Engineering standards for AI coding agents

A library of Agent Skills that tell a coding agent how to write and review code. Each skill is a SKILL.md file with numbered rules. A rule says what the code must do, shows a good and a bad example, and names the check a reviewer can run against the repository.

The library has two layers. The core pack works in any language and any stack, and stands on its own. A framework pack adds the rules of one framework on top of it. The library works in Claude Code, Antigravity and any other agent that reads the SKILL.md format.

What it does

• Writing. When you ask an agent to add an endpoint, a form or a migration, the pack's entry skill loads the rules that apply to that change, and the agent follows them.
• Review. When you ask for a review of a pull request, a commit or a branch, the pack's review skill loads the same rules and reports findings with a severity, the rule each one breaks and the failure it causes. A separate pass compares the change against the code as it stood before the ticket began, to find validation, authorization or edge-case handling that was lost.
• Detection first. The skills read your framework version, libraries and existing conventions before they judge anything. They do not flag NgModules in an Angular project that uses them, or a localStorage token in a project that stores tokens that way. They recommend a default only for new code and for projects with no convention.

Packs

Pack	For	Skills
core	Any language and any stack. Start here.	9
angular	Angular and TypeScript, through v22	8
nestjs	NestJS backends, TypeORM on PostgreSQL by example	7

Install core first. It works on its own in a project in any language, because review, code hygiene, comments, commit messages, regression checks and planning need no framework. It has no stack-specific standards for testing, security or persistence. Those come from the framework pack you add on top. Every installed skill's description loads at the start of a session, so a pack you do not use costs context for nothing. React and FastAPI packs are planned.

The core pack

The core pack covers the work every codebase repeats: reviewing a change, keeping it clean, commenting it, committing it and planning it. None of it depends on a framework, and the framework packs load these skills when they apply.

• One review entry point for any language. code-review obtains the change (a pull request, a commit, a branch or pasted code), loads the hygiene, structure, dead-code, comment and regression skills that apply, and reports findings ranked from 🔴 BLOCKER to ⚪ LOW. Each finding names the standard it breaks, or is labelled as engineering judgement.
• A regression pass against git history. historical-regression-check compares the whole change with the code as it stood before the ticket began, and finds lost validation, weakened authorization and dropped query conditions that a diff review misses.
• Dead-code reports that admit what they did not check. refactor-checker starts from the code you point to, traces references outward and grades its confidence. It never deletes anything.
• Comments that stay true. commenting-standards keeps comments to present-tense business rationale in JSDoc, TSDoc and Python docstring forms. An optional script bundled with it checks the mechanical rules over a whole diff in one run, so the agent writes no search of its own.
• Commit messages that match your repository. commit-message reads your history and tooling for a convention, falls back to Conventional Commits, and never runs git commit.
• Planning for work that spans sessions. plan-tracker-flow and prd-implementation-planner keep a long task or a requirements document tied to the code.

Install

Any agent, with the skills CLI

The skills CLI installs into Claude Code, Antigravity, Codex, Cursor, Gemini CLI, GitHub Copilot and many other agents.

# pick skills interactively, grouped by pack
npx skills add Yogndrr/engineering-standards

# or install one pack
npx skills add https://github.com/Yogndrr/engineering-standards/tree/main/skills/core
npx skills add https://github.com/Yogndrr/engineering-standards/tree/main/skills/angular
npx skills add https://github.com/Yogndrr/engineering-standards/tree/main/skills/nestjs

Add -g to install for your user account instead of the current project.

Claude Code plugins

/plugin marketplace add Yogndrr/engineering-standards
/plugin install core@engineering-standards
/plugin install nestjs@engineering-standards

Plugin skills run under the plugin's name, for example /nestjs:nestjs-testing.

Manual copy

Copy each skill folder (the folder that holds SKILL.md, such as skills/nestjs/nestjs-testing) into your agent's skills directory. Put the skill folders directly in that directory, without the core, angular or nestjs folder around them.

Agent	Project directory	User directory
Claude Code	.claude/skills/	~/.claude/skills/
Antigravity	.agents/skills/	~/.gemini/antigravity/skills/
Codex	.agents/skills/	~/.agents/skills/
Cursor	.agents/skills/	~/.cursor/skills/
Gemini CLI	.agents/skills/	~/.gemini/skills/
GitHub Copilot	.agents/skills/	~/.copilot/skills/

The skills CLI documents the directory for every other agent it supports.

