AIgility

AIgility (a play on AI + Agile) is the Agentic Product Delivery Lifecycle: a portable, model-agnostic library of AI skills and agents, organised by the 8 phases of the product delivery lifecycle. Clone it, run one install command inside any project, and they become available to your AI assistant.

Works with Claude, ChatGPT, Gemini and any model — each skill is plain Markdown you can copy-paste, and the installer wires them into Claude Code's per-project skills folder automatically.

🧭 Browse the visual catalog → — a single page with every skill grouped by phase, searchable and filterable. Open docs/index.html locally, or enable GitHub Pages to host it as a live site.

What's inside

185 skills mapped onto the eight delivery phases (plus a cross-cutting set). Click a phase to jump to its skills, or install just that set with ./install.sh --phase <id>.

| Phase | Focus | Skills | Install just this set | |-------|-------|:-----:|-----------------------| | Discover | Research & insight | 23 | ./install.sh --phase discover | | Plan | Strategy, OKRs & scope | 30 | ./install.sh --phase plan | | Design | UX & architecture | 17 | ./install.sh --phase design | | Develop | Build & integrate | 22 | ./install.sh --phase develop | | Test | QA, security & compliance | 17 | ./install.sh --phase test | | Deploy | Launch & go-to-market | 18 | ./install.sh --phase deploy | | Operate | Run & monitor | 24 | ./install.sh --phase operate | | Optimize | Measure & iterate | 9 | ./install.sh --phase optimize | | Cross-cutting | Practices that span every phase | 28 | ./install.sh --phase cross-cutting |

Full per-phase listings are in Skills by phase below.

Browse the catalog

For a visual, searchable overview of the whole library, open docs/index.html — one self-contained page (no build step, no dependencies) with every skill grouped by phase, a phase filter, and live search. Two ways to view it:

• Locally: open the file in a browser (open docs/index.html on macOS).
• As a live site (GitHub Pages): in the repo's Settings → Pages, set the source to the main branch and the /docs folder. GitHub then serves it at https://<your-username>.github.io/<repo-name>/ — a shareable front page for the whole package.

The page is generated from catalog.yaml, so it always matches the installed skills.

Install as a plugin (recommended)

The whole library — skills and the ten subagents — installs as a single versioned plugin with two commands, no cloning required:

Claude Code

/plugin marketplace add Portfoliopals/aigility
/plugin install aigility@aigility

GitHub Copilot CLI

copilot plugin marketplace add Portfoliopals/aigility
copilot plugin install aigility@aigility

GitHub Copilot app: Settings → Plugins → add Portfoliopals/aigility as a marketplace, then install the aigility plugin.

This bundles skills/ and agents/ as one unit you can update (/plugin marketplace update aigility) and pin by version. Hooks and MCP stay opt-in — the plugin doesn't auto-wire them.

Install with npx

Prefer plain skill folders over the plugin system? One command copies the skills exactly like the install script, no clone needed (Node 18+):

npx aigility --global          # all skills → ~/.copilot/skills (GitHub Copilot, every project)
npx aigility --global-claude   # all skills → ~/.claude/skills (Claude Code, every project)
npx aigility                   # all skills → ./.claude/skills (current project only)
npx aigility --phase discover  # just one lifecycle phase
npx aigility --full            # skills + agents + loops + hooks into the current project

It accepts every flag the install script does (--list, --list-phases, --phase <id>, --with-agents, …) and works on macOS, Linux, and Windows.

Install into a project (script)

Cloned the repo? The installer copies every skill into that project's .claude/skills/ folder. Add --full to also bring the agents/, loops/ and hooks/ operating layers along in one command.

macOS / Linux

cd /path/to/your/project
/path/to/ai-product-delivery-lifecycle/install.sh          # skills only
/path/to/ai-product-delivery-lifecycle/install.sh --full   # skills + agents/ + loops/ + hooks/

Windows (PowerShell)

cd C:\path\to\your\project
powershell -ExecutionPolicy Bypass -File C:\path\to\ai-product-delivery-lifecycle\install.ps1

List what's available without installing: ./install.sh --list (or .\install.ps1 -List). List the lifecycle phases and their skill counts with ./install.sh --list-phases (.\install.ps1 -ListPhases).

