A collection of Agent Skills for agentic coding tools, covering full-stack delivery: Angular, TypeScript and CSS on the front end, Java and Spring Boot on the back end, and PostgreSQL underneath. Each skill is a single SKILL.md entry point backed by focused reference files, so an agent loads only what the task in hand needs rather than one oversized prompt. The guidance is deliberately version-specific, and the mistakes agents actually make are recorded alongside it.
| Skill | What it does |
|---|---|
ngrx-signal-store-developer |
Generates and refactors NgRx @ngrx/signals SignalStore code and provides architectural guidance for signalStore, withState / withComputed / withMethods / withProps / withHooks, rxMethod / signalMethod, withEntities, the events plugin, reusable signalStoreFeature, and TestBed testing. This is the signals-based store, not the Redux-style @ngrx/store; the skill covers when to prefer each and how to migrate. |
angular-webpack-esbuild-migration |
Migrates an Angular project off a webpack-based builder (@angular-builders/custom-webpack, or @angular-devkit/build-angular:browser) to Angular's native esbuild builder - the application builder on 17+, or browser-esbuild as a stepping stone on 16. Covers the builder swap, outputPath, polyfills, moduleResolution: "bundler", SCSS ~ paths, the optional Karma → Jest move, and every compiler error the stricter pipeline surfaces. |
typescript-developer |
Generates modern TypeScript and provides architectural guidance, derived from the Google TypeScript Style Guide and extended to current practice: tsconfig and strictness flags, ES modules, classes and #private, the type system (satisfies, nullability, generics, any vs unknown, branded types, discriminated unions), literal unions in place of enums, decorators, async and promises, using resource management, naming, JSDoc and testing. Targets TypeScript 6.0 with 7.0 readiness. Every departure from the Google guide is recorded in google-style-deltas.md. |
postgresql-developer |
Designs PostgreSQL schemas from requirements, makes database architecture decisions, writes SQL, and diagnoses slow queries, for PostgreSQL 14-18. Covers schema design from a spec, multi-tenancy (shared schema + RLS, schema-per-tenant, database-per-tenant), data types and keys, constraints, SQL authoring (joins, aggregation, window functions, CTEs, upserts, keyset pagination, full-text search, JSONB), indexing and EXPLAIN, statistics and the planner, transactions and isolation, locking, MVCC and vacuum, lock-aware migrations, roles and row-level security, connection pooling, configuration, backups, replication, and testing with Testcontainers. Pairs with java-developer and spring-boot-developer. |
java-developer |
Generates modern Java code and provides architectural guidance for Java 8-25: immutability, records, sealed types, pattern matching, switch expressions, Optional vs null plus JSpecify nullness annotations, var, text blocks, Javadoc (///, {@return}, {@snippet}), exceptions and resource management, JPMS modules, bean generation, data-oriented programming, structured concurrency and scoped values (the Java 25 StructuredTaskScope redesign, writing a Joiner, ScopedValue against ThreadLocal, and the measured cost of synchronized pinning before Java 24), and version migration. Carries an enforcement map from every rule to the javac -Xlint key, Error Prone check or formatter that actually checks it, and records every departure from the Google Java Style Guide in google-style-deltas.md. Every version floor is verified by compiling the idiom at each release from 8 to 25. |
spring-boot-developer |
Generates modern Spring Boot code and provides architectural guidance for Boot 4.x and 3.5.x in one skill: package structure and Spring Modulith, REST APIs with RFC 9457 ProblemDetail, Jackson 3, Spring Data JPA, transactions, Flyway, caching, Spring Security 7, JWT and OAuth2, HTTP interface clients, resilience, messaging, configuration, Actuator observability, virtual threads and structured concurrency for in-request fan-out, Spring Batch 6, Spring AI and MCP, and Testcontainers-based testing. Pairs with java-developer. |
angular-spring-contract |
Owns the contract between an Angular frontend and a Spring Boot backend, and nothing inside either: the OpenAPI document and what the generator makes of it, the Postgres to Java to wire to TypeScript type pipeline, dates and times, RFC 9457 ProblemDetail on the client, auth end to end (token storage, single-flight refresh, 401 mid-request, guards), pagination envelopes, optimistic concurrency, upload limits, and traceparent propagation. Install it alongside the skills above; it defers everything inside a single layer to them. Every wire format was captured from running Spring Boot 3.5.16 and 4.1.0 applications. |
angular-accessibility |
Takes an Angular application to WCAG 2.2 AA, covering what sits outside a single widget: focus and announcement across route changes and dialogs, perceivable form errors, colour and target size, the criteria new in 2.2, and what automated tooling provably cannot see. A deliberate gap-filler for the official angular-developer skill, which owns widget-level ARIA and is never restated here. Rule counts and contrast ratios are computed, not asserted. |
css-developer |
Organises, writes and maintains a project's whole style layer, independent of framework and component library: the cascade and @layer as the architecture rather than as a trick, where a declaration goes, design token tiers and the runtime versus compile-time split that decides what can ever be themed, which of plain CSS, SCSS or Sass to pick and why including what changes when Tailwind is in the picture, utility classes against semantic classes, support floors, container queries, and introducing style linting to a project that has none. Takes no position on which UI or component library you use. Every cascade rule was measured on Chromium 151, Firefox 153 and WebKit 26.5 with zero engine disagreement; the Sass and Tailwind interactions were measured by compiling them; support dates are computed from the web-features dataset. |
spring-sso-developer |
