alexderz/agentic-toolbox：面向 SDLC 的智能体技能工具箱

Skills here are tools, not a marketplace dump. Agents pick the right tool for the job. The process applies to software, docs, process changes, and other tickets using this home. SDLC work is keyed by role (architect, designer, builder, tester, security, manager, operator).

Git is the source of truth. A local or vendor mirror may follow. Do not treat a mirror as an independent write path for skill bodies.

License: MIT (LICENSE). skills/debug-anthropic/ and skills/ui-craft/ are Apache-2.0 (NOTICE). Pins: SOURCES.md.

How the work gets done, in plain language (including a calculator walkthrough): docs/how-software-gets-built.md.

Roles

Role	Job
architect	Design, HLD/LLD, adversarial review of approach
designer	User stories, high-level UX, Spec mockups when there is a screen
builder	Implement and ship
tester	Mechanical CI, hooks, cleanup, verification evidence
security	Gates at Spec (trust boundaries) and Review, plus skill intake — not only a monthly vuln pass
manager	Process, board after-act, and land order (local, serialized merges; no PRs). The only tracker writer. Does not bless ships
operator	The person in the loop: exceptions, vuln severity, extra hosts, personal accounts

If no listed skill fits the task, do the work without one. Never create a new skill id mid-task. Do not remint a skill that already lives here.

PRs welcome. Maintainer: alexderz. See CONTRIBUTING.md. Internal work skips PRs: it lands by local merge.

Bundles

There is no plugin manifest yet. Natural install groups:

Bundle	Skills	When
sdlc-process	`discover-the-idea`, `ux-design`, `sdlc-artifacts`, `tracker-sdlc`, `sdlc-onboarding`, `tdd`, `debug`, `docs-google-style`, `verify-before-done`, `pr-review`, `yagni`, `security-hardening`, `shell-safety`	Any repo using this process. Chunk gather-only turns load `discover-the-idea` and no language skill. Incoming items skip that interview. Default debug is `debug`; `debug-pocock` / `debug-anthropic` are alternatives
research	`buying-researcher`	researcher persona when the ask is a buy or market study. Not an SDLC step
workers	`grok-acp`, `cursor-cloud-agents-when`	Operator opt-in. `grok-acp` offloads a build to the local Grok CLI over ACP and needs the `grok-acp` package on `PATH`. `cursor-cloud-agents-when` chooses Cursor Cloud Agent or the local grok CLI for coding or heavy multi-step work
diagrams	`pr-lens`	Operator opt-in. Architecture and data-flow diagrams for a PR, rendered locally and attached with `gh`. Needs Node (`npx`) and `gh` 2.99+
ui	`ui-craft`	Builder visual-quality rules while implementing a UI, beside `ux-design`. Text only. Which version, or none, is asked once per product repo: the skill's ask
languages	`language-router`, `lang-*`, `golang-safety`, `golang-testing`, `golang-security`, `modern-python`	Writing or reviewing code. Load at most one language-family skill per turn

lang-go, lang-python, and lang-shell are pointers. They do not count as a skill load. They route to golang-*, modern-python, and shell-safety. shell-safety sits in sdlc-process because every agent shell is in scope; lang-shell only points at it.

Authoritative pins: SOURCES.md. Routing table: skills/language-router/SKILL.md.

Intake rules (security first)

Placeholders remain for empty ids. Bodies land via security intake and a compress, not a vendor paste.

Do not install a second process pack beside this repo’s ids. See docs/INTAKE.md.
Pin every third-party cherry-pick SHA in SOURCES.md. Empty SHA cells mean the body is not here yet.
security intake before any third-party content lands in this repo.
No auto-update. No marketplace install. No scripts. No secrets.
First-party skills (tracker-sdlc, sdlc-onboarding, cursor-cloud-agents-when, language guides) are written here; they are not vendor copies.

Directories under skills/<id>/ are placeholders (.gitkeep only) until a body lands.

