feat(skills): add discovery, security, browser QA, and compound layers by praxstack · Pull Request #38 · praxstack/ai-visual-code-review

praxstack · 2026-08-29T11:52:29Z

📋 Description

Vendors the missing layers of an agent engineering OS — discover → spec → implement → review → security → browser QA → ship → learn — without dumping 400+ unrelated SKILL.md files into always-on context.

Also scaffolds Matt Pocock’s per-repo config and a Cursor-native pstack model map.

🔗 Related Issue

Follow-up on the skill-pack work in this PR. No separate issue.

🔄 Type of Change

✨ New feature (non-breaking change that adds functionality)
📝 Documentation update

Pipeline (pick one methodology per stage)

find-skills
  → spec (gstack XOR Spec Kit XOR Compound Engineering)
    → interrogate (Matt Pocock + improve)
      → implement (pstack XOR Superpowers)
        → review / test
          → Trail of Bits (on demand)
            → agent-browser QA
              → ship
                → ce-compound

Do not run gstack, Superpowers, pstack, and Compound Engineering as four simultaneous methodologies on the same task.

What landed

Repo config

docs/agents/issue-tracker.md — GitHub Issues for praxstack/ai-visual-code-review; PRs-as-request-surface off
docs/agents/triage-labels.md — default labels (needs-triage, needs-info, ready-for-agent, ready-for-human, wontfix)
docs/agents/domain.md — single-context (CONTEXT.md + docs/adr/)
.cursor/rules/pstack-models.mdc — alwaysApply: true, Cursor Task slugs only (no unconfirmed *-max / grok-4.6-fast-xhigh names)
scripts/link-agent-skills.sh copies that map to ~/.cursor/rules/ on Cloud Agent boot

New vendored packs (slimmed `SKILL.md` + references + scripts)

Pack	Source	Skills	Notes
find-skills	vercel-labs/skills	1	Skill #0 / discovery only
agent-browser	vercel-labs/agent-browser	1	Optional CLI via `scripts/install-agent-browser.sh`
trailofbits	trailofbits/skills	81	CC-BY-SA-4.0; on demand, not always-on
compound-engineering	EveryInc/compound-engineering-plugin	33	Learn/compound layer
anthropics	anthropics/skills	5	`frontend-design`, `webapp-testing`, `mcp-builder`, `skill-creator`, `claude-api`
awesome-copilot	github/awesome-copilot	15	GitHub issue/PR/Actions/`gh` subset only

Existing packs remain: Superpowers, Matt Pocock, gstack, official Cursor pstack, improve, Cursor Team Kit, Vercel agent-skills, Addy Osmani.

Catalog: 344 skills in docs/agent-skills.md.

The installer now supports an optional allowlist field (pack|repo|subdir|license|skill,dir,names).

Intentionally not vendored whole-set

github/spec-kit — no useful SKILL.md tree for this app. Use specify init --here --integration cursor-agent (install Specify from the Git tag, never a random PyPI specify-cli).
microsoft/skills, aws/agent-toolkit-for-aws, cloudflare/skills, supabase/agent-skills — stack cartridges; install when the product uses that stack.
Remainder of anthropics (pptx/xlsx/docx/art/branding) and the rest of awesome-copilot (~400 skills). find-skills is how agents pull more later.

gstack’s Cursor ./setup --host cursor installer still disagrees with the README on some releases (issue 2361); this repo keeps pstack native for Cursor and gstack as a portable skill tree.

✅ Checklist

My code follows the project's style guidelines
I have performed a self-review of my code
I have made corresponding changes to the documentation
My changes generate no new warnings
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes

📝 Additional Notes

App runtime is unchanged. plans/ from the earlier improve audit is still executor handoff, not implemented here.

Verification

npm test: 5 suites, 77 tests (pack presence, allowlists, spec-kit not vendored, pstack slug gate, Matt Pocock docs)
npm run lint: 0 errors, 31 pre-existing warnings
bash -n on the three install/link scripts
agent-browser CLI present; Chrome 152 already installed on this VM

Refresh Superpowers, Matt Pocock, and gstack. Point pstack at cursor/plugins instead of the Claude Code port. Add shadcn/improve, Cursor Team Kit, Vercel agent-skills, and Addy Osmani's pack. The installer now copies skill scripts and reuses a clone when two packs share a repo. docs/agent-skill-packs.md records why these packs landed and which first-party trees were skipped. Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

coderabbitai · 2026-08-29T11:52:38Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 63ad3f9e-f65e-4a10-a192-3fe97809c6ba

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

…ss, and engines Advisor-only output from shadcn/improve against 068fec2. No application code changed. Executors should start at plans/README.md. Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

chatgpt-codex-connector · 2026-08-29T11:57:03Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T12:04:02.061099Z	`b3a0a44`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b3a0a44da3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-29T12:03:59Z

+  (cd "$dir" && find . -type f \
+    -not -path '*/.git/*' \
+    -not -name '*.zip' \
+    \( -name '*.md' -o -path './scripts/*' -o -path './references/*' \) \


Preserve runtime dependencies alongside skill scripts

When an installed skill invokes its bundled scripts, this allowlist omits required sibling runtime files: vercel-optimize/scripts/collect-signals.mjs imports ../lib/*.mjs, but no lib/ directory is vendored, so it exits immediately with ERR_MODULE_NOT_FOUND. The same filter drops styles.css, renderer.js, and template.html, which the new pr-review-canvas skill explicitly requires. Copy each skill's required runtime tree or add pack-specific assets so these indexed skills are usable.

