Clanker Skills

Map reality. Change the owner. Prove the outcome.

Clanker Skills is a curated collection of 17 evidence-first software-engineering
workflows for Codex, Claude Code, OpenCode, Pi, and Grok Build. The same
portable skill payload is shipped in each runtime's native layout, so a
workflow retains its scripts, references, templates, assets, and licenses
wherever it is installed.

The collection is for work where a successful command is not sufficient
evidence. It helps an agent identify the owner before editing, map reachable
surfaces, validate analytical inputs, freeze audit findings before rendering,
inspect finished PDFs, and remove chat residue from durable prose.

[!NOTE]
This is a community-maintained project. It is not affiliated with or endorsed
by OpenAI, Anthropic, OpenCode, Pi, or xAI.

Install

Choose the runtime you use. Each package is independently usable; no symlink,
shared home-directory setup, or Codex installation is required for the other
four runtimes.

Runtime	Native package	Primary route	Package guide
Codex	Codex plugin	Marketplace installation	Codex
Claude Code	`platforms/claude-code/`	`claude --plugin-dir`	Claude Code
OpenCode	`platforms/opencode/.opencode/skills/`	`opencode.json` `skills.paths`	OpenCode
Pi	`platforms/pi/skills/`	`pi install` from Git	Pi
Grok Build	`platforms/grok/.grok/skills/`	`config.toml` `[skills]` path	Grok Build

Codex

Add the repository as a plugin marketplace, then install its plugin:

codex plugin marketplace add CanerKocak/clanker-skills --ref main
codex plugin add clanker-skills@clanker-skills

Start a new task after installation. A skill can activate from its description,
or invoke one directly:

$writing-plans turn this specification into an implementation plan
$edit-the-chain map the owner and blast radius before changing this API
$analyze-data-quality determine whether this export is safe to publish

The Codex package follows the documented
plugin structure: one
.codex-plugin/plugin.json manifest and one skills/
tree.

Claude Code

Clone the repository and start Claude Code with the standalone plugin directory:

git clone https://github.com/CanerKocak/clanker-skills.git "$HOME/clanker-skills"
claude --plugin-dir "$HOME/clanker-skills/platforms/claude-code"

Run /skills to confirm discovery. Claude Code namespaces these
workflows as /clanker-skills:writing-plans,
/clanker-skills:edit-the-chain, and so on. See the
Claude Code package guide for the native
plugin layout.

OpenCode

Merge the native package path into opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "skills": {
    "paths": [
      "/absolute/path/to/clanker-skills/platforms/opencode/.opencode/skills"
    ]
  }
}

The OpenCode package guide also covers the
project-local .opencode copy and discovery check.

Pi

The repository root is a Pi package. Install the native Pi skills directly
from Git:

pi install git:github.com/CanerKocak/clanker-skills@main

Use pi install -l to attach the package only to the current
project. The Pi package guide also provides a
settings-based route for an existing clone.

Grok Build

Add the native skills directory to the [skills] paths in
~/.grok/config.toml:

[skills]
paths = ["/absolute/path/to/clanker-skills/platforms/grok/.grok/skills"]

The Grok Build package guide covers global and
project-local installation, including discovery with grok inspect.

Why these workflows exist

Most failures in agent-driven engineering are not syntax failures. They come
from editing the wrong owner, missing another caller, trusting a partial
dataset, promoting a weak suspicion into a security finding, or declaring a
document complete without looking at the rendered artifact.

Clanker Skills contributes four recurring controls:

Ownership before edits. Map the real oracle, call chain, and reachable
product surfaces before changing a shared contract.
Independent evidence. Reconcile compiler or language-server evidence
with AST and text searches instead of treating one heuristic as exhaustive.
Frozen inputs before publishing. Separate business context, analytical
validation, security findings, report rendering, and visual QA.
Restraint before ceremony. Reject speculative guards, recovery rails,
generic UI patterns, and prose that merely narrates the work session.

Workflow map

flowchart TD
    A[Request] --> C{Workstream}
    A -.->|multi-step specification| W[writing-plans]
    W --> C
    A -.->|uncertain or high-risk| B[adaptive-code-orchestrator]
    B --> C
    C -->|non-trivial code change| D[edit-the-chain]
    D --> E[semantic-blast-radius]
    E --> F[ast-grep-callchain-audit]
    E --> G[call-chain-invariants]
    F --> H[Smallest correct change]
    G --> H
    H -.->|security-focused diff| I[differential-review]
    H --> J[thermo-nuclear-code-quality-review]
    I -.->|guard or fallback proposed| K[yagni-anti-ceremonial]
    C -->|Data| L{Business context complete?}
    L -->|No| M[gather-business-context]
    L -->|Yes| N[analyze-data-quality]
    M --> N
    C -->|Audit PDF| O[pdf-findings-schema]
    O --> P[pdf-security-audit-report]
    P --> Q{Rendering path}
    Q -->|Typst| R[pdf-typst-report]
    Q -->|Other renderer| S[pdf-visual-qa]
    R --> S
    C -->|Frontend or durable prose| T[uncodixfy or prompt-leakage]

This is a routing map, not a requirement to invoke every skill. Small local
work should stay small.

