fargo
c8f46341cc
ci/woodpecker/pr/ci Pipeline was successful
Implements the rev-security-01 verdict on #1320 (comment 23282): Should Fix (first, per tasking): mosaic-deploy's branch-protected-repos section shipped a working recipe for both failure modes the estate removes identity that is not the actor's (a legacy shared credential path, ~/.config/mosaic/credentials/gitea.env, which no longer exists in the credential system) and a quality gate routed around (raw curl + force_merge:true, no queue guard, no head pin). Replaced with wrapper-only merge guidance: protection blocks are signals to fix, not to bypass. Placeholder-ized estate RFC1918 topology and hostnames (six carriers, one more than the verdict's five — the original scan missed guides/): - skills/mosaic-portainer: Portainer URL, Docker host - skills/mosaic-gitea: SSH resolution target - skills/mosaic-deploy: Docker node, stack-name map (now generic example shape; estate mappings belong in skills-local overrides, which link with precedence) - tools/coolify/README: base URL - guides/INFRASTRUCTURE: cloudflare example moved from 10.0.0.5 to the RFC 5737 documentation range (192.0.2.5), the unambiguous example form Left as-is per the verdict's split: estate DNS endpoints (e.g. git.mosaicstack.dev, ci.mosaicstack.dev) pass as examples. Rescan of the whole shipped framework tree for RFC1918, estate hosts, and stack-name patterns: zero remaining hits. The gate defect itself is filed separately as #1321 (cross-referenced on #1320, comment 23285).
Agent Skills
Complete agent skill fleet for Mosaic Stack. 101 skills across 12 domains — coding, business development, design, marketing, writing, orchestration, document generation, Vue/Vite ecosystem, and more. Platform-aware — works with both GitHub (gh) and Gitea (tea) via our abstraction scripts.
This tree lives in the monorepo (packages/mosaic/framework/skills/) and ships inside the framework package; it is no longer a separate repository.
Security Audit
All skills were reviewed on 2026-02-16. Findings:
| ID | Severity | Skill | Issue | Action |
|---|---|---|---|---|
| C-001 | CRITICAL | vercel-deploy |
Uploads entire project to external endpoint via curl |
REMOVED |
| C-002 | ANNOTATED | docx, pptx, xlsx |
LD_PRELOAD shim compiles C at runtime to hook socket() |
Security warnings added — legitimate sandbox workaround, should never activate on Docker Swarm |
| W-001 | WARNING | using-superpowers |
Forces aggressive auto-loading via <EXTREMELY-IMPORTANT> tags |
Awareness only — review before enabling |
| W-002 | WARNING | mcp-builder |
Can connect to arbitrary MCP servers | Awareness only — review server URLs |
| W-003 | WARNING | create-agent |
Uses Function() constructor (eval equivalent) |
Awareness only — review generated code |
88 of 93 audited skills passed all checks as clean instruction-only SKILL.md files.
Skills (95)
Code Quality & Review (6)
| Skill | Purpose | Origin |
|---|---|---|
lint |
Zero-tolerance linting — detect linter, fix ALL violations, never disable rules | Mosaic Stack |
pr-reviewer |
Structured PR code review workflow (Gitea/GitHub) | Adapted from SpillwaveSolutions |
code-review-excellence |
Code review methodology and checklists | awesome-skills |
verification-before-completion |
Evidence-based completion claims | obra/superpowers |
receiving-code-review |
How to receive and respond to code reviews | obra/superpowers |
requesting-code-review |
How to request effective code reviews | obra/superpowers |
Frontend & UI (8)
| Skill | Purpose | Origin |
|---|---|---|
next-best-practices |
Next.js 15+ — RSC, async, self-hosting, data patterns | vercel-labs/next-skills |
vercel-react-best-practices |
React/Next.js performance (57 rules) | vercel-labs |
vercel-composition-patterns |
React composition and component patterns | vercel-labs |
vercel-react-native-skills |
React Native development patterns | vercel-labs |
shadcn-ui |
Component patterns — forms, dialogs, tables, charts | developer-kit |
tailwind-design-system |
Tailwind CSS v4 design system patterns | wshobson |
ui-animation |