To update later: git pull in this repo, then re-run the install command.

Install globally (just for yourself)

A per-project install only exposes the skills inside that one project. To make every skill available to your assistant in every project on your machine, install globally instead:

macOS / Linux

/path/to/ai-product-delivery-lifecycle/install.sh --global

Windows (PowerShell)

powershell -ExecutionPolicy Bypass -File C:\path\to\ai-product-delivery-lifecycle\install.ps1 -Global

This copies the skills into ~/.copilot/skills, which GitHub Copilot (the Copilot app, coding agent, code review, and CLI) discovers automatically across all your projects. Re-run after a git pull to update.

For Claude Code, use --global-claude (.\install.ps1 -GlobalClaude) instead — it installs into ~/.claude/skills, Claude Code's global skills folder.

Global skill folders differ by tool: GitHub Copilot reads ~/.copilot/skills (and the vendor-neutral ~/.agents/skills); Claude Code reads ~/.claude/skills. --global targets Copilot; --global-claude targets Claude Code.

Install just one phase

Only want the Discover-phase skills, or just the Deploy set? Install a single lifecycle phase instead of all 152:

macOS / Linux

./install.sh --list-phases            # see the phase ids and how many skills each has
./install.sh --phase discover         # into this project's .claude/skills
./install.sh --phase deploy --global  # into ~/.copilot/skills, Deploy skills only

Windows (PowerShell)

.\install.ps1 -ListPhases
.\install.ps1 -Phase discover
.\install.ps1 -Phase deploy -Global

The phase → skill mapping is read from catalog.yaml; a skill can belong to more than one phase, so it will install with each phase it's tagged in. Valid ids: discover, plan, design, develop, test, deploy, operate, optimize, cross-cutting.

Using with ChatGPT / Gemini / other models

Every skill is just Markdown. Open the skill's SKILL.md under skills/<name>/ and paste its contents into your model of choice as a system prompt or instruction.

Skills by phase

Each skill below links to its SKILL.md. New here? Read the phases top-to-bottom — they follow the arc of building a product. Or jump straight to the phase you need.

Discover

Research & insight · 23 skills · install with ./install.sh --phase discover

Figure out what's worth building and for whom — market and customer research, opportunity framing, and validating the problem before you commit.

• brainstorming — Collaborative Q&A that turns vague ideas into shaped designs/specs before any implementation
• market-research — TAM/SAM/SOM sizing plus competitive and industry intelligence with citations
• competitor-analysis — Research and profile competitors into structured dossiers and comparison pages
• customer-research — Interviews/reviews/JTBD synthesis into personas and user segments
• customer-interview-script — Mom-Test-style interview scripts and transcript synthesis
• domain-research — Structured domain/industry research producing a cited research document
• technical-research — Technical/architecture research producing a cited report
• opportunity-solution-tree — Map outcome to opportunities, solutions and experiments (Teresa Torres)
• prfaq-working-backwards — Amazon Working-Backwards PRFAQ to stress-test a product concept
• product-brief — Create, update or validate a product brief
• identify-assumptions — Surface risky assumptions across value/usability/viability/feasibility
• design-experiments — Lean pretotype/low-effort experiments to test product assumptions
• feedback-sentiment-analysis — Analyze user feedback for sentiment, JTBD and satisfaction
• analyze-feature-requests — Theme and prioritize feature requests by impact/effort/risk
• product-validation-lens — Validate the why before building; pressure-test product direction
• brand-discovery — Structured multi-session brand-identity interviews producing a brandbook
• forge-idea — Persona-driven interrogation that hardens or rejects a half-formed idea
• document-existing-project — Document a brownfield codebase for AI context and onboarding
• customer-journey-map — End-to-end customer journey map with touchpoints and pain points
• survey-design — Design a bias-free quantitative survey: screeners, scales, Kano/MaxDiff/Van Westendorp, sampling, min-n, analysis plan.
• experiment-readout — Read out a discovery experiment's results and force an owned pivot / persevere / kill decision.
• participant-recruitment — Recruit and screen interview participants: screeners, outreach copy, incentives, panels, B2B vs B2C sourcing.
• opportunity-scan — End-to-end opportunity scan: mine pain points with verbatim quotes, compare incumbents, isolate whitespace, size TAM/SAM/SOM, go/no-go call.

