mirror of
https://github.com/personamanagmentlayer/pcl.git
synced 2026-09-14 15:40:22 +08:00
4e07a6a874
* chore(stdlib): add conformance tooling for the skills library
The library had no gate that could express what a valid skill is, so
malformed frontmatter, over-budget files and credential literals went
unnoticed. These scripts define and enforce that contract.
- validate-skills.py: extend with Agent Skills v1.0 conformance -
naming rules and directory agreement, an explicit activation trigger
in the description, canonical layout, the 500-line SKILL.md budget,
relative-link integrity, and two security rules (no unrestricted
Bash(*) grant, no credential literals). Structural checks now read a
skill as a whole so material moved into references/ still counts.
- split-skill-references.py: move the heaviest sections of an oversized
SKILL.md into references/. Verifies line by line that every source
line lands in exactly one output and refuses to write otherwise.
- generate-skill-inventory.py: derive SKILLS_INVENTORY.md and
DIRECTORY_STRUCTURE.md from the tree so they cannot drift.
- generate-skill-catalog.py: index the canonical layout only, count
references/ toward a skill's size, and stop truncating descriptions
at 200 characters - the catalog is the discovery surface and must
carry the activation trigger.
- .gitignore: Python bytecode from these scripts, and local .pcl state.
Reviewed-by: Security Analyst, Compiler Engineer, DevX Engineer
* fix(stdlib): bring all 174 skills to Agent Skills v1.0 conformance
No skill in the library was conformant. 41 of 175 failed the existing
validator outright, and none satisfied the spec. This pass fixes the
tree and records the result. See stdlib/CHANGELOG.md for the per-skill
versioning and migration notes.
BREAKING CHANGE: one skill removed, five moved, seven with a capability
withdrawn. Library version 2.0.0 -> 3.0.0.
Structure
- Convert 71 skills stored as flat files to <category>/<name>/SKILL.md,
the layout the spec requires and the only one able to carry companion
resources.
- Rename 5 directories that disagreed with their declared name:, so
resolution by path and by name stop giving different answers. The
repository docs already referenced the corrected paths.
- Merge the duplicate legal-technology skills into legaltech-expert and
delete legal-tech-expert, carrying over everything the survivor
lacked.
Metadata
- Repair 20 unparseable frontmatters: an H1 preceded the --- block and
the key was skill_id: instead of name:, so any parser reading
frontmatter at offset 0 saw no metadata at all. The objectives,
prerequisites and outcome they carried become real body sections.
- Add the missing version: to 21 skills, fold keywords into tags, move
expertise_level under metadata, and align 10 category: values with
their directory.
Discoverability
- Give all 174 descriptions an explicit "Use when ..." trigger, built
from each skill's own tags and section headings. 152 previously said
only what the skill was about, leaving an agent nothing to match on.
Progressive disclosure
- Split 127 oversized skills, moving bulk material into references/ read
on demand and leaving an index behind. A SKILL.md now averages 277
lines instead of 644 and none exceeds 500. Verified lossless line by
line against the previous revision.
Security
- Withdraw the unrestricted Bash(*) grant from 7 skills; none of the six
non-financial ones contained a single shell command. finance-expert
documents code that charges cards and reads bank accounts, so it now
grants no shell at all.
- Remove credential literals: Stripe keys, two JWT signing keys, an
Express session secret, a Redis password and WiFi credentials, all
inlined in examples. They load from the environment now.
- finance-expert: idempotency keys were documented but absent, so a
retry double-charged; webhook signature failures were not caught, so a
forged event raised uncaught instead of being rejected;
int(amount * 100) truncated fractions of a cent. All fixed, plus a
money-movement guardrails section.
- trading-expert: place_order routed without any pre-trade risk check
although a RiskManager sat unused in the next section. Risk validation
now runs before routing and raises rather than returning a boolean a
caller can ignore; live routing is opt-in.
- Correct an Ansible Vault example that showed plaintext under an
"encrypted" label.
Also fixes 8 broken documentation links and a prematurely closed code
fence in skill-creator-expert that leaked template content into prose.
Per the repository file-organization policy, four stale progress reports
(SKILLS_MANIFEST, COMPLETE_SKILLS_LIBRARY, COMPLETE_LIBRARY_MANIFEST,
PHASE_3_DATA_ANALYTICS) move out of stdlib/ into the gitignored
.roadmap/status/stdlib/; they claimed 31 of 100 skills complete. They
appear here as deletions because .roadmap/ is not tracked.
