awareness only — review server URLs                                                            |
| W-003 | WARNING       | `create-agent`         | Uses `Function()` constructor (eval equivalent)                 | Awareness only — review generated code                                                         |

88 of 93 audited skills passed all checks as clean instruction-only SKILL.md files.

## Skills (95)

### Code Quality & Review (6)

| Skill                            | Purpose                                                                         | Origin                          |
| -------------------------------- | ------------------------------------------------------------------------------- | ------------------------------- |
| `lint`                           | Zero-tolerance linting — detect linter, fix ALL violations, never disable rules | Mosaic Stack                    |
| `pr-reviewer`                    | Structured PR code review workflow (Gitea/GitHub)                               | Adapted from SpillwaveSolutions |
| `code-review-excellence`         | Code review methodology and checklists                                          | awesome-skills                  |
| `verification-before-completion` | Evidence-based completion claims                                                | obra/superpowers                |
| `receiving-code-review`          | How to receive and respond to code reviews                                      | obra/superpowers                |
| `requesting-code-review`         | How to request effective code reviews                                           | obra/superpowers                |

### Frontend & UI (8)

| Skill                         | Purpose                                               | Origin                  |
| ----------------------------- | ----------------------------------------------------- | ----------------------- |
| `next-best-practices`         | Next.js 15+ — RSC, async, self-hosting, data patterns | vercel-labs/next-skills |
| `vercel-react-best-practices` | React/Next.js performance (57 rules)                  | vercel-labs             |
| `vercel-composition-patterns` | React composition and component patterns              | vercel-labs             |
| `vercel-react-native-skills`  | React Native development patterns                     | vercel-labs             |
| `shadcn-ui`                   | Component patterns — forms, dialogs, tables, charts   | developer-kit           |
| `tailwind-design-system`      | Tailwind CSS v4 design system patterns                | wshobson                |
| `ui-animation`                | Motion design — performance, accessibility, easing    | mblode                  |
| `web-design-guidelines`       | Web design principles and guidelines                  | vercel-labs             |

### Backend & API (4)

| Skill                             | Purpose                                           | Origin   |
| --------------------------------- | ------------------------------------------------- | -------- |
| `nestjs-best-practices`           | NestJS — 40 rules, 10 categories, priority-ranked | kadajett |
| `fastapi`                         | FastAPI + Pydantic v2 + async SQLAlchemy 2.0      | jezweb   |
| `architecture-patterns`           | Clean Architecture, Hexagonal, DDD                | wshobson |
| `python-performance-optimization` | Profiling, memory, parallelization                | wshobson |

### Authentication (5)

| Skill                                      | Purpose                                            | Origin      |
| ------------------------------------------ | -------------------------------------------------- | ----------- |
| `better-auth-best-practices`               | Better-Auth — Drizzle, sessions, plugins, security | better-auth |
| `create-auth-skill`                        | Creating custom Better-Auth skills                 | better-auth |
| `email-and-password-best-practices`        | Email/password auth patterns                       | better-auth |
| `organization-best-practices`              | Multi-org/team auth patterns                       | better-auth |
| `two-factor-authentication-best-practices` | 2FA implementation patterns                        | better-auth |

### AI & Agent Building (7)

| Skill                         | Purpose                                             | Origin           |
| ----------------------------- | --------------------------------------------------- | ---------------- |
| `ai-sdk`                      | Vercel AI SDK — streaming, multi-provider, agents   | vercel/ai        |
| `create-agent`                | Modular agent with OpenRouter multi-model access    | openrouterteam   |
| `proactive-agent`             | WAL Protocol, compaction recovery, self-improvement | halthelobster    |
| `dispatching-parallel-agents` | Launching and managing parallel subagents           | obra/superpowers |
| `subagent-driven-development` | Development workflow using subagents                | obra/superpowers |
| `executing-plans`             | Executing multi-step implementation plans           | obra/superpowers |
| `using-superpowers`           | Overview of the superpowers skill system            | obra/superpowers |

### Development Workflow (6)

| Skill                            | Purpose                                 | Origin           |
| -------------------------------- | --------------------------------------- | ---------------- |
| `test-driven-development`        | TDD Red-Green-Refactor discipline       | obra/superpowers |
| `systematic-debugging`           | Structured debugging methodology        | obra/superpowers |
| `using-git-worktrees`            | Git worktree patterns for parallel work | obra/superpowers |
| `finishing-a-development-branch` | Branch cleanup, squash, merge patterns  | obra/superpowers |
| `writing-plans`                  | Writing effective implementation plans  | obra/superpowers |
| `brainstorming`                  | Structured brainstorming methodology    | obra/superpowers |