Plan

Strategy, OKRs & scope · 30 skills · install with ./install.sh --phase plan

Turn a validated problem into a plan — strategy, vision, priorities and OKRs, requirements, and the architecture and stories to build against.

• prd — Create, update or validate a Product Requirements Document
• product-strategy — Create a product strategy canvas and strategic direction
• product-vision — Craft an inspiring, achievable product vision statement
• outcome-roadmap — Transform an output-focused roadmap into an outcome-focused one
• prioritization-frameworks — RICE/ICE/Kano/MoSCoW reference and applied prioritization
• okrs — Brainstorm team-level OKRs aligned to company objectives
• north-star-metric — Define a North Star Metric and supporting metrics constellation
• business-model-canvas — Lean Canvas / Business Model Canvas / Startup Canvas generation
• strategic-frameworks — Detailed SWOT strategy analysis with actionable recommendations
• pricing-strategy — Pricing/packaging strategy: tiers, freemium, WTP, elasticity
• monetization-offers — Monetization strategy and offer construction (value stacking, guarantees)
• user-stories — User/job stories (INVEST, 3C's, WWA) with acceptance criteria
• epics-and-stories — Transform PRD and architecture into epics and detailed stories
• writing-plans — Bite-sized implementation plans assuming zero codebase context
• pre-mortem — Pre-mortem risk analysis on a PRD or launch plan
• strategy-red-team — Adversarially red-team a PRD/roadmap/strategy for failure modes
• stakeholder-map — Power/interest stakeholder grid with a communication plan
• sprint-planning — Capacity, story selection, dependency mapping and sprint status tracking
• spec-driven-development — Distill intent into a canonical SPEC kernel; specify/plan/tasks/implement flow
• implementation-readiness-check — Validate PRD/UX/architecture/stories are aligned before implementation
• project-blueprint — Turn a one-line objective into a multi-session construction plan
• market-segmentation — Identify 3-5 customer segments with demographics, JTBD and fit
• ideal-customer-profile — Identify the Ideal Customer Profile / positioning context doc
• customer-journey-map — End-to-end customer journey map with touchpoints and pain points
• privacy-impact-assessment — Structured PIA/DPIA workflow: data flow mapping, risk scoring, GDPR/CCPA checks, NIST profile, remediation plan.
• roadmap-creation — Create a now/next/later roadmap from a PRD + prioritization: sequence milestones, order dependencies, slot to capacity.
• delivery-estimation — Forecast ship dates and size epics/roadmaps with ranges — t-shirt, PERT, reference-class, Monte Carlo throughput.
• build-vs-buy-analysis — Decide build vs buy vs partner with TCO, vendor shortlisting, lock-in/exit-cost, and a decision record (Plan phase).
• fundraising-pitch — Run a raise: fundraising narrative, deck, investor CRM, cap-table basics, data room, term-sheet literacy.
• business-case-model — Compute and stress-test product economics: revenue projection, CAC/LTV/payback, break-even, budget ask, investment memo.

Design

UX & architecture · 17 skills · install with ./install.sh --phase design

Shape how it looks and feels — UX specs, design systems, brand, accessibility, motion, and end-to-end interface polish.

