Skill UI

Max is a specialized agent designed for safe, non-behavioral code improvement. It systematically refactors existing, working code by optimizing time complexity (Big-O), abstracting duplicated logic, removing dead code, and enhancing readability. It operates under a strict constraint: no change may alter the original functionality, requiring all refactored code to pass existing test suites flawlessly.

This skill provides a deterministic, git-only method to verify claims made by AI agents (e.g., 'done', 'shipped', 'fixed'). Instead of trusting the agent's self-report, it audits the commit's diff and git history using the DOS kernel (`dos verify`, `dos commit-audit`) to confirm if the claimed change genuinely occurred and is backed by non-forgeable evidence. It acts as a critical quality gate.

This skill designs and audits the core engineering harness required for reliable AI agent collaboration within a codebase. It establishes critical infrastructure elements such as change tracking, linting rules, CI/CD gates, and standardized documentation, ensuring the repository remains the single source of truth for all intelligent agents. Ideal for setting up complex development workflows.

This skill enables the creation of a robust 'harness' system for coding agents within a repository. It addresses the need to prevent repeated AI-generated coding mistakes by implementing durable instructions, guardrails, regression tests, and failure memory. It treats the target repository as the source of truth, ensuring consistency and maintaining high reliability across all automated contributions.

This skill enforces a high standard for all generated code, prioritizing correctness, clarity, and idiomatic patterns across all languages. It helps minimize code bloat by removing unnecessary abstractions and verbose patterns, while also optimizing the agent's output by using targeted diffs and eliminating excessive conversational overhead. Use this for all code generation, refactoring, or review tasks.

This skill scaffolds the necessary configurations for advanced engineering workflows. It guides the user through setting up the issue tracking system (GitHub, GitLab, or local markdown), defining the canonical triage label vocabulary, and establishing the domain documentation context (single or multi-context). It must be run once to initialize the repository for subsequent agent-driven development skills.

This document provides a comprehensive guide to the principles and vocabulary needed to write high-quality, predictable, and effective skills. It covers advanced concepts like model-invoked vs. user-invoked skills, managing context load, structuring information hierarchies (steps vs. reference), and implementing progressive disclosure to improve agent predictability.

This meta-skill provides a comprehensive framework for the entire lifecycle of AI agent skills. It supports creating, refactoring, rigorously evaluating (e.g., Skill OS 2.0 Gates), and securely packaging skills from various sources like workflows, prompts, and documents. It ensures standardized, team-ready, and governed deployment of advanced AI capabilities.

This skill reconstructs the detailed workflow behind a specific coding artifact (like a feature or PR). By analyzing local `ax` agent traces, it connects commits, sessions, skills, and tool calls into a concise, evidence-grounded narrative. It is used when needing to understand the step-by-step process and key decisions that led to a result.

This skill provides comprehensive security auditing for Model Context Protocol (MCP) servers and their associated tool metadata. It is designed to detect sophisticated supply chain attacks, including tool poisoning (indirect prompt injection), Server-Side Request Forgery (SSRF), tool shadowing, and unauthenticated exposure. It is essential for securing AI agent stacks before integrating new tools or during CI/CD processes.

Automate security regression testing for Large Language Model (LLM) applications by integrating Promptfoo and DeepTeam into CI/CD pipelines. This skill enforces a critical security gate, automatically testing endpoints against OWASP LLM Top 10, OWASP Agentic threats, and common jailbreaks/prompt injections. It ensures that security patches do not regress over time due to prompt or model changes, providing continuous risk monitoring.