Skill catalog

Planning and change safety

Skill	Use it for	Core contract
`writing-plans`	A specification or requirements for a multi-step task, before implementation begins.	Produces an implementation-ready plan with exact files, interfaces, tests, verification commands, and no placeholder steps.
`adaptive-code-orchestrator`	Uncertain, cross-cutting, or high-risk repository work.	Chooses solo work, bounded reconnaissance, dependency waves, or independent review according to the evidence gap.
`edit-the-chain`	A non-trivial edit that needs owner and impact mapping.	Classifies the requested route as a short path, awkward parkour, or the wrong oracle, then binds review to the exact final candidate.
`semantic-blast-radius`	Shared APIs, types, helpers, state machines, or public contracts.	Builds one cross-file impact graph from compiler or LSP evidence plus independent AST and text searches.
`ast-grep-callchain-audit`	Structural definitions, calls, imports, parameter flow, and variants.	Contributes AST-backed call-chain edges and counterexamples; a structural match remains a candidate until verified.
`call-chain-invariants`	Similar-looking product surfaces with uncertain shared behavior.	Classifies each reachable surface as applying, different-contract, not applicable, or unknown before completeness is claimed.
`differential-review`	Security-focused review of a commit, branch, diff, or pull request.	Uses history, blast radius, coverage, and adversarial analysis while requiring evidence before promoting a finding.
`yagni-anti-ceremonial`	Proposed guards, fallbacks, compatibility rails, or recovery paths.	Separates live contract requirements from residual risk, policy, follow-up work, ceremony, and theater.
`thermo-nuclear-code-quality-review`	The final source candidate before delivery.	Runs two distinct coherence passes: ownership and boundary integrity, then simplification and hidden-coupling pressure.

Data and business context

Skill	Use it for	Core contract
`gather-business-context`	Missing definitions, source authority, ownership, recent changes, or decision framing.	Retrieves only the context needed downstream, preserves source conflicts, and does not disguise retrieval as analysis.
`analyze-data-quality`	Tables, financial equations, dashboards, query results, or analytical evidence.	Establishes grain and checks completeness, uniqueness, validity, consistency, integrity, freshness, distributions, and reconciliation boundaries.

Security reporting and PDFs

Skill	Use it for	Core contract
`pdf-findings-schema`	Freezing security findings before report layout begins.	Defines canonical JSON so rendering cannot invent findings, evidence, status, or severity.
`pdf-security-audit-report`	Turning frozen findings into a security assessment report.	Builds report structure from validated data and keeps severity and remediation claims traceable to evidence.
`pdf-typst-report`	Stable typesetting for long technical or security reports.	Provides a Typst-first report path and hands the rendered result to the visual-quality gate.
`pdf-visual-qa`	Any generated PDF approaching delivery.	Renders pages to pixels and rejects clipping, overlap, overflow, weak contrast, and other visible defects.

Interface and durable prose

Skill	Use it for	Core contract
`uncodixfy`	Generating or revising frontend HTML, CSS, React, Vue, Svelte, or product UI.	Avoids generic agent-generated dashboard patterns in favor of product-specific hierarchy, spacing, motion, and color.
`prompt-leakage`	Comments, READMEs, instructions, review text, and commit messages.	Removes chat motives, restatements, and reviewer theater while retaining information that a stranger cannot infer.

Make routing automatic in Codex

After installing the Codex plugin, add the repository's single
evidence-first routing block to your global
~/.codex/AGENTS.md. It maps work by contract, including
$writing-plans for multi-step specifications, and makes clear
when not to invoke adjacent workflows.

Repository structure

.agents/plugins/marketplace.json            Codex marketplace catalog
.github/assets/social-preview.png           Repository brand card
plugins/clanker-skills/
├── .codex-plugin/plugin.json               Codex plugin identity and UI metadata
└── skills/<name>/                          Canonical source for all 17 skills
    ├── SKILL.md                            Trigger and workflow contract
    ├── agents/openai.yaml                  Codex display metadata
    └── references|scripts|templates|...    Package-owned resources
platforms/
├── claude-code/                            Standalone Claude Code plugin
├── opencode/.opencode/skills/              Native OpenCode skill tree
├── pi/skills/                              Native Pi skill tree
└── grok/.grok/skills/                      Native Grok Build skill tree
scripts/sync_platform_packages.py           Regenerates and checks native mirrors
scripts/validate_repository.py              Dependency-free repository validation

The canonical source is the only place to edit a portable skill. The four
platform trees are generated, self-contained copies that deliberately omit
only Codex display metadata under agents/.

Verification

Run the same checks used by GitHub Actions from the repository root:

python3 scripts/sync_platform_packages.py --check
python3 scripts/validate_repository.py

The checks fail if a mirror drifts from the portable source, an inventory,
frontmatter name, package manifest, README catalog, routing entry, local
Markdown link, provenance pin, or the 1280×640 social-preview contract moves
without an explicit update.

Runtime boundaries

ast-grep-callchain-audit expects the maintained
ast-grep binary.
The PDF report path may call a separately installed pdf base
skill for ReportLab operations. Typst is optional and used only when selected.
edit-the-chain includes an optional codex exec
review helper. Non-Codex runtimes retain the workflow and must use their
native isolated-review mechanism for that optional execution path.
Conditional workflows can name companion skills that are not bundled here.
Missing companions must be reported as a boundary rather than simulated.

Provenance and licensing

uncodixfy retains its upstream MIT License and is recorded in
THIRD_PARTY_NOTICES.md. The repository
does not grant a blanket license for the remaining material. Public access
alone is not permission to copy, modify, or redistribute those packages; a
repository-wide license remains a maintainer decision.

Contributing and security

Read CONTRIBUTING.md before changing a package.
For unsafe execution or exploitable workflow behavior, follow
SECURITY.md and use private vulnerability reporting.
Use public issues for reproducible bugs and focused skill proposals.

Built for engineers who want agents to show their work and state where their
evidence stops.