• architecture-design — Produce an architecture spine/invariants document for consistent build
• architecture-decision-records — Capture architectural decisions as structured ADRs
• frontend-design-polish — End-to-end frontend design/redesign/critique/audit/polish (22 subcommands)
• anti-slop-design-taste — Opinionated non-templated frontend design-taste rulebook
• ui-ux-design-intelligence — Searchable databases of styles, palettes, font pairings and UX guidance
• design-system — Three-layer design-token architecture and component specs
• brand-identity — Brand voice, visual identity and messaging framework
• banner-design — Design banners for social, ads, web heroes and print
• presentation-slides — Create strategic HTML/Chart.js presentations from design tokens
• ui-styling — Build accessible UIs with shadcn/ui and Tailwind plus canvas visuals
• app-store-screenshots — Design App Store / Google Play marketing screenshots: deck strategy, store-required sizes, and a bundled visual-style library.
• ux-specification — Plan UX patterns and produce DESIGN.md/EXPERIENCE.md specs
• accessibility — WCAG 2.2 AA design, implementation and audit across web/mobile
• ui-motion — Production-ready animation/motion patterns for React/Next.js
• threat-modeling — Threat modeling with OWASP Threat Dragon: DFDs, STRIDE/LINDDUN, mitigations, reports (Design phase).
• oauth2-secure-flow — Configure secure OAuth 2.0 flows (PKCE, Client Credentials, Device Grant) per OAuth 2.1/RFC 9700.
• usability-testing — Get human evidence a designed flow works before build: usability sessions, first-click/5-sec/tree tests, metrics, synthesis.

Develop

Build & integrate · 22 skills · install with ./install.sh --phase develop

Write the code well — idiomatic language and framework patterns, API and data design, error handling, feature flags, code review, refactoring, and disciplined execution of a plan.

• executing-plans — Load, critically review and execute a written implementation plan
• subagent-driven-development — Execute a plan via a fresh implementer subagent per task with review
• language-framework-patterns — Idiomatic pattern packs for React/Vue/Next/Python/Go/Rust/Java/Kotlin/Swift/etc
• database-patterns — PostgreSQL/Supabase schema, query and migration patterns
• api-design — REST API design: naming, status codes, pagination, versioning
• error-handling — Robust typed error handling across TypeScript/Python/Go
• git-workflow — Branching, commit conventions, worktrees and conflict resolution
• remotion-video-creation — Programmatic React-to-MP4 video best practices (30+ reference rules)
• correct-course — Manage significant mid-sprint scope/requirement changes
• inherit-legacy-style — Prevent style drift when onboarding an AI agent onto legacy code
• code-review — Reviews PRs and diffs for correctness, security, tests and maintainability with actionable feedback.
• refactoring — Improves code structure without changing behaviour — seams, characterization tests and strangler-fig migrations.
• feature-flags — Adds feature flags, kill switches, gradual rollouts and targeting, with a plan to retire flag debt.
• agentic-ai-security — Layered defenses (allowlist, scoped identity, policy gate, HITL, audit) for securing agentic AI tool invocation.
• prompt-injection-defense — Detect indirect prompt injection hidden in web pages, documents, and images before an LLM agent ingests them.
• secret-scanning — Implement Gitleaks-based secret scanning: pre-commit hooks, CI/CD gates, custom rules, baselines, and remediation.
• project-scaffolding — Bootstrap a new repo/toolchain: scaffold, layout, lint/format/typecheck, test runner, CI gate, one-command dev env.
• trust-and-safety — Product trust & safety: UGC moderation, abuse throttling, account-takeover & payment/signup fraud defense.
• payments-billing-integration — Wire payment provider, checkout, idempotent webhooks, subscriptions, entitlements, tax/MoR, and go live with the first real charge.
• auth-and-multi-tenancy — Build signup/login/sessions, RBAC and entitlements, and enforced tenant isolation for multi-tenant SaaS.
• llm-feature-patterns — Build LLM/AI product features: prompt versioning, RAG, structured outputs, tool calling, streaming, model fallback, cost budgeting.
• async-jobs-and-webhooks — Durable jobs, queues, scheduling, idempotency/outbox/dead-letter, and safe inbound/outbound webhooks.