### Document Generation (6)

| Skill             | Purpose                            | Origin     |
| ----------------- | ---------------------------------- | ---------- |
| `pdf`             | PDF document generation            | anthropics |
| `docx`            | Word document generation           | anthropics |
| `pptx`            | PowerPoint presentation generation | anthropics |
| `xlsx`            | Excel spreadsheet generation       | anthropics |
| `doc-coauthoring` | Collaborative document writing     | anthropics |
| `internal-comms`  | Internal communications drafting   | anthropics |

### Design & Creative (7)

| Skill                   | Purpose                                 | Origin     |
| ----------------------- | --------------------------------------- | ---------- |
| `brand-guidelines`      | Brand identity enforcement              | anthropics |
| `frontend-design`       | Frontend design patterns and principles | anthropics |
| `canvas-design`         | Canvas/visual design patterns           | anthropics |
| `algorithmic-art`       | Generative/algorithmic art creation     | anthropics |
| `theme-factory`         | Theme generation and customization      | anthropics |
| `slack-gif-creator`     | Animated GIF creation for Slack         | anthropics |
| `web-artifacts-builder` | Self-contained HTML artifact building   | anthropics |

### Marketing & Business (25)

| Skill                       | Purpose                                       | Origin        |
| --------------------------- | --------------------------------------------- | ------------- |
| `marketing-ideas`           | 139 ideas across 14 categories                | coreyhaines31 |
| `pricing-strategy`          | SaaS pricing — value metrics, tiers, research | coreyhaines31 |
| `programmatic-seo`          | SEO at scale — templates, playbooks           | coreyhaines31 |
| `competitor-alternatives`   | Competitor comparison pages                   | coreyhaines31 |
| `referral-program`          | Referral & affiliate programs                 | coreyhaines31 |
| `seo-audit`                 | Comprehensive SEO audit methodology           | coreyhaines31 |
| `copywriting`               | Marketing copywriting patterns                | coreyhaines31 |
| `copy-editing`              | Copy editing and proofreading                 | coreyhaines31 |
| `content-strategy`          | Content strategy and planning                 | coreyhaines31 |
| `social-content`            | Social media content creation                 | coreyhaines31 |
| `email-sequence`            | Email sequence design and automation          | coreyhaines31 |
| `launch-strategy`           | Product launch planning                       | coreyhaines31 |
| `marketing-psychology`      | Psychology-driven marketing                   | coreyhaines31 |
| `product-marketing-context` | Product marketing positioning                 | coreyhaines31 |
| `paid-ads`                  | Paid advertising campaigns                    | coreyhaines31 |
| `schema-markup`             | Schema.org structured data                    | coreyhaines31 |
| `analytics-tracking`        | Analytics setup and tracking                  | coreyhaines31 |
| `ab-test-setup`             | A/B testing methodology                       | coreyhaines31 |
| `page-cro`                  | Landing page conversion optimization          | coreyhaines31 |
| `form-cro`                  | Form conversion optimization                  | coreyhaines31 |
| `signup-flow-cro`           | Signup flow conversion optimization           | coreyhaines31 |
| `onboarding-cro`            | User onboarding optimization                  | coreyhaines31 |
| `popup-cro`                 | Popup/modal conversion optimization           | coreyhaines31 |
| `paywall-upgrade-cro`       | Paywall/upgrade conversion optimization       | coreyhaines31 |
| `free-tool-strategy`        | Free tool as marketing strategy               | coreyhaines31 |

### Vue/Vite Ecosystem (16)

| Skill                        | Purpose                                   | Origin |
| ---------------------------- | ----------------------------------------- | ------ |
| `vue`                        | Vue.js development patterns               | antfu  |
| `vue-best-practices`         | Vue.js best practices and conventions     | antfu  |
| `vue-router-best-practices`  | Vue Router patterns and guards            | antfu  |
| `vue-testing-best-practices` | Vue component testing patterns            | antfu  |
| `vueuse-functions`           | VueUse composable function patterns       | antfu  |
| `nuxt`                       | Nuxt.js framework patterns                | antfu  |
| `vite`                       | Vite build tool configuration and plugins | antfu  |
| `vitest`                     | Vitest testing framework patterns         | antfu  |
| `vitepress`                  | VitePress documentation site patterns     | antfu  |
| `slidev`                     | Slidev presentation framework             | antfu  |
| `pnpm`                       | pnpm package manager patterns             | antfu  |
| `turborepo`                  | Turborepo monorepo patterns               | antfu  |
| `unocss`                     | UnoCSS atomic CSS engine                  | antfu  |
| `tsdown`                     | tsdown TypeScript bundler                 | antfu  |
| `pinia`                      | Pinia state management                    | antfu  |
| `antfu`                      | Anthony Fu's coding conventions           | antfu  |