Reviewed-by: Security Analyst, Language Designer, DevX Engineer,
Documentation Specialist
* fix(skills): resolve standard library skills from their real layout
No stdlib skill was resolvable. SkillResolver looked for
`<stdlibDir>/<name>.md` with stdlibDir defaulting to `stdlib/skills`, a
directory that does not exist, and the path ignored the category level
the library actually uses. The two LSP providers had the same wrong
directory and scanned only one level deep, so neither completion nor
go-to-definition could see a skill either.
- skill-discovery.ts: enumerate skill entry points across the shapes in
use - a flat `<name>.md`, `<name>/SKILL.md`, and
`<category>/<name>/SKILL.md` - while skipping references/, scripts/
and assets/, which hold supporting material rather than entry points.
- skill-resolver.ts: point stdlibDir at `stdlib`, and look the name up
as a directory under any category as well as the two legacy shapes, so
existing custom stdlib directories keep working. The name is used as a
single path segment and rejected if it contains a separator or
traversal, so a reference cannot escape the stdlib root.
- Rewire both LSP providers onto the shared discovery helper.
Tests: 13 new cases covering the layouts, ordering, the references/
exclusion, path-traversal rejection, and an integration test that
resolves real shipped skills by bare name.
Reviewed-by: Compiler Engineer, Runtime Architect, Security Analyst
* feat(stdlib): add 17 skills covering the library's largest gaps
Selection was driven by cross-referencing coverage against observed usage
rather than by intuition: Stack Overflow and GitHub Octoverse data for
which technologies matter, and install rankings on public agent-skill
registries for the shape of skills people actually use.
That comparison found a mismatch of form, not only of coverage. The
most-installed skills in the ecosystem are procedures - tdd, refactoring,
frontend design, browser automation - while all 174 existing skills were
domain knowledge shaped as <domain>-expert. The new workflows/ category
closes that gap and introduces the <activity>-workflow convention.
New category workflows/ (4)
- tdd-workflow, refactoring-workflow, debugging-workflow,
code-review-workflow. code-review-workflow complements rather than
replaces code-review-expert: procedure versus judgement. Merge them if
the split proves confusing in use.
Applied AI (3) - the largest coverage gap
- llm-engineering-expert, rag-expert, agent-engineering-expert.
The library referenced LLMs in tags but covered none of it: pgvector
appeared zero times across 174 skills, LangChain once, MCP twice
despite the repository shipping an MCP integration guide.
Capabilities (2)
- document-processing-expert (PDF, DOCX, XLSX, PPTX in one skill),
browser-automation-expert (a client against third-party sites,
distinct from playwright-expert which tests your own application).
Data (3)
- mysql-expert, the second most used database and previously absent
while rarer stores had skills; analytical-databases-expert;
stream-processing-expert.
Security (3)
- secrets-management-expert, supply-chain-security-expert (OWASP A03
2025), identity-access-expert (OWASP A01).
Interface and meta (2)
- accessibility-expert: design/ held only design-expert, which despite
its name covers software architecture, so WCAG had no home.
- skill-router: find and compose skills across 191, with a
disambiguation table for overlapping pairs.
Grouping by decision context rather than by technology keeps the growth
to 17 skills for roughly 50 topics. Five vector stores live inside
rag-expert; four document formats inside document-processing-expert.
Per-tool depth sits in references/, which the progressive-disclosure work
in 3.0.0 made cheap.
Four further gaps are better served by extending existing skills -
PyTorch and TensorFlow in ml-expert, OpenTelemetry in monitoring-expert,
Pulumi and Crossplane in terraform-expert - and are not in this change.
Library 3.0.0 -> 3.1.0, additive only. Adds the workflows label to the
inventory generator; catalogue, inventory, structure and CHANGELOG
regenerated.
Reviewed-by: Product Strategist, Security Analyst, DevX Engineer,
Documentation Specialist
* fix(test): create test directories with mkdtempSync
CodeQL flagged js/insecure-temporary-file (CWE-377) on both suites.
`join(tmpdir(), <predictable name>)` followed by mkdirSync creates a
world-readable directory at a guessable path, so another local user can
pre-create it or plant a symlink between the name being computed and the
directory being created.
mkdtempSync creates the directory atomically with a random suffix and
0700 permissions, which closes both the disclosure and the race.
One occurrence is new in this branch (skill-discovery); the other
pre-dates it in skill-resolver and is fixed in the same pass rather than
left as a known finding in a file this branch already touches.