Test

QA, security & compliance · 17 skills · install with ./install.sh --phase test

Prove it works — test-driven development, per-stack test suites, end-to-end and contract flows, load testing, test-data management, adversarial edge-case hunting, and eval harnesses.

• test-driven-development — Write-test-first, watch-it-fail, minimal-code-to-pass discipline
• e2e-testing — Playwright E2E testing: POM, CI integration, flaky-test strategies
• test-scenarios — Generate comprehensive QA test scenarios from user stories
• systematic-debugging — Root-cause-first debugging discipline before any fix
• adversarial-review — Edge-case-hunter and verification-gap adversarial review layers
• eval-harness — Eval-driven development framework for agent/LLM sessions
• language-specific-testing — pytest/Go/Rust/Kotlin/JUnit/C#/F# testing packs
• contract-testing — Verifies API/service compatibility with consumer-driven contracts and schema-evolution checks in CI.
• load-testing — Plans and interprets load, stress, soak and spike tests against SLO thresholds and latency percentiles.
• test-data-management — Builds factories, fixtures, deterministic seed data and isolated test databases with clean teardown.
• prompt-injection-defense — Detect indirect prompt injection hidden in web pages, documents, and images before an LLM agent ingests them.
• rag-injection-testing — Red-team RAG pipelines for indirect prompt injection using garak/Promptfoo/PyRIT plus embedding-poisoning checks.
• sast-in-ci — Integrate CodeQL/Semgrep SAST scanning, SARIF upload, and merge-blocking quality gates into GitHub Actions.
• dast-in-ci — Integrate OWASP ZAP DAST scanning (baseline/full/API scans) into CI/CD pipelines with quality gates.
• llm-red-teaming — Continuous LLM red-teaming with Promptfoo/DeepTeam gated in CI against OWASP LLM Top 10 and MITRE ATLAS.
• beta-program-uat — Run UAT or a beta/early-access program: recruit testers, capture feedback, set exit criteria, decide go/no-go.
• payment-flow-testing — Verify the checkout/billing money path pre-launch: PSP test mode, webhook idempotency, double-charge, proration, refunds, tax edges.

Deploy

Launch & go-to-market · 18 skills · install with ./install.sh --phase deploy

Ship it and announce it — CI/CD and release-readiness, infrastructure-as-code, secrets and config, rollback and recovery, observability, changelogs and release notes, and the go-to-market launch itself.

• deployment-patterns — CI/CD pipelines, Docker/K8s, health checks and rollback
• release-notes — Generate user-facing release notes from tickets/PRDs/changelogs
• changelog-generation — Scan merges/PRs/commits into a categorized changelog draft
• finishing-a-development-branch — Verify tests then present merge/PR/cleanup options and execute
• github-ops — GitHub repo ops via gh CLI: issues, PRs, CI, releases
• production-readiness-audit — Local-evidence production readiness audit before launch
• product-launch — Plan product launches, feature announcements and GTM release
• go-to-market-strategy — GTM channels, motions, messaging and launch timeline
• infrastructure-as-code — Designs and reviews Terraform/Pulumi/CloudFormation — modules, state, environments, plan/apply and drift.
• secrets-config-management — Manages config, env vars and secret stores with rotation and leak prevention across code, logs and images.
• rollback-recovery — Plans rollbacks and recovery runbooks — blue-green/canary aborts, reversible migrations and failure playbooks.
• observability-setup — Wires logs, metrics, traces and OpenTelemetry into dashboards, correlation IDs and actionable alerts.
• sbom-supply-chain — Parse CycloneDX/SPDX SBOMs, correlate with NVD CVEs, graph transitive deps, and score supply-chain risk before deploy.
• iac-security-audit — Audit Terraform IaC for security misconfigurations with Checkov, tfsec, Terrascan, and OPA/Rego policy-as-code.
• container-security — Scan container images/IaC/K8s with Trivy for CVEs, misconfigs, secrets, and generate SBOMs.
• dependency-confusion-defense — Detect and prevent dependency confusion attacks across npm/PyPI/Maven/Composer/RubyGems via namespace pinning and registry scanning.
• legal-launch-pack — Draft launch-blocking legal docs (ToS, privacy, cookies, refunds, DPA) as counsel-review starter templates.
• platform-policy-compliance — Pass App Store/Play review, manage API ToS and deplatforming risk, ship counsel-ready legal-doc starters.