Motion design — performance, accessibility, easing | mblode |
web-design-guidelines |
Web design principles and guidelines | vercel-labs |
Backend & API (4)
| Skill | Purpose | Origin |
|---|---|---|
nestjs-best-practices |
NestJS — 40 rules, 10 categories, priority-ranked | kadajett |
fastapi |
FastAPI + Pydantic v2 + async SQLAlchemy 2.0 | jezweb |
architecture-patterns |
Clean Architecture, Hexagonal, DDD | wshobson |
python-performance-optimization |
Profiling, memory, parallelization | wshobson |
Authentication (5)
| Skill | Purpose | Origin |
|---|---|---|
better-auth-best-practices |
Better-Auth — Drizzle, sessions, plugins, security | better-auth |
create-auth-skill |
Creating custom Better-Auth skills | better-auth |
email-and-password-best-practices |
Email/password auth patterns | better-auth |
organization-best-practices |
Multi-org/team auth patterns | better-auth |
two-factor-authentication-best-practices |
2FA implementation patterns | better-auth |
AI & Agent Building (7)
| Skill | Purpose | Origin |
|---|---|---|
ai-sdk |
Vercel AI SDK — streaming, multi-provider, agents | vercel/ai |
create-agent |
Modular agent with OpenRouter multi-model access | openrouterteam |
proactive-agent |
WAL Protocol, compaction recovery, self-improvement | halthelobster |
dispatching-parallel-agents |
Launching and managing parallel subagents | obra/superpowers |
subagent-driven-development |
Development workflow using subagents | obra/superpowers |
executing-plans |
Executing multi-step implementation plans | obra/superpowers |
using-superpowers |
Overview of the superpowers skill system | obra/superpowers |
Development Workflow (6)
| Skill | Purpose | Origin |
|---|---|---|
test-driven-development |
TDD Red-Green-Refactor discipline | obra/superpowers |
systematic-debugging |
Structured debugging methodology | obra/superpowers |
using-git-worktrees |
Git worktree patterns for parallel work | obra/superpowers |
finishing-a-development-branch |
Branch cleanup, squash, merge patterns | obra/superpowers |
writing-plans |
Writing effective implementation plans | obra/superpowers |
brainstorming |
Structured brainstorming methodology | obra/superpowers |
Document Generation (6)
| Skill | Purpose | Origin |
|---|---|---|
pdf |
PDF document generation | anthropics |
docx |
Word document generation | anthropics |
pptx |
PowerPoint presentation generation | anthropics |
xlsx |
Excel spreadsheet generation | anthropics |
doc-coauthoring |
Collaborative document writing | anthropics |
internal-comms |
Internal communications drafting | anthropics |
Design & Creative (7)
| Skill | Purpose | Origin |
|---|---|---|
brand-guidelines |
Brand identity enforcement | anthropics |
frontend-design |
Frontend design patterns and principles | anthropics |
canvas-design |
Canvas/visual design patterns | anthropics |
algorithmic-art |
Generative/algorithmic art creation | anthropics |
theme-factory |
Theme generation and customization | anthropics |
slack-gif-creator |
Animated GIF creation for Slack | anthropics |
web-artifacts-builder |
Self-contained HTML artifact building | anthropics |
Marketing & Business (25)
| Skill | Purpose | Origin |
|---|---|---|
marketing-ideas |
139 ideas across 14 categories | coreyhaines31 |
pricing-strategy |
SaaS pricing — value metrics, tiers, research | coreyhaines31 |
programmatic-seo |
SEO at scale — templates, playbooks | coreyhaines31 |
competitor-alternatives |
Competitor comparison pages | coreyhaines31 |
referral-program |
Referral & affiliate programs | coreyhaines31 |
seo-audit |
Comprehensive SEO audit methodology | coreyhaines31 |
copywriting |
Marketing copywriting patterns | coreyhaines31 |
copy-editing |
Copy editing and proofreading | coreyhaines31 |
content-strategy |
Content strategy and planning | coreyhaines31 |
social-content |
Social media content creation | coreyhaines31 |
email-sequence |
Email sequence design and automation | coreyhaines31 |
launch-strategy |
Product launch planning | coreyhaines31 |
marketing-psychology |
Psychology-driven marketing | coreyhaines31 |
