Developer skills, hooks, and conventions for the One Project common monorepo.
Authorization via the access-zones library and our wrappers (assertAccess, checkPermission, AccessBoundary). Triggers when adding or modifying a tRPC procedure, server action, service-layer function, or route that needs permissions — and when gating UI on the client. Trigger phrases — "permission", "permissions", "role", "roles", "admin", "access", "authorize", "authorization", "can the user", "is admin", "profile admin", "assertAccess", "checkPermission", "AccessBoundary", "access-zones", "decisions zone", "profile zone".
Talk to Asana directly via the REST API — preferred over the Asana MCP because the token and project IDs come from .env.local (deterministic, no per-machine MCP install). Triggers when reading or updating tasks in our task project. Trigger phrases — "asana", "asana task", "task gid", "list tasks", "asana comment", "asana custom field", "asana api", "app.asana.com", "$ASANA_API_KEY", "$ASANA_PROJECT_ID".
Branching and pull-request workflow. Triggers before any commit or push, and when opening a PR. Trigger phrases — "commit", "push", "open a PR", "pull request", "feature branch", "branch name", "gh pr create", "git push", "rebase onto dev", "merge dev", "force push", "release".
React component file organization — type placement, main export location, helper location. Triggers when creating a new .tsx file, splitting a large component, extracting a helper, or moving types. Trigger phrases — "new component", "create a component", "refactor this component", "where to put", "file structure", "component file", "extract helper", "split component".
Local development environment — Docker stack, port layout (apps/app on 3100, API on 3101/3300, Supabase on 3121/3122/3123, Storybook on 3600, emails on 3883), .env.local vs .env.docker, Supabase Studio + Mailpit, and how to drive the running app via Playwright MCP. Triggers when starting the stack, checking why a service is unreachable, running the app in a browser, picking the right URL/port, or wiring up .env. Trigger phrases — "localhost:3100", "localhost:3101", "localhost:3121", "Supabase Studio", "Mailpit", "docker:dev", "pnpm docker:dev", "PORT_PREFIX", ".env.local", ".env.docker", "Playwright", "open the app", "dev server", "is the server running", "TIPTAP_PRO_TOKEN".
Executes bash commands
Hook triggers when Bash tool is used
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
Claude Code plugin marketplace for the One Project common monorepo.
One install gives engineers the full agent harness for this codebase: 13 in-house skills, a vendored copy of Vercel's react-best-practices skill, and the protected-branch hooks.
Once per machine, add the marketplace and install the plugin:
/plugin marketplace add [email protected]:oneprojectorg/common-agent-toolkit.git
/plugin install devtools@common-agent-toolkit
Both commands run inside Claude Code. The marketplace add clones this repo to ~/.claude/plugins/cache/; the install wires the skills and hooks into Claude Code via the cached copy. Works with private GitHub repos through your existing gh / SSH auth.
/plugin marketplace update common-agent-toolkit
Pulls the latest from this repo and re-syncs installed plugins. No re-install needed.
To refresh the vendored Vercel skill from upstream:
bash scripts/sync-vercel.sh
Then commit the resulting diff.
| Skill | What it covers |
|---|---|
access-control | Authorization via the access-zones library and our wrappers (assertAccess, checkPermission, <AccessBoundary>). |
asana-api | Talking to Asana directly via the REST API. |
branch-and-pr | Branching and pull-request workflow. |
component-file-structure | Conventions for organizing a React component file. |
dev-environment | Local dev stack — docker layout, port map, .env.local vs .env.docker, Supabase Studio + Mailpit, driving the running app from Playwright. |
drizzle-migrations | Drizzle ORM workflow for schema edits and migrations. |
i18n-strings | Wrapping user-facing strings with translations in apps/app. |
implement-task | End-to-end implementation flow for a claimed Asana task. |
op-ui-conventions | Using @op/ui, design tokens, and the type scale. |
pickup-task | Pick up the next available Agent task from Asana and claim it atomically. |
release | Open the dev → main release PR (invokable as /release). |
test-conventions | Vitest vs Playwright layout, .test.ts vs .spec.ts, the E2E env shim, and choosing which kind of test to add. |
vercel-react-best-practices | Vendored from vercel-labs/agent-skills — React/Next.js performance rules. MIT-licensed; refreshed via scripts/sync-vercel.sh. |
workspace-shortcuts | pnpm w:* shortcuts for running commands inside a specific workspace. |
PreToolUse on Bash)block-protected-branches.sh — refuses git/gh commands targeting main or dev (with the CLAUDE_RELEASE=1 marker as the single dev → main PR exception).require-feature-branch.sh — refuses commits while HEAD is on a protected branch.common-agent-toolkit/
├── .claude-plugin/
│ └── marketplace.json
├── plugins/
│ └── devtools/
│ ├── .claude-plugin/plugin.json
│ ├── skills/<name>/SKILL.md
│ └── hooks/
│ ├── hooks.json
│ ├── block-protected-branches.sh
│ └── require-feature-branch.sh
├── scripts/
│ └── sync-vercel.sh
├── README.md
└── LICENSE
Create plugins/devtools/skills/<name>/SKILL.md.
Frontmatter must include name and description. Keep the description specific — the agent uses it to decide when to load the skill.
---
name: my-skill
description: One or two sentences. Start with what the skill covers, then "Use when ...".
---
# body
Optional supporting files (scripts/, references/, etc.) live next to SKILL.md in the same folder.
Add a row in the README table above.
MIT. The vendored vercel-react-best-practices skill retains its upstream MIT license; see its SKILL.md frontmatter for attribution.
npx claudepluginhub oneprojectorg/common-agent-toolkit --plugin devtoolsFeature development with code-architect/explorer/reviewer agents, CLAUDE.md audit and session learnings, and Agent Skills creation with eval benchmarking from Anthropic.
Production-grade engineering skills for AI coding agents — covering the full software development lifecycle from spec to ship.
Permanent coding companion for Claude Code — survives any update. MCP-based terminal pet with ASCII art, stats, reactions, and personality.
Claude harness - A harness for solo developers (Vibecoders) to handle full-cycle contract development.
Complete Claude Code configs for mobile development - Android, iOS, and Kotlin Multiplatform