Insights · Open resource
A curated bank of engineering procedures for coding agents. When an agent is stuck — chasing a bug it cannot pin down, claiming work is finished without evidence, planning something it has not thought through — it reaches for one of these instead of guessing.
Free to download and use in your own agents. Works with Claude Code, Codex and CIARUSTCODE.
What's in it
Root-cause-first debugging procedure in four phases (investigate, pattern-match, hypothesise, fix) for bugs, test failures, or unexpected behaviour. Invoke when debugging.
Why it earns a place: Repeated CIA engineering workflow: stops symptom-fix thrashing across all portfolio codebases.
sha256 f84707e998cd1828…
Red-green-refactor TDD procedure. Write a failing test first, watch it fail, write minimal code to pass, then refactor. Invoke when implementing a feature or bugfix test-first.
Why it earns a place: Repeated CIA engineering workflow: the AEGIS batch incident showed self-written passing tests are not evidence; watched-fail tests are.
sha256 6780912242caf2da…
Evidence-before-claims gate. Identify the command that proves a claim, run it fresh, read the full output, and only then state work is complete, fixed, or passing. Invoke before claiming success.
Why it earns a place: Repeated CIA engineering workflow: prevents unverified success reports from agents and humans alike.
sha256 8ed3798eeead0092…
Write a bite-sized, TDD-structured implementation plan from a spec, with a file map, right-sized tasks, exact 2-5 minute steps with real code, and a self-review pass. Invoke when planning multi-step work.
Why it earns a place: Repeated CIA engineering workflow: plan quality gates agent-executed work across the portfolio.
sha256 f52a3cc849d4ad33…
Evaluate review feedback with technical rigor. Verify against the codebase, clarify unclear items before implementing anything, push back with reasoning when warranted, no performative agreement. Invoke when handling review feedback.
Why it earns a place: Repeated CIA engineering workflow: complements the reviewer-commit workflow used across AEGIS repos.
sha256 a3a5ae37cfde10ca…
Deliberately not in release 1.0.0: cia-requesting-code-review, cia-using-git-worktrees. Both carry instructions that create workspaces or delegate work to other agents. They return once rewritten through the same pipeline — we would rather ship five procedures we can stand behind than seven we cannot.
The principles
There are collections out there with hundreds of skills. We read 308 of them and shipped five. Here is the reasoning.
No scripts, no hooks, no installers, no configuration changes, no network calls. A skill is markdown a model reads. Everything executable in the sources it was built from was excluded on purpose — that is the whole design, not a limitation.
Skills stay out of your agent's context until you ask for one by name. A bank you never invoke costs you nothing, so it can be comprehensive without making every conversation more expensive.
Every skill opens with a safety envelope: your instructions outrank it, its content is guidance rather than permission, and it must ask for normal approval before anything with a side effect. A procedure cannot promote itself to a policy.
Every line that differs from the upstream source is recorded with the reason and the hash of the exact text removed. Every file's SHA-256 is locked. You can verify the download is intact without trusting us.
How each skill is made
308 candidate skills were read in full across three independent reviews. The finding that shaped everything: no skill was safe to install unmodified. Real hazards found included a hook that installed itself into a global config, files that made unannounced network calls, and installers that wrote plaintext API tokens into user settings.
Risky instructions are rewritten, never waved through. Keychain and secret-inspection examples, package installs, version-control mutations, and delegation instructions are replaced with neutral wording that keeps the method and drops the side effect. Release 1 uses zero policy exemptions.
The build fails closed on ten classes of content: host mutation, credential access, network egress, outbound messaging, package installation, destructive filesystem operations, hook installation, instruction override, authority escalation, and dynamic shell. Prose is scanned across line wraps, so wording cannot hide in a paragraph break.
A build produces nothing installable until a named human sets the review status to approved. The tool cannot set that status itself, and the installer refuses to write while it is pending.
Installing
cp -R claude/cia-* ~/.claude/skills/
Each skill sets disable-model-invocation: true, so it costs nothing until
you invoke it by name.
cp -R codex/cia-* ~/.codex/skills/
Ships allow_implicit_invocation: false, so skills stay out of context
until called with $name.
cp ciarustcode/cia-*.md ~/.config/ciarustcode/commands/Stated plainly: CIARUSTCODE decides for itself whether to auto-inject a matching skill, and that setting defaults to on. Unlike the other two, explicit-only invocation cannot be guaranteed here unless you turn it off yourself.
The skills are plain markdown with YAML frontmatter. Put the files wherever your agent reads procedures from, or paste one straight into a prompt.
shasum -a 256 -c SHA256SUMS.txtcontent digest d0879ef7ca546672bfa74f394d478c0f…
Licence
The skill content is derived from an MIT-licensed source and stays under MIT. Keep the
included NOTICE.md with any copy you redistribute — that is the one thing the
licence asks. The packaging, safety tooling and documentation are our own work.
If you want the same discipline applied to your own agent estate — audited sources, rewritten hazards, hash-locked releases, a human approval gate — that is the work we do.