Server · #232 trending MCP repo
Opencode Power Pack
waybarrios/opencode-power-pack
55 rigorous skills for Claude Code, Codex, OpenCode 1 and 2, and Pi: code review, security audit, feature development, frontend design, MCP tools, Hugging Face ML/training, and more.
- Stars
- 551
- This week
- —
- Forks
- 45
- Open issues
- 4
- Skills inside
- 55
Inside this repo
48 of 55 skills
skills/agentic-actions-auditoragents-md-improverAudit and improve project-rules files (AGENTS.md, CLAUDE.md, .agents/instructions, local overrides) so the agent keeps accurate project context. Use when the user asks to check, audit, review, update, improve, or fix their AGENTS.md or CLAUDE.md, mentions "project rules maintenance" or "agent contexskills/agents-md-improveragents-md-reviseCapture learnings from the current session into the project-rules file (AGENTS.md, CLAUDE.md, or local override) so future sessions benefit. Use when the user says "revise the rules", "update AGENTS.md / CLAUDE.md with what we just learned", "save this to project memory", "remember this for next timskills/agents-md-reviseai-slopOperational rubric that turns "don't make AI slop" into observable properties, severity levels, evidence requirements, and repair actions for interface design. Use as the reference rubric when building or reviewing marketing sites, product interfaces, dashboards, portfolios, or e-commerce pages, espskills/ai-slopcode-architectDesign a feature architecture by analyzing existing codebase patterns and conventions, then provide a comprehensive implementation blueprint with specific files to create or modify, component designs, data flows, and a build sequence. Use this skill when the user asks for an architecture design, an skills/code-architectcode-explorerDeeply analyze an existing codebase feature by tracing execution paths, mapping architecture layers, understanding patterns and abstractions, and documenting dependencies. Use this skill when you need to understand how a feature works before modifying or extending it, when dispatched as a sub-task dskills/code-explorercode-qualityAgents should invoke this skill for code reviews, linting/formatting setup, maintainability checks, complexity concerns, warning cleanup, coding standards, or quality gates in Rust, TypeScript, Python, shell, and mixed repos.skills/code-qualitycode-reviewReview a pull request or a set of code changes for bugs, logic errors, and project-convention violations using a confidence-filtered, multi-agent process. Use this skill when the user asks to review a PR, audit pending changes, or inspect a diff for problems before merging.skills/code-reviewcode-reviewerReview code for bugs, logic errors, security vulnerabilities, code quality issues, and adherence to project conventions, using confidence-based filtering to report only high-priority issues that truly matter. Use this skill when reviewing a small set of changes locally (such as unstaged diff), when skills/code-reviewercodeqlRun CodeQL database creation and security queries, add data-extension models, or process CodeQL SARIF. Use when CodeQL is explicitly requested; use security-review for a broader manual security review.skills/codeqldesign-patternsAgents should invoke this skill when choosing patterns, designing traits/interfaces/components, deciding abstraction boundaries, evaluating dependency injection/callbacks, or comparing implementation approaches in Rust, TypeScript/React, or Django/Python.skills/design-patternsdifferential-reviewPerforms security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressiskills/differential-reviewfeature-devGuide a feature implementation through a structured seven-phase workflow with deep codebase understanding, clarifying questions, parallel architecture design, and quality review. Use this skill when the user asks to build a new feature, add functionality, or wants a methodical approach to implementaskills/feature-devfp-checkSystematically verifies suspected security bugs to eliminate false positives. Produces TRUE POSITIVE or FALSE POSITIVE verdicts with documented evidence for each bug.skills/fp-checkfrontend-designCreate distinctive, production-grade frontend interfaces with high design quality and accessible markup. Use this skill when the user asks to build or beautify web components, pages, applications, landing pages, dashboards, artifacts, or React/HTML/CSS UI. Generates creative, polished code that avoiskills/frontend-designhf-cliUse the `hf` CLI for Hub authentication, downloads, uploads, repositories, cache, jobs, buckets, webhooks, and endpoint administration. Use for CLI operations, not model recommendations, paper analysis, training design, or building a Space.skills/hf-clihf-cloud-aws-context-discoveryDiscover the active AWS profile, region, account, and caller identity before SageMaker or AWS work. Use when local AWS context is needed or unspecified; do not use for cloud-agnostic model planning.skills/hf-cloud-aws-context-discoveryhf-cloud-python-env-setupCreate an isolated Python environment with a compatible Python version and boto3 for SageMaker or AWS automation. Use before executing AWS Python code; do not use for general Python environment setup.skills/hf-cloud-python-env-setuphf-cloud-sagemaker-deployment-plannerPlan