Agent skills library

A library of reusable, universal agent skills — including security-pentest and performance-audit workflows.

SkillsAgent workflowsDocumentation

Dev-story01

Challenge

An agent is only as good as its instructions, and those usually live in one-off chat prompts that nobody reuses.

What we did

A collection of documented skills — each a named workflow with its steps, rules and when-to-use context — that agents pull in instead of improvising from a bare prompt.

Result

Repeated agent work follows a written, versioned procedure, and adding a new skill means writing it down once rather than re-explaining it per task.

Dev-story article

Agent skills library: how the project was built

Every time an agent ran a security audit or a performance pass, it improvised the methodology from scratch — sometimes seven thorough phases, sometimes a couple of curl commands and a shrug. The high-stakes, easy-to-skip work was exactly the work that drifted most between sessions. The fix was to stop treating methodology as something the agent remembers and start treating it as something it loads.

Sections

Modules

Stack

Skills + Agent workflows

Why the project exists

An agent is only as good as its instructions, and those usually live in one-off chat prompts that nobody reuses.

What was built

A collection of documented skills — each a named workflow with its steps, rules and when-to-use context — that agents pull in instead of improvising from a bare prompt.

A plugin of six agent skills, each a Markdown SKILL.md with frontmatter that tells the agent when to trigger it and a body that walks through the actual steps. Two are the anchors — a security-pentest skill and a performance-audit skill — and four cover Vue, VueUse, testing, and router work with reference folders full of specific gotchas. An agent pulls the relevant skill into context and follows a fixed, battle-tested procedure instead of reinventing one.

Main modules and user path

M01

security-pentest: a 7-phase methodology mapped to OWASP Top 10 — recon, auth bypass, injection, CORS, DDoS resilience, infrastructure, and crypto — each phase carrying concrete curl commands per attack vector plus a findings table with severity levels

M02

performance-audit: 7 phases from response-time baseline through caching, compression, Range-request and ETag header checks, concurrent load, resource monitoring, and database performance, closing on a performance-targets table

M03

The decisive rewrite from project-specific to universal: hardcoded endpoints were pulled out and replaced with generic TARGET / FRONTEND placeholders, so one skill applies to any API or stack instead of a single deployment

M04

Frontmatter-driven triggering: each skill's description spells out exactly when to invoke it (before launch, after auth changes, when users report slowness), so the agent loads the right procedure without being told

M05

A Vue-focused set — vue, vueuse-functions, vue-testing-best-practices, vue-router-best-practices — each backed by a reference/ directory of narrow, named pitfalls like navigation-guard infinite loops and Suspense async-component testing

Architecture and technology decisions

Built with Skills, Agent workflows, Documentation.

Plain Markdown SKILL.md files with YAML frontmatter and per-skill reference subdirectories, assembled into an installable plugin via a plugin.json manifest that lists the six skills.

Result and lessons

Repeated agent work follows a written, versioned procedure, and adding a new skill means writing it down once rather than re-explaining it per task.

Instead of an agent half-remembering how to pentest, it loads a fixed 7-phase procedure that runs the same on any project; the security and performance skills went from project-bound scripts to genuinely portable workflows in the universal rewrite.