9.3 KiB
9.3 KiB
name, version, description, category, tags, allowed-tools
| name | version | description | category | tags | allowed-tools | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| kotlin-expert | 1.1.0 | Expert-level Kotlin development, Android, coroutines, and multiplatform. Use when the user mentions Android, coroutines, multiplatform, or JVM, or when the task involves Kotlin Fundamentals, Android Development, Kotlin Multiplatform, or Kotlin Style. | languages |
|
|
Kotlin Expert
Expert guidance for Kotlin development, Android, coroutines, Kotlin Multiplatform, and modern JVM development.
Core Concepts
Kotlin Fundamentals
- Null safety
- Extension functions
- Data classes
- Sealed classes
- Coroutines and Flow
- Higher-order functions
Android Development
- Jetpack Compose
- ViewModel and LiveData
- Room database
- Retrofit networking
- Dependency injection (Hilt)
- Android lifecycle
Kotlin Multiplatform
- Shared business logic
- Platform-specific implementations
- iOS and Android targets
- Common module architecture
Modern Kotlin Syntax
// Data classes
data class User(
val id: String,
val name: String,
val email: String,
val createdAt: LocalDateTime = LocalDateTime.now()
)
// Sealed classes for type-safe states
sealed class Result<out T> {
data class Success<T>(val data: T) : Result<T>()
data class Error(val exception: Exception) : Result<Nothing>()
object Loading : Result<Nothing>()
}
// Extension functions
fun String.isValidEmail(): Boolean {
return this.contains("@") && this.contains(".")
}
// Scope functions
fun processUser(user: User) {
user.run {
println("Processing user: $name")
// 'this' refers to user
}
user.let { u ->
// 'it' or custom name refers to user
println(u.email)
}
user.apply {
// Modify properties
// Returns the object
}
}
// Null safety
fun findUser(id: String): User? {
return database.find(id)
}
val user = findUser("123")
val name = user?.name ?: "Unknown" // Elvis operator
user?.let { println(it.name) } // Safe call with let
// When expression
fun getUserStatus(user: User): String = when {
user.isActive && user.isPremium -> "Premium Active"
user.isActive -> "Active"
else -> "Inactive"
}
Coroutines and Flow
import kotlinx.coroutines.*
import kotlinx.coroutines.flow.*
class UserRepository {
private val api: UserApi
// Suspend function
suspend fun fetchUser(id: String): User {
return withContext(Dispatchers.IO) {
api.getUser(id)
}
}
// Flow for reactive streams
fun observeUsers(): Flow<List<User>> = flow {
while (true) {
val users = fetchUsers()
emit(users)
delay(5000) // Refresh every 5 seconds
}
}.flowOn(Dispatchers.IO)
// StateFlow for state management
private val _users = MutableStateFlow<List<User>>(emptyList())
val users: StateFlow<List<User>> = _users.asStateFlow()
suspend fun refreshUsers() {
_users.value = fetchUsers()
}
}
// Coroutine scopes
class UserViewModel : ViewModel() {
private val repository = UserRepository()
fun loadUsers() {
viewModelScope.launch {
try {
val users = repository.fetchUser("123")
// Update UI
} catch (e: Exception) {
// Handle error
}
}
}
// Parallel execution
suspend fun loadMultipleUsers(ids: List<String>): List<User> {
return coroutineScope {
ids.map { id ->
async { repository.fetchUser(id) }
}.awaitAll()
}
}
// Flow transformation
fun searchUsers(query: String): Flow<List<User>> {
return repository.observeUsers()
.map { users -> users.filter { it.name.contains(query, ignoreCase = true) } }
.distinctUntilChanged()
.debounce(300)
}
}
Android Jetpack Compose
import androidx.compose.foundation.layout.*
import androidx.compose.material3.*
import androidx.compose.runtime.*
import androidx.compose.ui.Modifier
@Composable
fun UserListScreen(viewModel: UserViewModel = viewModel()) {
val users by viewModel.users.collectAsState()
val isLoading by viewModel.isLoading.collectAsState()
Scaffold(
topBar = { TopAppBar(title = { Text("Users") }) }
) { padding ->
if (isLoading) {
CircularProgressIndicator(
modifier = Modifier.fillMaxSize()
)
} else {
LazyColumn(
modifier = Modifier.padding(padding)
) {
items(users) { user ->
UserCard(user = user)
}
}
}
}
}
@Composable
fun UserCard(user: User) {
Card(
modifier = Modifier
.fillMaxWidth()
.padding(8.dp)
) {
Column(modifier = Modifier.padding(16.dp)) {
Text(
text = user.name,
style = MaterialTheme.typography.headlineSmall
)
Text(
text = user.email,
style = MaterialTheme.typography.bodyMedium
)
}
}
}
Room Database
import androidx.room.*
import kotlinx.coroutines.flow.Flow
@Entity(tableName = "users")
data class UserEntity(
@PrimaryKey val id: String,
@ColumnInfo(name = "name") val name: String,
@ColumnInfo(name = "email") val email: String,
@ColumnInfo(name = "created_at") val createdAt: Long
)
@Dao
interface UserDao {
@Query("SELECT * FROM users")
fun getAllUsers(): Flow<List<UserEntity>>
@Query("SELECT * FROM users WHERE id = :userId")
suspend fun getUserById(userId: String): UserEntity?