and coordinate a model deployment to Amazon SageMaker, including serving stack and real-time versus async inference. Use as the entry point for SageMaker hosting requests, before image, IAM, and endpoint implementation skills.skills/hf-cloud-sagemaker-deployment-plannerhf-cloud-sagemaker-iam-preflightVerify or select a SageMaker execution role before creating models, endpoints, or training jobs. Use when a role ARN is missing or IAM access fails; inspect existing roles before proposing role creation.skills/hf-cloud-sagemaker-iam-preflighthf-cloud-sagemaker-production-defaultsImplement a production SageMaker endpoint with autoscaling, CloudWatch alarms, and tags. Use after the serving image and IAM role are known; use the deployment planner first when architecture is undecided.skills/hf-cloud-sagemaker-production-defaultshf-cloud-serving-image-selectionSelect and verify the current region-specific serving container URI for a SageMaker model deployment. Use after the deployment pathway is chosen and before endpoint code; never infer an image URI from memory.skills/hf-cloud-serving-image-selectionhf-memHugging Face CLI to estimate the required memory to load Safetensors or GGUF model weights for inference from the Hugging Face Hub.skills/hf-memhuggingface-bestFind and compare recommended Hugging Face models for a task using benchmarks, model size, and device constraints. Use for model selection questions; use huggingface-local-models for GGUF setup and hf-cli for Hub operations.skills/huggingface-besthuggingface-community-evalsRun evaluations for Hugging Face Hub models using inspect-ai and lighteval on local hardware. Use for backend selection, local GPU evals, and choosing between vLLM / Transformers / accelerate. Not for HF Jobs orchestration, model-card PRs, .eval_results publication, or community-evals automation.skills/huggingface-community-evalshuggingface-datasetsUse this skill for Hugging Face Dataset Viewer API workflows that fetch subset/split metadata, paginate rows, search text, apply filters, download parquet URLs, and read size or statistics.skills/huggingface-datasetshuggingface-gradioBuild Gradio web UIs and demos in Python. Use when creating or editing Gradio apps, components, event listeners, layouts, or chatbots.skills/huggingface-gradiohuggingface-llm-trainerTrain or fine-tune language models with TRL or Unsloth on Hugging Face Jobs, including SFT, DPO, GRPO, reward models, and GGUF conversion. Use for cloud LLM training; use huggingface-vision-trainer for vision tasks.skills/huggingface-llm-trainerhuggingface-local-modelsUse to select models to run locally with llama.cpp and GGUF on CPU, Mac Metal, CUDA, or ROCm. Covers finding GGUFs, quant selection, running servers, exact GGUF file lookup, conversion, and OpenAI-compatible local serving.skills/huggingface-local-modelshuggingface-lora-space-builderBuild and publish a Gradio Hugging Face Space for a user-provided image or video LoRA, including pipeline selection and model-card settings. Use for LoRA demos; use huggingface-spaces for general Space work.skills/huggingface-lora-space-builderhuggingface-paper-publisherPublish and manage research papers on Hugging Face Hub. Supports creating paper pages, linking papers to models/datasets, claiming authorship, and generating professional markdown-based research articles.skills/huggingface-paper-publisherhuggingface-papersLook up and read Hugging Face paper pages in markdown, and use the papers API for structured metadata such as authors, linked models/datasets/spaces, Github repo and project page. Use when the user shares a Hugging Face paper page URL, an arXiv URL or ID, or asks to summarize, explain, or analyze anskills/huggingface-papershuggingface-spacesBuild, deploy, debug, or maintain a Hugging Face Space using Gradio, Docker, or Static SDKs. Use for general Space hosting and configuration; use huggingface-zerogpu for ZeroGPU runtime constraints and lora-space-builder for LoRA demos.skills/huggingface-spaceshuggingface-tool-builderUse this skill when the user wants to build tool/scripts or achieve a task where using data from the Hugging Face API would help. This is especially useful when chaining or combining API calls or the task will be repeated/automated. This Skill creates a reusable script to fetch, enrich or process daskills/huggingface-tool-builderhuggingface-trackioTrack and visualize ML training experiments with Trackio. Use when logging metrics during training (Python API), firing alerts for training diagnostics, or retrieving/analyzing logged metrics (CLI). Supports real-time dashboard visualization, alerts with webhooks, HF Space syncing, and JSON output fskills/huggingface-trackiohuggingface-vision-trainerTrain object-detection, image-classification, or SAM segmentation models on Hugging Face Jobs. Use for vision fine-tuning and evaluation; use huggingface-llm-trainer for language models.skills/huggingface-vision-trainerhuggingface-zerogpuImplement or debug Hugging Face Spaces ZeroGPU code using `@spaces.GPU`, including isolation, state, duration, sizing, and CUDA-wheel constraints. Use for ZeroGPU-specific behavior; use huggingface-spaces for general hosting.skills/huggingface-zerogpuhumanizerRewrite AI-generated copy in Spanish and English so it sounds