Operate

Run & monitor · 24 skills · install with ./install.sh --phase operate

Run it in the wild — growth and lifecycle marketing, product analytics, retention, and triage of incidents, CI, PRs, issues and dependencies.

• seo — Technical/on-page SEO, AEO/GEO and programmatic SEO
• paid-ads — Plan and optimize paid ad campaigns plus creative and ASO
• lifecycle-email — Lifecycle/drip email sequences, nurture flows and re-engagement campaigns
• social-content — Create/schedule/optimize social content and social listening
• content-marketing — Content strategy, copywriting and copy editing
• churn-retention — Reduce churn via cancellation flows, save offers and dunning
• onboarding-activation — Optimize post-signup onboarding, activation and paywalls
• product-analytics — Analytics tracking setup and metrics dashboards
• autonomous-loop-ops — Budget-guarded, self-limiting agent loops with verifier and minimal-fix
• ci-triage — Classify CI failures as flake/regression/env/config before fixing
• pr-babysitter — Triage open PRs for CI status, review comments and merge readiness
• issue-triage — Scan, dedupe and prioritize issues; propose labels (propose-only)
• dependency-triage — Scan manifests/lockfiles for outdated/CVE deps grouped by risk
• incident-monitoring — Canary/deployed-URL monitoring and verification after releases
• post-merge-scan — Scan recent merges to main for follow-up cleanup (TODOs, deprecations, broken doc links, stale flags)
• slo-error-budgets — Defines SLIs, SLOs and error budgets with burn-rate alerts and reliability-vs-velocity release gates.
• incident-response — Build structured NIST/PICERL-aligned incident response playbooks with RACI matrices, decision trees, and SOAR integration guidance.
• customer-support-ops — Support ops for a live product: triage, SLAs, macros, help center, refunds, escalation, and a support-signals feed.
• production-incident-management — Declare, classify, mitigate, communicate, and postmortem a production availability/performance incident.
• cost-monitoring-finops — Daily cost-watch: inference/request, per-customer COGS, per-feature cost, cloud anomalies, margin guardrails.
• community-devrel — Stand up and run a two-way user/dev community: platform, moderation, community-led support, champions, DevRel content.
• backup-disaster-recovery — Backup and disaster recovery — RPO/RTO targets, backup cadence, tested restores, region-failover runbooks. (Operate)
• billing-revenue-ops — Operate the money after it's charged: refunds, chargebacks/disputes, VAT/sales tax, proration, MRR/ARR reconciliation.
• sales-playbook — Runs the sales-led/sales-assisted conversion motion: discovery, demo, objections, proposal/quote/SOW, pipeline, CRM, procurement.

Optimize

Measure & iterate · 9 skills · install with ./install.sh --phase optimize

Make it better — experimentation and A/B tests, cohort and conversion analysis, funnel analysis, SLOs and error budgets, performance tuning, and growth loops.