product-marketing-context |
Product marketing positioning | coreyhaines31 |
paid-ads |
Paid advertising campaigns | coreyhaines31 |
schema-markup |
Schema.org structured data | coreyhaines31 |
analytics-tracking |
Analytics setup and tracking | coreyhaines31 |
ab-test-setup |
A/B testing methodology | coreyhaines31 |
page-cro |
Landing page conversion optimization | coreyhaines31 |
form-cro |
Form conversion optimization | coreyhaines31 |
signup-flow-cro |
Signup flow conversion optimization | coreyhaines31 |
onboarding-cro |
User onboarding optimization | coreyhaines31 |
popup-cro |
Popup/modal conversion optimization | coreyhaines31 |
paywall-upgrade-cro |
Paywall/upgrade conversion optimization | coreyhaines31 |
free-tool-strategy |
Free tool as marketing strategy | coreyhaines31 |
Vue/Vite Ecosystem (16)
| Skill | Purpose | Origin |
|---|---|---|
vue |
Vue.js development patterns | antfu |
vue-best-practices |
Vue.js best practices and conventions | antfu |
vue-router-best-practices |
Vue Router patterns and guards | antfu |
vue-testing-best-practices |
Vue component testing patterns | antfu |
vueuse-functions |
VueUse composable function patterns | antfu |
nuxt |
Nuxt.js framework patterns | antfu |
vite |
Vite build tool configuration and plugins | antfu |
vitest |
Vitest testing framework patterns | antfu |
vitepress |
VitePress documentation site patterns | antfu |
slidev |
Slidev presentation framework | antfu |
pnpm |
pnpm package manager patterns | antfu |
turborepo |
Turborepo monorepo patterns | antfu |
unocss |
UnoCSS atomic CSS engine | antfu |
tsdown |
tsdown TypeScript bundler | antfu |
pinia |
Pinia state management | antfu |
antfu |
Anthony Fu's coding conventions | antfu |
Orchestration (1)
| Skill | Purpose | Origin |
|---|---|---|
kickstart |
Launch orchestrator for milestone/issue/task — auto-discovers context, bootstraps tracking | Mosaic Stack |
Meta / Skill Authoring (4)
| Skill | Purpose | Origin |
|---|---|---|
writing-skills |
TDD-based skill authoring methodology | obra/superpowers |
skill-creator |
Anthropic's skill creation guide | anthropics |
mcp-builder |
Building MCP (Model Context Protocol) servers | anthropics |
webapp-testing |
Web application testing patterns | anthropics |
Source Repositories
| Repository | Skills | Domain Focus |
|---|---|---|
| anthropics/skills | 16 | Documents, design, MCP, testing |
| obra/superpowers | 14 | Agent workflows, TDD, code review, planning |
| coreyhaines31/marketingskills | 25 | Marketing, CRO, SEO, growth |
| antfu/skills | 16 | Vue, Vite, Vitest, pnpm, Nuxt |
| better-auth/skills | 5 | Authentication patterns |
| vercel-labs/agent-skills | 4 | React, design |
| vercel-labs/next-skills | 1 | Next.js 15+ |
| vercel/ai | 1 | AI SDK |
| halthelobster/proactive-agent | 1 | Agent architecture |
| openrouterteam/agent-skills | 1 | Agent building |
| kadajett/agent-nestjs-skills | 1 | NestJS |
| jezweb/claude-skills | 1 | FastAPI |
| wshobson/agents | 3 | Architecture, Python, Tailwind |
| mblode/agent-skills | 1 | UI animation |
| giuseppe-trisciuoglio/developer-kit | 1 | shadcn/ui |
| Mosaic Stack (original) | 4 | PR review, code review, orchestration, linting |
Installation
The skills ship with the framework package. The framework installer installs them
into ~/.config/mosaic/skills/, and the post-install step links them into each
runtime's skill directory:
# Install or upgrade the framework (skills arrive with it — no second repo)
./packages/mosaic/framework/install.sh
# Re-link installed skills into runtime homes (claude, codex, opencode, pi)
mosaic sync
Operators can override any canonical skill by copying it to
~/.config/mosaic/skills-local/<name>/ — local skills take precedence during
linking.
Adapting Skills
When adding skills from the community:
- Replace raw
gh/teacalls with our~/.config/mosaic/rails/git/scripts - Test on both GitHub and Gitea repos
- Add Mosaic Stack context notes where upstream assumptions differ
- Document any platform-specific limitations
License
Individual skills retain their original licenses. Adaptations are MIT.