direct, concrete and human while preserving meaning, facts and numbers exactly. Use when drafts feel robotic, verbose or translated and need short active sentences without em-dashes.skills/humanizerinsecure-defaultsDetects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.skills/insecure-defaultsmcp-builderGuide the creation of high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when the user wants to build an MCP server to integrate an external API or service, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).skills/mcp-builderpaper-summarizerAgents should invoke this skill for academic or technical papers, arXiv/PubMed/IEEE/ACM links, PDFs, methodology review, limitations, practical implications, or extracting findings for engineering decisions.skills/paper-summarizersarif-parsingParses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on \"parse sarif\", \"read scan results\", \"aggregate findings\", \"deduplicate alerts\", or \"process sarif output\". Handles filtering, deduplication, format conversion, and CI/CD integraskills/sarif-parsingsecurity-reviewPerform a focused security review of pending git changes to identify high-confidence security vulnerabilities with real exploitation potential. Use this skill when the user asks for a security review, security audit, vulnerability scan, or wants to check pending changes on a branch for security issuskills/security-reviewsecurity-threat-modelCreate a repository-grounded AppSec threat model covering assets, trust boundaries, attackers, abuse paths, and mitigations. Use only for explicit threat-modeling requests, not general architecture or code review.skills/security-threat-modelsemgrep-rule-creatorCreates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.skills/semgrep-rule-creatorsemgrep-rule-variant-creatorCreates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.skills/semgrep-rule-variant-creatorsemgrepRun Semgrep static analysis across a codebase, optionally using Semgrep Pro for cross-file taint analysis. Use when Semgrep or a static-analysis scan is requested; use security-review for a manual audit.skills/semgrepsharp-edgesIdentify error-prone APIs, dangerous configuration, and footgun designs that enable security mistakes. Use for API ergonomics, misuse resistance, secure defaults, or pit-of-success reviews; use code-review for general defects.skills/sharp-edgesDocumentation
README
OpenCode Power Pack for Claude Code, Codex, OpenCode 1 + 2, and Pi
Fifty-five portable workflows for Claude Code, Codex, OpenCode 1 and 2, and Pi.
Code review, security audit, feature development, frontend design, project memory, and authoring tools.
Install · Documentation · OpenCode 2 · Select Skills · Claude Code · Codex Quick Install · Pi Quick Install · Skills · Sandbox Contract · Invocation · Architecture · Credits
OpenCode 2 support
Version 0.6.0 supports OpenCode 2 and keeps OpenCode 1.18.7 support. Both hosts load all 55 skills and the three feature-development specialists. Smoke tests cover OpenCode 1.18.7, 2.0.14, and 2.0.32, including effective read-only permissions on V2.
Install the plugin in OpenCode 2:
opencode plugin add "opencode-power-pack@git+https://github.com/waybarrios/opencode-power-pack.git"
Release v0.6.0 and npm 0.6.0 include the plugin for OpenCode 1 and 2. Tag v0.5.0 and npm 0.5.0 have only the OpenCode 1 plugin.
For host commands, update steps, and the current catalog, see the documentation and skill reference. The OpenCode compatibility guide covers source selection and V2 permissions.
Native sandboxes in v0.5.0
OpenCode Power Pack now includes an opt-in, fail-closed sandbox runner for safer command execution from Codex, OpenCode, Claude Code, and Pi. It gives all four agents one portable capability contract with four least-privilege profiles, while using native Seatbelt isolation on macOS and Bubblewrap on Linux.
- Lightweight: one contained command tree, with no container image, daemon, or persistent sandbox to manage.
- Portable: the same CLI and skill policy work from all four supported coding agents.
- Least privilege: skills default to
observe,develop,network-read, orpublish, with explicit escalation checks. - Fail closed: unavailable isolation, undeclared escalation, missing confirmation, or backend failure stops execution instead of retrying outside the sandbox.
Install the CLI, verify the boundary from the active agent session, and run a command with the skill's trusted profile:
npm install --global @waybarrios/opencode-power-pack@0.6.0
opencode-power-pack sandbox doctor --json
opencode-power-pack sandbox exec --skill code-review -- git status --short
The current guarantee is intentionally precise: the command and its descendants are shell-contained. Automatic host routing and whole-agent isolation are not claimed yet. See run the sandbox from each agent and the complete compatibility specification.
Claude Code Quick Install
Run these commands inside Claude Code:
/plugin marketplace add waybarrios/opencode-power-pack
/plugin install opencode-power-pack@opencode-power-pack
Run /reload-plugins if the installation summary requests it. Skills are namespaced to avoid collisions, so explicit invocations use names such as /opencode-power-pack:code-review and /opencode-power-pack:feature-dev.