Using the skills

Start from the entry skills. Name them in a prompt, or let the agent pick them from their descriptions.

• angular-guidelines and nestjs-guidelines apply while you write code. They route to the other skills in the pack.
• code-review applies when you ask for a review of a project in any language. angular-code-review and nestjs-code-review apply to their own stacks and take precedence over it there. Each is a single entry point and loads its own criteria.

Example prompts:

• "Add a search autocomplete for project members to this page."
• "Add an endpoint that lists invoices for a project."
• "Review the changes on this branch."
• "Draft a commit message for what I just changed."

Skill catalogue

Core

Skill	What it does
code-review	Entry point for review in any language. Obtains the change, loads the hygiene, structure, dead-code, comment and regression skills that apply, and reports ranked findings.
code-hygiene	Checks that a change does what was asked and leaves the code clean: requirement traceability, exhaustive handling of enum states, dates and money, dead code, type strictness and debug residue.
code-structure	Decides where shared logic belongs when several features repeat the same mechanics.
commenting-standards	Comment and doc-comment rules: timeless business rationale, no boilerplate narration, no change history, length limits and tracked TODOs, in JSDoc, TSDoc and Python docstring forms. Ships an optional checker for the mechanical rules (Node.js 18 or later).
commit-message	Drafts a commit message that follows the repository's convention, or Conventional Commits. It never commits.
historical-regression-check	Compares a change with the earlier implementation to find lost validation, weakened authorization and dropped query conditions.
plan-tracker-flow	A plan document and a tracker document for work that spans several sessions.
prd-implementation-planner	Compares a product requirements document with the code, then produces an audit or a build plan.
refactor-checker	Investigates whether code you point to is dead or redundant. It reports and never edits.

Angular

Skill	What it does
angular-guidelines	Entry point for writing. File organization, architecture style, injection, control flow, RxJS and signals, component and service roles, change detection cost, and keeping client models in step with the API.
angular-code-review	Entry point for review.
angular-accessibility	WCAG 2.2 Level AA for templates: accessible names, error association, live regions, keyboard operation, the combobox pattern and focus management.
angular-forms-and-autocomplete	Reactive forms, server-side search, select versus autocomplete, value integrity, dependent controls and submit behaviour.
angular-ui-state-and-error-handling	The loading, error, empty and populated states, error branching on status and code, and where error handling lives.
angular-network-and-async	Typed HttpClient calls, debounced and switched searches, stale responses, retries, timeouts, subscription teardown and interceptors.
angular-security	Sanitization, open redirects, token storage, CSRF configuration, secrets in the bundle and client logs.
angular-testing	The test level for each kind of unit, timing tests with fake clocks, and HttpTestingController.

NestJS

Skill	What it does
nestjs-guidelines	Entry point for writing. Route naming, versioning, status codes, parameter pipes, query projection, response payloads and exceptions.
nestjs-code-review	Entry point for review.
nestjs-architecture	Modules, layering, guards and filters, validation, configuration, async discipline, outbound timeouts and retries.
nestjs-api-contracts	DTO typing, pagination, filter allow-lists, field exposure, status codes, the error envelope and compatibility.
nestjs-security-and-authorization	Authentication, object-level authorization inside the query, injection, uploads, CSRF, rate limiting, SSRF and headers.
nestjs-data-integrity-and-persistence	Constraints, transactions, lost updates, indexes, bounded queries, soft delete and migrations.
nestjs-testing	The test level for each kind of unit, denial-path tests, and real-database tests for rollback and concurrency.

Library defaults

When a project has no convention of its own, the skills recommend these defaults, worded the same in every pack:

• camelCase on the wire for bodies, route params and query keys, with kebab-case route paths;
• a {code, message, details[]} error envelope, where clients branch on code and never on message text;
• one pagination envelope, { items, total, page, pageSize }, with search on the server;
• no automatic retry of a non-GET request unless the endpoint honours an idempotency key;
• soft delete decided per entity and applied to every query on that entity;
• WCAG 2.2 Level AA;
• an httpOnly cookie plus CSRF protection for token storage on new projects.

A project that already does something else keeps it, and the skills do not flag existing code that follows it.

Contributing

Read CONTRIBUTING.md first. Run bash scripts/validate.sh before you open a pull request. Everyone who takes part follows the Code of Conduct. Report a skill that gives unsafe advice through the private channel in SECURITY.md.

License

MIT