• conversion-rate-optimization — CRO for marketing pages, forms and popups
• ab-testing — Design and analyze A/B tests and growth experiments
• cohort-analysis — Retention curves, adoption trends and segment insights
• performance-optimization — React/system performance tuning and benchmarking
• growth-loops — Identify growth loops/flywheels across loop types
• funnel-analysis — Analyses conversion funnels and activation drop-off to prioritise the leaks worth fixing.
• experiment-design — Design the next experiment: hypothesis, MDE/sample-size power planning, guardrails, pre-registration, learning log.
• llm-production-eval-loop — Mine live LLM traffic into eval cases, gate prompt/model changes against a growing suite, manage cost-quality.
• unit-economics-review — Post-launch unit-economics audit: MRR movement, NRR/GRR, LTV:CAC by channel, CAC payback, gross margin, burn multiple, break-even.

Cross-cutting

Practices that span every phase · 28 skills · install with ./install.sh --phase cross-cutting

Working practices you reach for in any phase — orchestrating agents, elicitation and confidence gates, retrospectives, doc management, and role-based persona agents (business analyst, product manager, architect, and more).

• parallel-execution-optimizer — Speed tasks via concurrent agents, batched calls and worktrees
• context-cost-optimization — Token/context budget audits and cost-aware LLM model routing
• writing-skills — TDD-style authoring/editing/verifying of new skills with subagents
• dispatching-parallel-agents — Delegate independent tasks to isolated concurrent subagents
• agent-orchestration — Multi-agent OS / orchestration pipeline and agent squads
• advanced-elicitation — Deep-critique methods (socratic, pre-mortem, red-team) to refine output
• confidence-check — Pre-implementation confidence gate before writing code
• project-management-mode — PDCA project-management agent restoring session context and tracking progress
• doc-management — Shard large docs into sections and generate doc indexes
• retrospective — Facilitate a structured retrospective with prioritized action items
• knowledge-ops — Knowledge base ingestion, sync and retrieval across stores
• issue-tracker-integration — Retrieve/update Jira tickets via API or MCP
• business-analyst — Acts as a strategic business analyst for requirements discovery and analysis.
• product-manager — Acts as a product manager for PRD creation and requirements discovery.
• system-architect — Acts as a system architect for technical design and architecture decisions.
• ux-designer — Acts as a UX/UI designer for interaction and interface design.
• software-engineer — Acts as a senior software engineer for story execution and implementation.
• technical-writer — Acts as a technical writer for documentation and knowledge curation.
• agent-roundtable — Orchestrates a roundtable of agent personas for group discussion and focus-group panels.
• next-step-advisor — Recommends which skill or next step to use based on your current state and goal.
• lifecycle-map — Index of every skill grouped by delivery phase — ask which skills fit a phase, or for the whole lifecycle map.
• agentic-ai-security — Layered defenses (allowlist, scoped identity, policy gate, HITL, audit) for securing agentic AI tool invocation.
• llm-guardrails — Build LLM input/output guardrails (NeMo, Guardrails AI, Presidio) against injection, PII leakage, and hallucination.
• gdpr-compliance — GDPR technical/organizational controls: DPIAs, data subject rights, breach notification, cross-border transfers.
• soc2-audit-prep — SOC 2 Type II audit prep: gap assessment, evidence collection, control validation, continuous compliance monitoring.
• status-report — Turn sprint/CI/metrics into weekly status, exec/board/investor updates, launch-readiness briefs, MBRs & pitch narratives.
• decision-log — Log product/business decisions (pricing, kills, pivots, scope, timing) as Decision Records so rationale survives session resets.
• localization-i18n — Make the product multilingual/multi-region: i18n architecture, locale formatting, plurals, RTL, TMS workflow, per-locale QA.

Re-categorising skills later

The mapping of skills → phases lives in catalog.yaml, the single source of truth. To move a skill to a different phase (or add it to a second one), edit its phases: list there and regenerate the "Skills by phase" section above. A skill can belong to more than one phase.