Codex Quick Install
codex plugin marketplace add waybarrios/opencode-power-pack --ref main
codex plugin add opencode-power-pack@opencode-power-pack
Start a new Codex session, open /plugins to confirm the installation, or invoke a workflow explicitly with $code-review, $feature-dev, $security-review, and the other bundled skills.
Pi Quick Install
pi install git:github.com/waybarrios/opencode-power-pack
Pi discovers the fifty-five skills declared by the package. Use pi list to verify the installation. For a project-local installation recorded in .pi/settings.json, add -l:
pi install git:github.com/waybarrios/opencode-power-pack -l
Selective Install With npm
Install only the workflows you want into the shared .agents/skills location recognized by Codex, OpenCode, and Pi:
Use npx when you want to run the latest installer without keeping a global copy:
# Inspect every profile and skill
npx @waybarrios/opencode-power-pack list
# Install the balanced recommended profile for your user
npx @waybarrios/opencode-power-pack install --profile recommended
# Install individual skills
npx @waybarrios/opencode-power-pack install code-review security-review
# Install a profile only for the current repository
npx @waybarrios/opencode-power-pack install --profile review --project
# Preview a selection without writing anything
npx @waybarrios/opencode-power-pack install --profile security --dry-run
# Update previously copied skills from the latest package
npx @waybarrios/opencode-power-pack@latest install --profile review --force
Or install the package globally and use its shorter executable:
npm install --global @waybarrios/opencode-power-pack
opencode-power-pack list
opencode-power-pack install --profile recommended
opencode-power-pack install code-review security-review
To update or remove the global installation:
npm update --global @waybarrios/opencode-power-pack
npm uninstall --global @waybarrios/opencode-power-pack
The npm package is scoped as @waybarrios/opencode-power-pack to give it an unambiguous registry identity. The package still installs the shorter opencode-power-pack executable for direct CLI use. No global installation is required when using npx.
GitHub Packages mirror
Every GitHub release can also be published from its immutable tag to the repository's GitHub Packages page. npmjs remains the recommended public installation source because it works without GitHub authentication.
To install the GitHub Packages mirror, first authenticate with a GitHub personal access token (classic) that has read:packages, then select the GitHub registry explicitly:
npm login --scope=@waybarrios --auth-type=legacy --registry=https://npm.pkg.github.com
npm install --global @waybarrios/opencode-power-pack --registry=https://npm.pkg.github.com
opencode-power-pack list
Run the installer directly from the mirror after authentication:
npx --registry=https://npm.pkg.github.com @waybarrios/opencode-power-pack list
Maintainers publish the mirror with the Publish GitHub Package workflow. Release events publish automatically, while a manual run requires an existing release tag such as v0.6.0. The workflow verifies that the tag matches package.json, uploads the artifact already verified by required release CI without rerunning lifecycle scripts, and authenticates with the repository-scoped GITHUB_TOKEN; no package token is stored in the repository.
| Profile | Intended use |
|---|---|
recommended |
Balanced software development without the specialized security and ML catalogs |
review |
Comprehensive and focused code review plus quality and differential review |
feature-dev |
End-to-end feature workflow with its explorer, architect, and reviewer dependencies |
frontend |
Frontend implementation and anti-generic design critique |
security |
Security review, threat modeling, static analysis, validation, and reporting |
huggingface |
Model discovery, local inference, training, evaluation, Spaces, and AWS deployment |
authoring |
Skills, MCP servers, technical-paper summaries, and natural copy editing with humanizer |
project-memory |
Audit and maintain durable project guidance |
Profiles automatically include required companion skills and can be combined with individual skill names. The default destination is ~/.agents/skills; --project finds the current Git root and installs into its .agents/skills directory. Existing directories are skipped unless --force is provided, and replacements are staged with rollback plus per-skill locking. Every copied skill retains its provenance, third-party notices, and license texts. Use --dry-run to preview or --all to install the complete catalog.
To install humanizer on its own, or the four-skill authoring profile:
npx @waybarrios/opencode-power-pack install humanizer --dry-run
npx @waybarrios/opencode-power-pack install --profile authoring
The npm installer and the full Claude Code/Codex/OpenCode plugins are alternative activation paths. Claude Code users should prefer the namespaced plugin because the selective installer currently targets the portable .agents/skills location used by Codex, OpenCode, and Pi. If a full plugin is already active, selectively copying the same skills does not reduce that plugin's loaded catalog.
