mizchi/skills
Dozens of mizchi's agent skills: frontend audits, AWS, Cloudflare, SQL, Playwright and OpenTelemetry, installed one by one
- 419 ★ on the repository
- Last commit
Extended access
Why this level
- Some skills run `gh`, `cf`, `aws-vault` and audit scripts that need access to repositories and cloud accounts
- Deployment skills change Cloudflare and AWS infrastructure on your command
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/mizchi-skillsDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Some skills run `gh`, `cf`, `aws-vault` and audit scripts that need access to repositories and cloud accounts
- Deployment skills change Cloudflare and AWS infrastructure on your command
This is third-party code. Review the repository files before installing.
What it does
mizchi/skills is a collection of standalone skills in the Agent Skills format (agentskills.io), each in its own folder with a `SKILL.md` and its own README. Skills install one at a time through APM with `apm install -g mizchi/skills/<skill-name>`, through `npx skills add mizchi/skills --skill <skill-name>` or by copying the folder. They fit Claude Code, Codex, opencode, Gemini CLI and Cursor. Topics come in groups. The frontend audit set covers project triage, CI, code hygiene, dependencies, testing, security, state, performance and a weekly roll-up run. Alongside sit skills for Node.js and SQLite with `sqlite-vec`, AWS (ECS blue/green, GitHub Actions OIDC, `aws-vault`), Cloudflare (Workers, Access, telemetry), SQL linting and query plan audits, MoonBit, Gleam, Playwright, StrykerJS, OpenTelemetry, Nix, `just` and `dotenvx`. One group covers working with agents itself: choosing a topology for several agents, iterative prompt tuning, turning mistakes into `ast-grep` and CLAUDE.md rules, finding and picking skills and publishing your own. The repository also holds the `waxa` CLI for evaluating skills, run with `npx @mizchi/waxa`.
Who it is for. Frontend and infrastructure engineers who want ready-made working procedures for an agent: project audits, CI tuning, AWS, Cloudflare and SQLite.
Good fit when
- You face an initial audit of someone else's frontend: triage, CI, dependencies with CVE triage, testing and security
- An agent fixes failing GitHub Actions checks through `gh` and can use the `gh-fix-ci` skill
- You deploy a Cloudflare Worker with rollback on a smoke test failure or put an app behind Cloudflare Access
- On Node 24 and newer you need to combine `node:sqlite` with the `sqlite-vec` extension
Not a fit when
- Your stack is different: the collection leans on the author's own stacks, MoonBit, Gleam and Cloudflare
- You want to install every skill at once: the collection is meant for picking skills one at a time per task
- You need the rules in Russian: skill texts are in English, some in Japanese
Example request
Run an initial frontend audit of this repository with the frontend-review-triage skill and name the top three risksLimitations
- Installing through APM requires Microsoft's Agent Package Manager; without it, skills install with `npx skills add` or by copying the folder.
- Some skills depend on neighbors: `maintainer-persona` calls `ai-index`, `natural-writing-ja` and `natural-writing-en`, and `vlmkit` routes to sub-skills in a separate repository.
- `mizchi-blog-style` and `chezmoi-management` describe the author's personal writing style and dotfiles and are of little use in other projects.
- The AI self-pentest section of the frontend security skill walks through common vulnerability patterns as a checklist and does not attack a network.
How to disable. Delete the unwanted skill's folder from the agent's skills directory, for example `~/.claude/skills/`. A skill installed through APM is removed with APM itself.
FAQ
How do I install one skill from mizchi/skills?
Run `apm install -g mizchi/skills/<skill-name>`, for example `frontend-review-triage`. Without APM, use `npx skills add mizchi/skills --skill <skill-name>` or copy the skill folder into the agent's skills directory.
Which agents do the skills work with?
With any agent that reads the Agent Skills format: Claude Code, Codex, opencode, Gemini CLI, Cursor and others. APM is only needed for one-command install.
What is in the frontend audit set?
Nine skills: triage, CI, code hygiene, dependencies, testing, security, state, performance and a weekly roll-up run. The roll-up uses expert sub-skills for frontend, React, performance, security and operations.
Which Cloudflare skills are there?
Deploying Workers through `cf` and typed configuration, deployment with rollback on a failed check, Cloudflare Access setup with a policy and service token, OTLP telemetry and building a Worker from MoonBit with a TypeScript entry.
What is waxa?
A CLI for evaluating skills, kept in `tools/waxa` and published as `@mizchi/waxa`. You run it with `npx @mizchi/waxa`, and `skill-finder` uses it as a mandatory gate before adopting a skill.