### Orchestration (1)

| Skill       | Purpose                                                                                    | Origin       |
| ----------- | ------------------------------------------------------------------------------------------ | ------------ |
| `kickstart` | Launch orchestrator for milestone/issue/task — auto-discovers context, bootstraps tracking | Mosaic Stack |

### Meta / Skill Authoring (4)

| Skill            | Purpose                                       | Origin           |
| ---------------- | --------------------------------------------- | ---------------- |
| `writing-skills` | TDD-based skill authoring methodology         | obra/superpowers |
| `skill-creator`  | Anthropic's skill creation guide              | anthropics       |
| `mcp-builder`    | Building MCP (Model Context Protocol) servers | anthropics       |
| `webapp-testing` | Web application testing patterns              | anthropics       |

## Source Repositories

| Repository                                                                                    | Skills | Domain Focus                                   |
| --------------------------------------------------------------------------------------------- | ------ | ---------------------------------------------- |
| [anthropics/skills](https://github.com/anthropics/skills)                                     | 16     | Documents, design, MCP, testing                |
| [obra/superpowers](https://github.com/obra/superpowers)                                       | 14     | Agent workflows, TDD, code review, planning    |
| [coreyhaines31/marketingskills](https://github.com/coreyhaines31/marketingskills)             | 25     | Marketing, CRO, SEO, growth                    |
| [antfu/skills](https://github.com/antfu/skills)                                               | 16     | Vue, Vite, Vitest, pnpm, Nuxt                  |
| [better-auth/skills](https://github.com/better-auth/skills)                                   | 5      | Authentication patterns                        |
| [vercel-labs/agent-skills](https://github.com/vercel-labs/agent-skills)                       | 4      | React, design                                  |
| [vercel-labs/next-skills](https://github.com/vercel-labs/next-skills)                         | 1      | Next.js 15+                                    |
| [vercel/ai](https://github.com/vercel/ai)                                                     | 1      | AI SDK                                         |
| [halthelobster/proactive-agent](https://github.com/halthelobster/proactive-agent)             | 1      | Agent architecture                             |
| [openrouterteam/agent-skills](https://github.com/openrouterteam/agent-skills)                 | 1      | Agent building                                 |
| [kadajett/agent-nestjs-skills](https://github.com/kadajett/agent-nestjs-skills)               | 1      | NestJS                                         |
| [jezweb/claude-skills](https://github.com/jezweb/claude-skills)                               | 1      | FastAPI                                        |
| [wshobson/agents](https://github.com/wshobson/agents)                                         | 3      | Architecture, Python, Tailwind                 |
| [mblode/agent-skills](https://github.com/mblode/agent-skills)                                 | 1      | UI animation                                   |
| [giuseppe-trisciuoglio/developer-kit](https://github.com/giuseppe-trisciuoglio/developer-kit) | 1      | shadcn/ui                                      |
| Mosaic Stack (original)                                                                       | 4      | PR review, code review, orchestration, linting |

## Installation

The skills ship with the framework package. The framework installer installs them
into `~/.config/mosaic/skills/`, and the post-install step links them into each
runtime's skill directory:

```bash
# Install or upgrade the framework (skills arrive with it — no second repo)
./packages/mosaic/framework/install.sh

# Re-link installed skills into runtime homes (claude, codex, opencode, pi)
mosaic sync
```

Operators can override any canonical skill by copying it to
`~/.config/mosaic/skills-local/<name>/` — local skills take precedence during
linking.

## Adapting Skills

When adding skills from the community:

1. Replace raw `gh`/`tea` calls with our `~/.config/mosaic/rails/git/` scripts
2. Test on both GitHub and Gitea repos
3. Add Mosaic Stack context notes where upstream assumptions differ
4. Document any platform-specific limitations

## License

Individual skills retain their original licenses. Adaptations are MIT.