Sandbox Capability Contract
The package assigns every bundled skill a default least-capability profile and an explicit set of allowed escalations. Native plugin and package installations expose the skills but do not install the sandbox executable, so install the npm CLI in the same operating-system environment as the agent:
npm install --global @waybarrios/opencode-power-pack@0.6.0
opencode-power-pack sandbox doctor
opencode-power-pack sandbox resolve --skill code-review
opencode-power-pack sandbox resolve --sandbox-profile publish --json
opencode-power-pack sandbox exec --skill code-review -- rg TODO .
| Sandbox profile | Workspace | Network and credentials | External side effects |
|---|---|---|---|
observe |
Read | Denied | Denied |
develop |
Write | Denied | Denied |
network-read |
Write | Explicitly approved | Denied |
publish |
Write | Explicitly approved | Explicit confirmation required |
Run an allowed network escalation by naming the destination explicitly:
opencode-power-pack sandbox exec \
--skill code-review \
--sandbox-profile network-read \
--allow-domain api.github.com \
-- curl https://api.github.com/repos/owner/repository
The literal -- is required. Everything after it is the contained child command and its arguments. The runner preserves the child exit code and never falls back to an unsandboxed execution.
Run the sandbox from each agent
Run sandbox doctor inside the same agent session that will execute the command. Success in a separate terminal does not prove the active agent can start the native backend.
| Host | How to invoke the runner |
|---|---|
| Codex | Ask Codex to use its shell tool for opencode-power-pack sandbox doctor, then for the complete sandbox exec command. |
| OpenCode | Ask OpenCode to use its shell tool for opencode-power-pack sandbox doctor, then for the complete sandbox exec command. |
| Claude Code | Ask Claude Code to use Bash for opencode-power-pack sandbox doctor, then for the complete sandbox exec command. |
| Pi | Ask Pi to use its shell tool for opencode-power-pack sandbox doctor, then for the complete sandbox exec command. |
Use this prompt in Codex, OpenCode, or Pi:
Use the shell tool to run `opencode-power-pack sandbox doctor`.
If it succeeds, run `opencode-power-pack sandbox exec --skill code-review -- git status --short`.
Do not run the child command separately and do not retry without the sandbox.
For Claude Code, use the same prompt with Use Bash in the first sentence. Keep the entire sandbox exec invocation in one host shell call.
Platform requirements
The runner requires Node.js 20.11.0 or newer.
| Platform | Status | Additional requirements |
|---|---|---|
| macOS | Supported | Native Seatbelt; sandbox doctor performs an operational preflight. |
| Linux | Supported | Trusted system installations of bubblewrap, socat, and rg, plus working unprivileged user and network namespaces. |
| WSL2 | Expected, dedicated CI pending | The same Linux dependencies and namespace support. |
| WSL1 | Unsupported | Required namespace primitives are unavailable. |
| Windows native | Fails closed | Platform-specific provisioning and boundary tests are not complete. |
The contract continues to report advisory because skill metadata does not enforce itself. The npm package also provides an opt-in sandbox exec runner backed by a pinned native runtime. When its operational preflight succeeds, sandbox doctor reports shell-contained; Strict ready remains no until a host adapter blocks ordinary tool bypasses.
For network-read, the runner enforces conventional HTTP read methods (GET, HEAD, and OPTIONS). This is a best-effort side-effect boundary because an approved endpoint can still implement unsafe GET behavior. Use narrow destination grants and expose only credentials required for the retrieval.
The runner is lightweight and on demand: it contains one command tree with native OS primitives, starts no persistent container or daemon, denies unrelated host reads, and deletes its private temporary directory after execution. sandbox doctor exits nonzero when the native boundary is unavailable.
See Sandbox Compatibility Across Coding Agents for the current Codex, Claude Code, OpenCode, and Pi matrix, platform requirements, activation design, fail-closed behavior, and adapter roadmap.
Selective installations include a generated SANDBOX_POLICY.json beside each copied SKILL.md. The file is self-describing and preserves the skill's default profile even when the central package is not present. It remains advisory until an enforcement backend and host adapter are active.
Why This Exists
Claude Code, Codex, OpenCode, and Pi read SKILL.md workflows, but many valuable workflows originated as Claude-specific commands and agents. Copying those artifacts directly does not preserve their orchestration, permissions, or subagent behavior.
This package exposes the shared skills as a namespaced Claude Code plugin, registers feature-development specialist roles as read-only OpenCode subagents, lets Codex execute the same phase assignments with its native subagent workflow, and exposes all fifty-five skills as a Pi package. It ships immutable provenance for every upstream work.
It complements obra/superpowers, which provides process skills such as brainstorming, TDD, debugging, and plan execution.
