agent-skills
Reusable skill library for AI coding delegates (session Claude, kimi, agy, vibe, codex) working on the CloudHost/iWP.es projects. Goal: capture process knowledge once, so a delegate brief can reference a skill instead of re-explaining the same process from scratch every time.
Format
Each skill is a directory under skills/ containing a SKILL.md with
YAML frontmatter (name, description, optional license/source)
followed by the actual instructions in markdown. This is the same format
Claude Code's native Skill tool consumes directly, and matches the
convention used by other cross-platform skill projects (see Provenance
below) -- Gemini CLI's activate_skill tool and some Codex plugin setups
can potentially consume the same format natively, though that hasn't
been separately verified for this repo yet.
For delegates that don't natively discover skills (kimi, vibe, and
any codex/agy invocation not specifically configured for plugin
discovery): read the relevant SKILL.md yourself before writing the
delegate's brief, and fold its content into the prompt directly rather
than assuming the delegate can fetch it itself.
Skills in this repo
wordpress-plugin-rebrand-- forking/rebranding an existing WP plugin under a new brand prefix.wordpress-plugin-conventions-- baseline WP plugin coding standards.wordpress-cli-remote-execution-- running wp-cli against a site inside a remote jail/container.gitea-release-workflow-- tagging releases on self-hosted Gitea, including a real release-asset-unreachable gotcha and its workaround.bastille-jail-provisioning-- FreeBSD jail creation via clone-from-base, including a real recurring IP-conflict gotcha.remote-shell-quoting-safety-- the base64-push pattern for landing$/quote-heavy content through nested shell layers without corruption.server-fleet-map-- which host is for what (dev/corporate/affiliate/ customers) and how to decide where new work belongs.delegate-brief-writing-- what a self-contained brief for a memoryless CLI delegate needs to contain.verification-before-completion-- never relay a delegate's self-report as fact; how to actually re-verify.karpathy-guidelines-- general LLM-coding behavioral guidelines (simplicity, surgical changes, surfacing assumptions).web-design-best-practices-- modern UI/UX conventions to apply by default (typography, spacing, color/contrast, motion, forms).web-accessibility-- WCAG-aligned baseline (semantic HTML, keyboard nav, contrast, ARIA usage, forms).security-headers-and-tls-- HTTP security headers and TLS/SSL configuration strength, including reverse-proxy-layer gotchas.code-sanitization-- framework-agnostic injection-prevention baseline (SQLi, XSS, command injection, path traversal, uploads, deserialization).parallel-delegate-shared-files-- never have 2+ parallel delegates edit the same bootstrap/wiring file; use self-registration instead. Real incident from the iWP Cache build (lost updates, twice).
Provenance
Some skills here are original (derived directly from real incidents on this project); some are adapted from external open-source skill libraries under their original MIT licenses, with attribution kept in each skill's frontmatter:
- obra/superpowers (MIT)
- SuperClaude-Org/SuperClaude (MIT)
- andrej-karpathy-skills (MIT)
Adding a new skill
When a real, non-obvious pattern or gotcha comes up more than once, write it down here rather than re-discovering it next time. Keep each skill focused on one concern, include the why (not just the what) so future edge cases can be judged sensibly, and prefer concrete confirmed incidents over generic advice.