Discussion
No questions or reviews yet.
Related
SkillsBuilder Skills
Skills for agents
A set of small skills from Builder.io for agent work habits: visual plans and diff recaps, docs-first checks, cross-agent review and clean status updates
skills-npm links agent skills shipped in your dependencies in node_modules and listed in the skills field of package.json
Tech Leads Club Agent Skills
Agent Skills
A vetted skill registry with a CLI that installs into twenty-plus agents and an MCP server for on-demand skill lookup
The author's personal set: shared agent rules and dozens of skills for GitHub, the browser, macOS, messaging and releases, plus a sync script
my-skills by akitaonrails
akitaonrails my-skills
Fabio Akita's personal set of 24 skills for Claude Code, Codex and opencode: releases, PR audits, security and fact-checking
A set of independent skills against drift in large codebases: hard-cut, root-cause tracing, lean testing and CI right-sizing.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| mizchi/skills (this card) | no | 419 | |
| Mindrally skills collection | no | 297 | over two hundred code rules per framework and language from Cursor rules, while mizchi's skills center on audit and deployment procedures |
| Designer Skills Collection | no | 3,252 | a set of design skills for research, UX and interfaces, while mizchi's collection targets frontend engineering and infrastructure |
README in short
The page briefly explains the format and install options, then lists skills in tables by group: frontend, Node.js, AWS, Cloudflare, SQL, languages, testing, AI, formal methods, tooling, DevOps and process. It ends with the `waxa` CLI for evaluating skills.
README badge
Original SKILL.md
---
name: frontend-review-triage
description: Use when starting a frontend review engagement or when the user asks for an initial assessment ("triage", "day 0", "what's the state of this repo"). Reads package.json, README, gh issues, and produces a scorecard covering lockfiles, TypeScript strictness, testing, CI, and known issues. Runs `scripts/audit-triage.sh`.
---
# Frontend Review — Triage
You are performing Day 0 triage for a frontend consulting engagement. Your job is to produce a short, honest scorecard of the repository's current state, not to recommend fixes. Recommendations come later from the other `frontend-review-*` skills.
## Procedure
0. **Classify the app** before running any script.
- Ask the user (or infer from README / package.json) which app type applies:
`admin` / `toc` / `btob-saas` / `ec` / `fintech` / `healthcare` / `iot-ops` / `media`
- Note any regulatory context (GDPR, PCI DSS, HIPAA, …) and authentication requirements.
- Read `checklist/00-app-classification.md` Step 3 to determine which security, performance, TypeScript strictness, lint, coverage targets, and dependency freshness checks are P0 vs P1 vs skip for this app type.
- Save the result to `<client-repo>/.frontend-review/kpi/app-classification.json`.
1. Run `scripts/audit-triage.sh --repo <client-repo>` where `<client-repo>` is the absolute path to the user's repository.
2. Read the resulting JSON at `<client-repo>/.frontend-review/report/latest/raw/triage.json`.
3. Also quickly skim:
- `package.json` — dependencies, scripts, engines
- `README.md` — is it up-to-date, does it describe how to run things
- `.github/workflows/` — which workflows exist
- `gh issue list --state open --limit 20 --json number,title,labels` — what's already flagged
4. Cross-reference against `checklist/12-known-issues.md` for the "known issues" collection routine.
## Output
Write a Markdown report to `<client-repo>/.frontend-review/report/latest/md/triage-scorecard.md` with:
- **App classification** — type ID and key domain notes (1–3 lines)
- **Priority overrides** — which P0 security/perf checks apply to this app type
- **Scorecard table** (copy from `raw/triage.json` and annotate)
- **Top 3 risks** — what would you fix first? Flag whether each risk is P0 or P1 per the classification matrix.
- **Open questions** for the client (things you can't tell from the code)
- **Next phase** — which `checklist/` items the Week 1 plan should target, ordered by the classification priority
Keep the entire report under 400 lines. If you find yourself writing more, you're analyzing instead of triaging.
## Boundaries
- Do NOT propose fixes beyond a short "top 3 risks" section. Each risk is one sentence.
- Do NOT run any other `audit-*.sh` script — leave those for the domain-specific skills.
- Do NOT modify any files outside `<client-repo>/.frontend-review/`.
- Do NOT push commits or create PRs in the client repo.
## Reference
- Checklist: `checklist/00-app-classification.md`, `checklist/12-known-issues.md`, `checklist/01-package-manager.md`, `checklist/02-dependencies.md`
- Phase: `phase/day-0-triage.md`