What's Inside
| Category | Skill | Purpose |
|---|---|---|
| Review | code-review |
Multi-agent PR review with confidence filtering and reproduction scenarios |
| Review | security-review |
Security-focused review with category coverage and exploit-path validation |
| Review | supply-chain-risk-auditor |
Flag dependencies at heightened risk of exploitation or takeover |
| Review | sharp-edges |
Identify error-prone APIs and footgun configurations before they cause security mistakes |
| Review | insecure-defaults |
Detect fail-open insecure defaults (hardcoded secrets, weak auth, permissive config) |
| Review | fp-check |
Systematically verify a suspected security bug to a TRUE/FALSE POSITIVE verdict |
| Review | vuln-report |
Draft a single-vulnerability disclosure report in GitHub advisory style |
| Review | agentic-actions-auditor |
Audit GitHub Actions workflows for prompt-injection risk in AI agent integrations |
| Review | security-threat-model |
Model threats using repository evidence, trust boundaries, assets, and abuse paths |
| Review | differential-review |
Security-focused differential review of a diff/PR with blast-radius analysis |
| Review | variant-analysis |
Find similar vulnerabilities/bugs across a codebase from one initial pattern |
| Review | sarif-parsing |
Parse, filter, dedupe, and convert SARIF output from CodeQL/Semgrep/other scanners |
| Review | semgrep |
Run a Semgrep static analysis scan with approval-gated ruleset selection |
| Review | semgrep-rule-creator |
Write custom Semgrep rules for a specific vulnerability/bug pattern |
| Review | semgrep-rule-variant-creator |
Port an existing Semgrep rule to additional target languages |
| Review | codeql |
Run a CodeQL scan using interprocedural data flow and taint tracking |
| Feature development | feature-dev |
Seven-phase workflow from discovery through implementation and review |
| Feature development | code-explorer |
Trace a feature across entry points, layers, state, and dependencies |
| Feature development | code-architect |
Produce a file-level architecture and implementation blueprint |
| Feature development | code-reviewer |
Adversarial review of a focused local change set |
| Design | frontend-design |
Create distinctive interfaces with an accessibility and craft rubric |
| Design | ai-slop |
Rubric to judge whether a design is generic "AI slop" or genuinely product-fit |
| Code quality | code-quality |
Linting, complexity, and review checklists across Rust, TypeScript, Python, and shell |
| Code quality | design-patterns |
Pattern trade-offs (when to use, when to skip) for Rust, TS/React, and Django/Python |
| Research | paper-summarizer |
Extract actionable findings and a claim-evidence map from academic/technical papers |
| Authoring | humanizer |
Rewrite AI-generated copy in ES/EN into direct, natural prose without inventing facts |
| Authoring | mcp-builder |
Design and build MCP servers in TypeScript or Python |
| Authoring | skill-creator |
Create, test, and improve reusable SKILL.md workflows |
| Hugging Face | hf-cli |
Use the hf CLI for auth, cache, repos, jobs, papers, and Spaces |
| Hugging Face | hf-mem |
Estimate memory needed to load Safetensors/GGUF weights for inference |
| Hugging Face | huggingface-best |
Find and compare the best model for a task via official benchmark leaderboards |
| Hugging Face | huggingface-datasets |
Dataset Viewer API workflows for metadata, pagination, search, and filters |
| Hugging Face | huggingface-papers |
Look up and analyze Hugging Face / arXiv paper pages via the papers API |
| Hugging Face | huggingface-paper-publisher |
Publish and manage research papers on the Hub, including research-article templates |
| Hugging Face | huggingface-tool-builder |
Build reusable scripts/tools around the Hugging Face API |
| Hugging Face | huggingface-local-models |
Select and run GGUF models locally with llama.cpp (CPU/Metal/CUDA/ROCm) |
| Hugging Face training | huggingface-llm-trainer |
Fine-tune LLMs (TRL: SFT/DPO/GRPO, or Unsloth) on Hugging Face Jobs |
| Hugging Face training | huggingface-vision-trainer |
Fine-tune object detection, image classification, and SAM/SAM2 segmentation models |
| Hugging Face training | train-sentence-transformers |
Train bi-encoder/cross-encoder/sparse embedding models |
| Hugging Face training | trl-training |
Train with the TRL CLI using SFT, DPO, GRPO, KTO, RLOO, and reward modeling |
| Hugging Face training | huggingface-community-evals |
Run local evaluations with inspect-ai / lighteval |
| Hugging Face training | huggingface-trackio |
Track and visualize ML training experiments with Trackio |
| Hugging Face Spaces | huggingface-spaces |
Build, deploy, and debug Gradio/Docker/static Spaces |
| Hugging Face Spaces | huggingface-gradio |
Build Gradio web UIs and demos in Python |
| Hugging Face Spaces | huggingface-lora-space-builder |
Build and publish a Gradio Space demo for a user-provided LoRA |
| Hugging Face Spaces | huggingface-zerogpu |
Write/debug ZeroGPU-constrained Gradio Space code |
| Hugging Face cloud | hf-cloud-aws-context-discovery |
Discover the user's local AWS context before any AWS work |
| Hugging Face cloud | hf-cloud-python-env-setup |
Set up an isolated Python env for SageMaker/AWS work |
| Hugging Face cloud | hf-cloud-sagemaker-deployment-planner |
Entry point for planning a SageMaker model deployment |
| Hugging Face cloud | hf-cloud-sagemaker-iam-preflight |
Ensure a usable SageMaker execution role exists before deploying |
| Hugging Face cloud | hf-cloud-serving-image-selection |
Pick the right SageMaker serving container image |
| Hugging Face cloud | hf-cloud-sagemaker-production-defaults |
Create a SageMaker endpoint with autoscaling, alarms, and tagging by default |
| JavaScript | transformers-js |
Run Hugging Face models directly in JS/TS (browser or Node/Bun/Deno) |
| Project memory | agents-md-improver |
Audit project rules and propose targeted improvements |
| Project memory | agents-md-revise |
Capture durable session learnings in project rules |
code-explorer, code-architect, and code-reviewer are standalone skills and specialist roles used by feature-dev. OpenCode registers named least-privilege agents; Codex can carry out the same assignments with native subagents and can use matching custom agents when the user configures them.