Skill ids

See SOURCES.md for upstream, SHA, license, and notes.

sdlc-process

Id	Ownership
`discover-the-idea`	First-party gatherer (interview → brief). Chunk Brief Gather. Do not load on an incoming item
`ux-design`	Designer. Stories + UX at Plan; mockups at Spec if there is a screen
`sdlc-artifacts`	First-party templates (HLD, LLD, tickets, track, changelog, …)
`tracker-sdlc`	First-party contract for every tracker read/write, plus per-tracker adapters. Loads the product repo's `.agents/tracker/SKILL.md`
`sdlc-onboarding`	First-party. Discovers a repo's tracker, proposes a mapping, writes the repo tracker skill on confirm
`tdd`	Rewrite (MIT). Pin in SOURCES.md
`debug`	Default systematic debug (MIT). Alternatives: `debug-pocock`, `debug-anthropic`
`docs-google-style`	Distill of Google developer docs style. Human + agent surfaces
`verify-before-done`	Rewrite (MIT). Pin in SOURCES.md
`pr-review`	Rewrite (MIT). Pin in SOURCES.md
`yagni`	First-party restraint
`security-hardening`	First-party Always/Ask/Never
`shell-safety`	First-party Always/Ask/Never. Pin in SOURCES.md

research

Id	Ownership
`buying-researcher`	First-party market / buy research. researcher persona; not SDLC

workers

Id	Ownership
`grok-acp`	First-party. Grok Build over ACP as a builder. Prose only; the client is packages/grok-acp. Operator opt-in
`cursor-cloud-agents-when`	First-party. Which worker builds: Cursor Cloud Agent or the local grok CLI. Prose only. Operator opt-in

diagrams

Id	Ownership
`pr-lens`	Rewrite of coldteadotai/pr-lens (MIT). Local render + PR attach only; no canvas, no `analyze`. Pin in SOURCES.md. Operator opt-in

ui

Id	Ownership
`ui-craft`	Topic-only rewrite of pbakaus/impeccable (Apache-2.0). Anti-patterns, typography, color, layout, motion, every UI state, one verification pass. No scripts, hooks or network. Pin in SOURCES.md

languages

Id	Ownership
`language-router`	First-party map
`lang-go` / `lang-python` / `lang-shell`	First-party pointers
`golang-safety` / `golang-testing` / `golang-security`	Rewrite of samber/cc-skills-golang (MIT)
`modern-python`	First-party (MIT). uv / ruff / ty / pytest
`lang-rust`, `lang-js-ts`, `lang-c`, `lang-cpp`, `lang-csharp`, `lang-java`, `lang-kotlin`, `lang-ruby`, `lang-php`, `lang-swift`, `lang-dart`, `lang-sql`, `lang-web-markup`, `lang-lua`, `lang-docker`, `lang-terraform`, `lang-makefile`, `lang-powershell`, `lang-protobuf`	First-party language guides

Packages

Not skills. Optional stdlib utilities that live next to the skills home.

Package	What
grok-acp	ACP client for the local Grok Build CLI: mint or resume a session, one prompt turn per call. Used by the `grok-acp` skill. MIT, stdlib only
a2a-webhook-adapter	A2A JSON-RPC peer → HTTPS plain POST webhook (Cursor Grok Bot allowlist). MIT, stdlib-first

Knowledge

Compressed facts (not skills): knowledge/README.md. Path knowledge/<domain>/<kind>/<slug>.md. First note: Jev.

SDLC: docs/SDLC.md
Architecture: docs/ARCHITECTURE.md
Intake: docs/INTAKE.md
First cherry-pick candidates: maintainers/CHERRY-PICK-CANDIDATES.md
CI hooks (fmt/lint): maintainers/CI-HOOKS-PLAN.md
Contributing: CONTRIBUTING.md

Agents landing in this repo: start at AGENTS.md. Claude Code reads CLAUDE.md, which points at AGENTS.md. Work on this repository itself starts at maintainers/AGENTS.md.