Agents and autonomous loops

Beyond the skills themselves, the library ships two optional operating layers:

• agents/ — a lifecycle agent roster of ten native Claude Code subagents: an orchestrator that routes work, eight phase specialists (discovery-analyst, planner, designer, builder, qa-engineer, release-manager, operator, optimizer), and a cross-cutting security-engineer. Each has YAML frontmatter (name/description), so once installed to .claude/agents/ Claude Code auto-delegates to them; each specialist owns one phase and names the exact skills from catalog.yaml it reaches for. The .agent.md extension means GitHub Copilot's plugin system loads them as custom agents too. Instantiates the agent-orchestration skill.
• loops/ — scaffolding for autonomous, budget-guarded loops: loop-budget.md (daily caps + kill switches), loop-run-log.md (per-run JSON ledger), STATE.md (watchlist), and six named patterns under loops/patterns/ (CI sweeper, PR babysitter, dependency sweeper, post-merge scanner, incident watch, eval regression). Every run reads the budget before acting and appends a log line after — the contract defined by the autonomous-loop-ops skill.

Both are opt-in. Add a flag to the installer:

./install.sh --with-agents   # skills + the agent roster -> .claude/agents/ (native subagents)
./install.sh --with-loops    # skills + the loops/ scaffolding
./install.sh --with-hooks    # skills + the opt-in hooks -> .claude/hooks/ (inert until wired)
./install.sh --full          # skills + agents + loops + hooks (the whole library, one command)

(PowerShell: -WithAgents, -WithLoops, -WithHooks, -Full.) Global installs skip these layers — they need a single project root to live in.

Re-running the installer is always safe: layers are copied file-by-file, so only files this library owns are replaced. Your own agents in .claude/agents/, and your accumulated loop state (loops/loop-budget.md caps you tuned, the loop-run-log.md ledger, the STATE.md watchlist), are never overwritten.

Hooks, MCP, recipes, and artifact conventions

Optional extras that round out the library:

• Golden-path recipes — worked end-to-end sequences (idea → launch, brownfield feature, growth experiment) naming the exact skills, subagents, and artifacts at each step.
• Artifact-location convention — where each phase reads and writes its artifacts (docs/product/PRD.md, docs/adr/, specs/, …) so handoffs chain deterministically.
• MCP servers — which Model Context Protocol servers to connect (Linear, GitHub, Figma, Postgres, Sentry, …) to make the "via MCP" skills act on real data. Template: .mcp.json.example.
• Hooks — opt-in, off-by-default Claude Code hooks (suggest a skill, load lifecycle context, guard sensitive files). ./install.sh --with-hooks copies them to .claude/hooks/ where they sit inert; they only run once you paste one snippet into .claude/settings.json. Nothing is auto-wired.

Licensing

This library is original work, MIT-licensed (see the root LICENSE). Every skill that started life adapted from another open-source skill collection has been rewritten clean-room — spec-extracted for capability, then re-authored from scratch without reading the original prose — so no shipped skill's wording, examples, or structure derive from an upstream source. catalog.yaml's source field marks every skill original (this library).

Portability notes

The library is deliberately portable and safe to drop onto any machine:

• No executables ship in skills/ — CI enforces it. Every skill is Markdown guidance plus data files. Skills whose upstream version relied on a load-bearing helper script (e.g. ui-ux-design-intelligence, ui-styling, and the security skills) carry a Portability note near the top of their SKILL.md explaining what to do by hand instead. Run those steps as guidance.
• All skills run standalone — runtime-specific activation scaffolding and external framework dependencies were removed, and role guidance uses neutral role names.
• Some marketing skills mention third-party connectors (e.g. paid-ads, product-analytics, lifecycle-email) as plain-text pointers; the skills work as standalone guidance without them.
• Full skill folders were preserved otherwise: templates, references, assets, and step files all come along so a skill's internal links resolve.