Which Code Review Skill?
| Situation | Use | Why |
|---|---|---|
| PR, branch, commit range, or complete pending diff | code-review (Comprehensive Code Review) |
Freezes the scope, runs multiple review lenses, cross-checks candidates, and can post validated findings to GitHub when requested |
| One file, function, or small local change | code-reviewer (Focused Code Review) |
Uses a lighter two-pass review with full-file and caller context |
feature-dev quality phase |
code-reviewer (Focused Code Review) |
Acts as the focused specialist role dispatched by the feature workflow |
They are complementary rather than duplicate workflows. Codex shows distinct user-facing titles, Claude Code namespaces both under opencode-power-pack, and the stable skill IDs continue to work across every host. Start with code-review for merge decisions and code-reviewer for focused iteration.
Installation
Prerequisites
- Git
- Node.js 20.11.0 or newer, including npm/npx, for selective installation and the sandbox runner
- One supported host:
- A current Claude Code installation with plugin support: https://code.claude.com/docs/en/plugins
- OpenCode 1.18.7 or newer, including OpenCode 2: https://opencode.ai
- A current Codex CLI or Codex desktop environment with plugin support: https://developers.openai.com/codex/
- A current Pi coding agent installation: https://pi.dev/
Claude Code
Add the repository marketplace and install its plugin from inside Claude Code:
/plugin marketplace add waybarrios/opencode-power-pack
/plugin install opencode-power-pack@opencode-power-pack
Run /reload-plugins if prompted. Claude Code loads plugin skills from the repository-level skills/ directory and prefixes them with the plugin namespace, preventing collisions with built-in or separately installed skills. For local development, run claude --plugin-dir . from a clone of this repository.
Codex CLI And Desktop
Add this repository as a marketplace, then install the plugin:
codex plugin marketplace add waybarrios/opencode-power-pack --ref main
codex plugin add opencode-power-pack@opencode-power-pack
codex plugin list --marketplace opencode-power-pack
Start a new Codex session after installation so the fifty-five bundled skills are loaded. Use /plugins to inspect the installed plugin or $ to select one of its skills explicitly. Codex plugin packaging follows the official plugin structure.
For a smaller personal or repository-specific set, use the selective npm installer instead of the full plugin.
OpenCode From GitHub
On OpenCode 2:
opencode plugin add "opencode-power-pack@git+https://github.com/waybarrios/opencode-power-pack.git"
On OpenCode 1:
opencode plugin --global "opencode-power-pack@git+https://github.com/waybarrios/opencode-power-pack.git"
Restart OpenCode after installation. One plugin adapts to the host version: OpenCode 2 registers all fifty-five skills and the three specialist agents through the V2 plugin API, and OpenCode 1 keeps the original config.skills.paths and config.agent hook. Either way the skills are invocable by name and the three roles are registered as read-only subagents.
The compatibility smoke tests cover OpenCode 1.18.7, 2.0.14, and 2.0.32. The SKILL.md format stays the same across these hosts.
To pin a release, append its tag to the same spec. OpenCode 2 needs v0.6.0 or later, because v0.5.0 predates the V2 port:
opencode plugin add "opencode-power-pack@git+https://github.com/waybarrios/opencode-power-pack.git#<tag>"
OpenCode From A Local Clone
git clone https://github.com/waybarrios/opencode-power-pack.git ~/code/opencode-power-pack
opencode plugin add "opencode-power-pack@git+file:///home/you/code/opencode-power-pack"
Use an absolute file:// URL adjusted for your operating system. The target directory must be a Git repository. On OpenCode 1, replace plugin add with plugin --global as shown above.
Pi From GitHub
pi install git:github.com/waybarrios/opencode-power-pack
Pi installs the Git package and loads the skills/ directory declared in package.json. Use -l to save it to project settings instead of user settings. See the Pi package documentation for source, update, filtering, and trust behavior.