AGENTS.md reference: AGENTS.md:L31-L32

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-08-29T12:03:59Z

+
+| Skill | Description |
+| --- | --- |
+| `vercel-composition-patterns` |  |


Parse multiline descriptions before publishing the skill index

The generated index now publishes empty descriptions for vercel-composition-patterns and vercel-react-native-skills because their valid YAML descriptions continue on indented lines; Make Bot UI similarly renders as the literal >-. In those cases the promised trigger catalog cannot tell agents when to select the skill. Parse YAML block scalars/multiline values and regenerate the index.

AGENTS.md reference: AGENTS.md:L18-L19

Useful? React with 👍 / 👎.

Record GitHub Issues for praxstack/ai-visual-code-review (PRs-as-request-surface off), default triage labels, and single-context CONTEXT.md + docs/adr/. Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

Write always-applied .cursor/rules/pstack-models.mdc using detected Task slugs. Map unavailable skill-example names onto the closest available models and keep a four-model cross-family panel. Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

…ted subsets Extend the clone+copy installer with allowlists so Cloud Agents get files in git. Vendor trailofbits (on demand), vercel find-skills, agent-browser, Compound Engineering, an Anthropic engineering subset, and a GitHub issue/PR/gh slice of awesome-copilot. Skip spec-kit and whole-set cloud cartridges. Document the one-methodology pipeline. Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

…packs Allow empty allowlists to mean the whole SKILL.md tree, pin spec-kit to v1.0.1, record the Microsoft engineering subset, and document AWS, Cloudflare, and Supabase scan roots. Tests now expect the full toolbox and vendored Spec Kit command skills. Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

Convert github/spec-kit@v1.0.1 constitution/specify/plan/tasks/implement (and the rest of the command set) into SKILL.md trees without running specify init in this Express app. Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

Replace the 15-skill GitHub-only subset with the complete slimmed skills/ tree so agents can treat the pack as an on-demand shelf. Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

…acks Install the documented Microsoft engineering/docs allowlist plus the AWS skills/ tree, Cloudflare skills, and Supabase agent-skills. Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

Reject non owner/name clone targets and keep git clone stderr so a failed refresh is diagnosable. Tests lock the spec-kit pin and the full awesome-copilot allowlist. Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

praxstack marked this pull request as ready for review August 29, 2026 11:56

chatgpt-codex-connector Bot reviewed Aug 29, 2026

View reviewed changes

cursoragent and others added 4 commits August 29, 2026 12:04

test(skills): split pack policy tests to stay under eslint line limit

3fe1631

Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

cursor Bot changed the title ~~feat(skills): vendor improve, official pstack, and first-party packs~~ feat(skills): add discovery, security, browser QA, and compound layers Aug 29, 2026

cursoragent and others added 6 commits August 29, 2026 12:25

feat(skills): vendor the full awesome-copilot skills toolbox

8f857f4

Replace the 15-skill GitHub-only subset with the complete slimmed skills/ tree so agents can treat the pack as an on-demand shelf. Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

feat(skills): vendor microsoft subset and aws, cloudflare, supabase p…

2a7750b

…acks Install the documented Microsoft engineering/docs allowlist plus the AWS skills/ tree, Cloudflare skills, and Supabase agent-skills. Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

docs(skills): regenerate catalog for spec-kit, copilot, and stack packs

ac6caa3

Co-authored-by: Prax Lannister <praxstack@users.noreply.github.com>

cursor Bot merged commit 37ac800 into main Aug 29, 2026
4 checks passed

praxstack mentioned this pull request Aug 29, 2026

feat(skills): Cursor-native flatten and 2026 high-signal stack #42

Merged

10 tasks

Navigation Menu

feat(skills): add discovery, security, browser QA, and compound layers - #38

feat(skills): add discovery, security, browser QA, and compound layers#38
cursor[bot] merged 12 commits into
mainfrom
prax/vendor-skill-packs-3d82

praxstack commented Aug 29, 2026 •

edited by cursor Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 29, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Aug 29, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Aug 29, 2026

Uh oh!

chatgpt-codex-connector Bot Aug 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

praxstack commented Aug 29, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📋 Description

🔗 Related Issue

🔄 Type of Change

Pipeline (pick one methodology per stage)

What landed

Repo config

New vendored packs (slimmed SKILL.md + references + scripts)

Intentionally not vendored whole-set

✅ Checklist

📝 Additional Notes

Verification

Uh oh!

coderabbitai Bot commented Aug 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Aug 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 29, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Aug 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

praxstack commented Aug 29, 2026 •

edited by cursor Bot

Loading

New vendored packs (slimmed `SKILL.md` + references + scripts)

coderabbitai Bot commented Aug 29, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Aug 29, 2026 •

edited

Loading