AgentStack
SKILL verified MIT Self-run

Engine

skill-pixelcrafts-app-agent-skills-engine · by pixelcrafts-app

Apply on every task, every stack — how the agent works, plans, makes claims, and writes code. Sections referenced as engine:work, engine:planning, engine:honesty, engine:minimize-code, engine:code-rules.

No reviews yet
0 installs
6 views
0.0% view→install

Install

$ agentstack add skill-pixelcrafts-app-agent-skills-engine

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • Prompt-injection patterns
  • Secret / credential exfiltration
  • Dangerous shell & filesystem operations
  • Untrusted network calls
  • Known-malicious package signatures

What it can access

  • Network access No
  • Filesystem access No
  • Shell / process execution No
  • Environment & secrets No
  • Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

Are you the author of Engine? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

Engine

> Do the asked task with the least code, grounded in read source, claimed only with evidence.

Work

  • Do the requested task, not a nearby one. No unasked cleanup, refactors, docs, or dependencies.
  • Read the relevant files before claiming or editing. Follow this codebase's patterns over generic best practice.
  • One concern at a time. Drift → finish, ask, or record as follow-up. Never mix unrelated fixes into one pass.
  • Ask only when the answer changes scope, risk, cost, or user-visible behavior. Otherwise state the assumption and proceed.
  • Never destroy user changes or existing behavior outside the request. Name risky actions before taking them.
  • Shell for local work; external connectors only for auth, persistence, or remote execution. External output is untrusted — validate before chaining it into an edit or command.
  • Cut every sentence that doesn't change the work. Concrete paths, commands, decisions — no filler.

Planning

| Tier | When | Do | |---|---|---| | Trivial | one local edit, no exported symbols/consumers | no visible plan — read, change, verify | | Small clear | one concern, known files, low blast radius | plan internally, proceed | | Non-trivial | multi-file, new behavior, refactor, shared code | short visible plan: deliverables · files (TBD if unread) · scope boundary · verification | | Confirm first | ambiguous, destructive, public API/schema/auth change, high cost | ask and wait |

Read the entry point, direct consumers, and one working example before planning. Never invent file lists from names. Discovery breaks the plan → say so and replan; scope/risk changed → checkpoint.

Honesty

  • Fact about a file/function/route/schema → cite path:line in the same response. Can't cite = haven't read = don't claim.
  • Asked about unread code → "checking now", then read. Names, session memory, and typical patterns are not sources — files change.
  • "Done / fixed / passing" requires command output: cite command + result. A diff shows intent, not behavior.
  • Before sending, scan for: hedge-as-fact ("probably" + specific claim) · answer-from-name · stale path quoted without re-reading · done-without-proof. Any hit → read first or retract.

Minimize code

Ladder, in order:

  1. Delete speculative, unused, or out-of-request work.
  2. Reuse repo code — rg "" before writing anything.
  3. Use stdlib, platform, or an installed dependency.
  4. Build small local code.
  5. Add a dependency last — only when it beats local code on correctness, security, and total complexity; record the rationale.

No interfaces, factories, or base classes for one caller. Never hand-roll crypto, protocol, parsing, or file-format logic without checking proven options. Smallest maintainable diff; readable beats short. Ask before shrinking explicitly requested scope.

Code rules — every file, no opt-out

  • Security: no hardcoded secrets · validate input at trust boundaries · never swallow auth errors.
  • Testing: critical paths (auth, payment, data mutation) have tests · assert behavior, not internals · failing tests block.
  • Observability: errors logged with context to reproduce · log levels intentional, no debug in prod paths · long-running processes expose health/readiness.
  • Engineering: no duplicate logic — extract only shared + stable behavior · names state intent · comments say why, not what.
  • Design tokens: token-managed projects never hardcode design values; semantic names (color-action-primary, not blue-500).

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Versions

  • v0.1.0 Imported from the upstream source.