Pi can also narrow an installed package through pi config. The npm installer is useful when you want the same selected set to be discovered by Pi, Codex, and OpenCode from .agents/skills.
Verify Claude Code
From a local clone, validate both the plugin and marketplace manifests:
claude plugin validate . --strict
After marketplace installation, run /plugin and confirm that opencode-power-pack is enabled. Invoke /opencode-power-pack:code-review for a first test.
Verify OpenCode
Restart OpenCode, then check the registered skills and specialist agents.
On OpenCode 2:
opencode debug agents
The output should include code-explorer, code-architect, and code-reviewer as subagent entries. OpenCode 2 enforces their read-only restrictions when evaluating permission requests, so the agent listing can show the host's base permissions. In the TUI, the slash catalog should list /code-review, /feature-dev, /frontend-design, and the other bundled skills.
On OpenCode 1:
opencode debug skill
opencode debug agent code-explorer
The first command should include all fifty-five unprefixed skill names. The second should report a subagent with editing denied. In the TUI, ctrl+p should list /code-review, /feature-dev, /frontend-design, and the other skill-derived commands.
Verify Codex
codex plugin list --marketplace opencode-power-pack
The list should show opencode-power-pack as installed. Start a new session and explicitly select $code-review, $feature-dev, or another bundled skill for a first test.
Verify Pi
pi list
The package list should include the Git source for waybarrios/opencode-power-pack. Start a new Pi session after installation so its bundled skills are available.
Updating
For Claude Code:
/plugin marketplace update opencode-power-pack
/plugin update opencode-power-pack@opencode-power-pack
Run /reload-plugins if prompted.
For Codex:
codex plugin marketplace upgrade opencode-power-pack
codex plugin add opencode-power-pack@opencode-power-pack
Start a new session after the upgrade.
For Pi:
pi update git:github.com/waybarrios/opencode-power-pack
For an OpenCode GitHub installation on OpenCode 2:
opencode plugin update "opencode-power-pack@git+https://github.com/waybarrios/opencode-power-pack.git"
On OpenCode 1, reinstall with the same spec:
opencode plugin --global "opencode-power-pack@git+https://github.com/waybarrios/opencode-power-pack.git"
Restart OpenCode after the command finishes. Pass the exact configured package specification, including any pinned tag. Local-clone users should run git pull in the clone, then update using their original opencode-power-pack@git+file://... specification on OpenCode 2, or reinstall it on OpenCode 1.
Uninstalling
For Claude Code:
/plugin uninstall opencode-power-pack@opencode-power-pack
For Codex:
codex plugin remove opencode-power-pack@opencode-power-pack
For Pi:
pi remove git:github.com/waybarrios/opencode-power-pack
For OpenCode 2, remove the plugin from the global configuration:
opencode plugin remove "opencode-power-pack@git+https://github.com/waybarrios/opencode-power-pack.git"
Use your exact configured package specification if it differs from this example. Alternatively, delete the opencode-power-pack@... entry from the plugins array in the config where it was installed, then restart OpenCode. On OpenCode 1, delete the entry from the plugin array instead. There are no command symlinks or copied command files to remove.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
| Claude Code cannot add the marketplace | The checkout predates .claude-plugin/marketplace.json or the repository is inaccessible |
Update the checkout, verify repository access, and run claude plugin validate . --strict locally |
| Claude Code installed the plugin but a skill name conflicts | The unprefixed skill came from another source | Invoke the namespaced form, such as /opencode-power-pack:code-review |
| Codex cannot find the marketplace | Marketplace snapshot is missing or stale | Run codex plugin marketplace add waybarrios/opencode-power-pack --ref main, or upgrade the existing marketplace |
| Codex installed the plugin but skills do not appear | The current session predates installation | Start a new Codex session and inspect /plugins |
| Pi does not show the skills | Package is absent, disabled, or the session predates installation | Run pi list, inspect pi config, and start a new Pi session |
| Skills or commands do not appear | OpenCode is older than 1.18.7 | Upgrade OpenCode, restart, and check the slash catalog or run opencode debug skill |
| Skills are missing from the catalog | Plugin installation failed or its plugins entry is absent |
Reinstall with opencode plugin add <module-spec> (OpenCode 2) or opencode plugin --global <module-spec> (OpenCode 1) and inspect the reported error |
| Specialist agents are missing | Stale plugin checkout | Update the plugin, restart, and run opencode debug agents (OpenCode 2) or opencode debug agent code-explorer (OpenCode 1) |
| Installation reports a Git error | Invalid URL, network failure, or inaccessible repository | Validate the source with git ls-remote <url> |
| A workflow is rushed or incomplete |
…
Releases