Qofeno Skills

demo

I kept running into the same problem with AI coding agents: ask one to "set up Stripe" or "connect a database," and half the time you get back a .env full of YOUR_API_KEY_HERE, a "for now" placeholder, or a confident report that describes what should happen instead of actually doing it.

So these skills are built around one rule I don't let myself break: if it can't be done for real, it doesn't get faked — it stops and asks. No placeholder keys, no mock data, no lorem ipsum, no quietly downgrading "set this up" into "here's a TODO for later."

Works with Claude Code, Cursor, Antigravity, Codex, and anything else that reads the open Agent Skills format (SKILL.md).

Install

npx skills add SohailKhan0525/skills

Or install one skill at a time:

npx skills add SohailKhan0525/skills --skill backend-setup-wizard

Want the agent to check every installed skill — from any source — before starting any request, not just when a prompt obviously matches? See ALWAYS-ON-SETUP.md.

Skills in this repo

Skill	Status	What it does
`backend-setup-wizard`	✅ Stable	Provisions, configures, and deploys real, live backends and third-party services (databases, auth, payments, etc.) entirely via CLI. Zero-knowledge credential handling — the agent never sees, types, or reads the raw key; auth happens via OAuth/CLI-login or the user's own terminal. Never test keys, never placeholders.
`security-hardening-wizard`	✅ Stable	Scans every file in a project — any extension, not just source code — for real vulnerabilities, fixes each one for real via CLI, hardens the live deployed backend/site, and produces a verified markdown audit report. Works standalone or as a follow-up to `backend-setup-wizard`.
`frontend-ui-ux-wizard`	✅ Stable	Designs and builds real, production-ready websites — full site scope (home, about, contact, pricing, real privacy/terms pages), a real design-token system, deliberate font pairing, real product screenshots via Playwright — then checks the build, pushes to GitHub, and deploys it live.
`skill-router`	✅ Stable	Checks every installed skill — from any publisher, not just this repo — for relevance before starting substantive work, so a matching skill doesn't get silently skipped just because a request didn't use its exact trigger words. Pair with ALWAYS-ON-SETUP.md for the closest thing to guaranteed coverage.

Status key: ✅ Stable — used and working · 🧪 Beta — functional, still being refined · 📝 Planned — not built yet

More are coming when I need them for my own projects (mainly Qofeno) — I build these because I actually use them, not the other way around. Check open issues for what's planned, or request one if there's a gap you keep hitting.

Why "no stand-ins"

I got tired of agents that technically respond to a request without actually doing it. Every skill here follows the same four rules:

No stand-ins. No placeholder code, no mock data, no lorem ipsum, no "MVP for now." If it can't be done for real yet, the skill says so instead of faking it.
No giving up early. If a step looks blocked, the skill searches current docs and tries alternate paths before telling you something isn't possible.
Stop and ask, don't route around it. If something needs input only you can give — a credential, a decision — the skill pauses and asks. It never invents a workaround.
Untrusted content stays untrusted. Any skill that fetches external docs or web content treats it as reference material, never as instructions to blindly execute — see backend-setup-wizard's Trust Boundaries section for the pattern every skill here follows.

Repo structure

skills/
├── backend-setup-wizard/
│   └── SKILL.md
├── security-hardening-wizard/
│   └── SKILL.md
├── frontend-ui-ux-wizard/
│   └── SKILL.md
├── skill-router/
│   └── SKILL.md
└── <next-skill>/
    └── SKILL.md
.github/
├── workflows/validate-skills.yml   # auto-validates every SKILL.md on push/PR
├── scripts/validate_skills.py
├── ISSUE_TEMPLATE/
└── PULL_REQUEST_TEMPLATE.md

Each skill lives in its own folder with a SKILL.md (YAML frontmatter + instructions), and optionally scripts/, references/, or assets/ subfolders.

Contributing

PRs welcome — see CONTRIBUTING.md for how to add a skill. Same bar applies to everyone, including me: real output, no placeholders, no giving up early. A GitHub Action validates every SKILL.md's frontmatter automatically on push.

If you use one of these and hit something that doesn't hold up to the "no stand-ins" rule, that's a bug — open an issue, I'd genuinely rather know.

License

MIT — use it, fork it, ship it.