Implements Single Sign-On in Java and Spring, for internal organisational SSO and for SSO-as-a-feature in multi-tenant SaaS. Spring Security as an OIDC/OAuth2 client and resource server, SAML 2.0 service provider, Spring Authorization Server, and SCIM provisioning from RFC 7644. A full attack catalogue split by protocol - PKCE, state, nonce, redirect-URI matching, algorithm confusion, mix-up, XML Signature Wrapping, XXE, assertion replay, session fixation, logout propagation, deprovisioning and multi-tenant isolation - cross-checked against OWASP ASVS 5.0. Plus 13 provider files (Entra ID, Okta, Keycloak, Auth0, Google Workspace, Cognito, AD FS, Ping, OneLogin, Shibboleth, WorkOS, Entra External ID and a procedure for the rest), each verified against that vendor's own documentation, indexed by cross-vendor tables showing where role information actually lives, which issuer strings surprise you, and what to use as a primary key. Also SCIM provisioning from RFC 7644, frontend integration for SPA-plus-BFF shapes, and both logout directions including OIDC back-channel logout. Covers Boot 4.x with Spring Security 7 and Boot 3.5.x with 6.5. Every Spring identifier and default was read from the 7.1.0 reference or the source at the version tag, and every file states what it could not verify. Exactly one CVE is cited because exactly one was verified against the vendor advisory. The skill was then put through an independent adversarial review, whose 15 findings were each re-verified against primary sources before being applied; the 106-rule review checklist and the ASVS V9 and V10 cross-check came out of that pass. |
java-performance-developer |
Diagnoses and fixes Java performance problems, and writes Java that does not create them, for Java 8 through 25. Built as triage-first: a symptom-to-cause decision tree routes from what the user observed to the measurement that identifies the cause, and only then to the fix. Covers benchmarking and the statistics of regression testing, the tool surface (jcmd, jstat, JFR, JMC, async-profiler, NMT, MAT) including the safepoint bias that makes some profilers systematically wrong, all six collectors with a per-version availability matrix, heap and G1 tuning, the JIT and code cache, startup via CDS and the Java 24/25 AOT cache, native memory and containers, then the code-level half - allocation and object layout, object lifecycle and indefinite references, heap analysis and the full out-of-memory taxonomy, collections, strings, buffered I/O and serialization, exceptions and logging, lambdas and streams, and concurrency. Owns proving where the bottleneck is for database and server layers, then defers to postgresql-developer and spring-boot-developer. Its checklist is deliberately split into apply-blind and measure-first halves, because a performance audit that recommends a flag with no measurement behind it is the failure mode the skill exists to prevent. Version-specific behaviour was verified by running it on Temurin 8u504, 11.0.32.1, 17.0.20.1, 21.0.12 and 25.0.4.1: every flag's existence, default and removal behaviour - and crucially whether a removed flag merely warns or stops the JVM starting, which most do. The flag tables keep accepted and effective in separate columns, because launching a JVM proves only the first; container and cgroup flags are marked as cited rather than measured, since they do not exist on the Windows hosts used. Timings are JMH with a control benchmark: buffering unbuffered I/O at 143x read and 763x write, a buffer above a deflater at 2.7x where the same buffer below it does nothing, HashMap pre-sizing at 2.3x at 100,000 entries while ArrayList pre-sizing is not measurable at that size, loop concatenation as a quadratic curve (1.3x at 10 iterations, 320x at 10,000) rather than one multiplier, uncontended synchronized at 16.7ns against a 1.3ns floor, a throw at 1,300ns from one frame down and 6,716ns from sixty with stack-trace capture scaling sublinearly, object headers at 16 to 8 bytes under Java 25 compact headers, and - re-measured with a paired, interleaved harness after the first method proved to be the noise source - -Xshare:off at ~32% of startup and the AOT cache at ~18% on top of CDS, both reproducing across independent passes to within half a point. Derived from both editions of Scott Oaks' Java Performance, which turn out to be one book twice - so the 1st edition is version-scoped to the Java 8 column rather than discarded. book-deltas.md records every departure, three errata found by running the book's own flags, and - after an adversarial audit - the figures this skill withdrew from its own earlier drafts, including a stream-versus-loop result that re-measurement showed was noise. |
ci-cd-developer |
Designs, reviews and fixes CI/CD pipelines and the release path to production, across GitHub Actions, Azure DevOps and GitLab CI. Structured so the reasoning is written once and translated: a platform-neutral spine (pipeline design, gates, promotion, trunk-based delivery) plus one reference per platform and a translation matrix mapping every concept to its spelling on each. Six deployment targets each answer the same four questions - how an artifact becomes running code, how config is injected, what the rollback primitive is, what the zero-downtime primitive is: Kubernetes, Azure App Service and Container Apps, AWS ECS and Fargate, VM and on-prem, Cloudflare Workers and Cloudflare Containers. The security half covers action SHA pinning and script injection, OIDC federation so no cloud key is stored, SBOM (CycloneDX/ECMA-424 and SPDX/ISO-IEC-5962), SLSA provenance and signing, dependency updates and scanner placement. Verified by running it: Maven reproducibility proven with a control (identical hashes with project.build.outputTimestamp, two different hashes without), syft measured emitting CycloneDX 1.7 but SPDX 2.3 by default while the standard is 3.0.1, cosign v3 offline signing with a tampering control plus three v2 recipes that now fail, and action tags resolved to SHAs (actions/checkout is at v7, not the v3 every tutorial shows). Its checklist splits adopt-anywhere from depends-on-context, and book-deltas.md records what could not be verified - every cloud target is cited rather than measured, and no DORA figures are quoted because the source was not available. |
Agent Skills are designed to be used with agentic coding tools like Claude Code, Codex, Gemini CLI, Antigravity and more. Activating a skill loads the specific instructions and resources needed for that task.
To use these skills in your own environment you may follow the instructions for your specific tool or use a community tool like skills.sh.
pnpm
pnpm dlx skills add https://github.com/0avi/skillsnpm
npx skills add https://github.com/0avi/skillsMIT © 2026 Avinay Basnet.