@Insert(onConflict = OnConflictStrategy.REPLACE)
suspend fun insertUser(user: UserEntity)
@Update
suspend fun updateUser(user: UserEntity)
@Delete
suspend fun deleteUser(user: UserEntity)
@Query("DELETE FROM users WHERE id = :userId")
suspend fun deleteUserById(userId: String)
}
@Database(entities = [UserEntity::class], version = 1)
abstract class AppDatabase : RoomDatabase() {
abstract fun userDao(): UserDao
companion object {
@Volatile
private var INSTANCE: AppDatabase? = null
fun getDatabase(context: Context): AppDatabase {
return INSTANCE ?: synchronized(this) {
val instance = Room.databaseBuilder(
context.applicationContext,
AppDatabase::class.java,
"app_database"
).build()
INSTANCE = instance
instance
}
}
}
}
Dependency Injection with Hilt
import dagger.Module
import dagger.Provides
import dagger.hilt.InstallIn
import dagger.hilt.components.SingletonComponent
import javax.inject.Singleton
@Module
@InstallIn(SingletonComponent::class)
object NetworkModule {
@Provides
@Singleton
fun provideRetrofit(): Retrofit {
return Retrofit.Builder()
.baseUrl("https://api.example.com")
.addConverterFactory(GsonConverterFactory.create())
.build()
}
@Provides
@Singleton
fun provideUserApi(retrofit: Retrofit): UserApi {
return retrofit.create(UserApi::class.java)
}
}
@HiltAndroidApp
class MyApplication : Application()
@AndroidEntryPoint
class MainActivity : ComponentActivity() {
@Inject lateinit var repository: UserRepository
}
Kotlin Multiplatform
// commonMain
expect class Platform() {
val name: String
}
expect fun platformSpecificFunction(): String
// androidMain
actual class Platform actual constructor() {
actual val name: String = "Android ${android.os.Build.VERSION.SDK_INT}"
}
actual fun platformSpecificFunction(): String = "Android implementation"
// iosMain
actual class Platform actual constructor() {
actual val name: String = UIDevice.currentDevice.systemName()
}
actual fun platformSpecificFunction(): String = "iOS implementation"
// Shared business logic
class UserService {
suspend fun fetchUser(id: String): User {
// Shared logic works on all platforms
return api.getUser(id)
}
}
Best Practices
Kotlin Style
- Use val over var when possible
- Leverage null safety features
- Use data classes for DTOs
- Prefer extension functions
- Use sealed classes for type-safe states
- Follow naming conventions
Coroutines
- Use appropriate dispatchers (IO, Main, Default)
- Handle cancellation properly
- Avoid GlobalScope
- Use structured concurrency
- Prefer Flow over LiveData
- Use StateFlow for state
Android
- Follow MVVM architecture
- Use Jetpack Compose for UI
- Implement proper lifecycle handling
- Use dependency injection
- Handle configuration changes
- Implement proper error handling
Anti-Patterns
❌ Using !! (non-null assertion) ❌ GlobalScope.launch ❌ Blocking main thread ❌ Not handling coroutine cancellation ❌ Tight coupling ❌ God classes ❌ Ignoring memory leaks
Resources
- Kotlin Docs: https://kotlinlang.org/docs/
- Android Developers: https://developer.android.com/kotlin
- Kotlin Coroutines: https://kotlinlang.org/docs/coroutines-overview.html
- Jetpack Compose: https://developer.android.com/jetpack/compose