agent-skills

Reusable agent skills extracted from real delivery work — a production WeChat mini-program with payments, a video-surveillance platform, and a few dozen deployment incidents I would rather not repeat.

These are the rule sets I actually give my coding agents (Claude Code / Codex / Cursor). They are not prompt collections: each one is a SKILL.md that describes a failure mode, how to detect it, and the order to do things in.

The skill bodies are written in Chinese (my working language). Where an English version exists it is named SKILL.en.md next to the original; the table below always summarises the skill in English.

Skills

Skill	What it prevents
ai-dev-best-practices · EN	Doing AI-assisted development in the wrong order: no plan, no checkpoints, token burn, agents re-doing work they already did, and the five reasons the same bug survives five "fixes". 35 pitfalls collected across 7 sessions.
deployment-pitfalls · EN	Six remote-deployment traps: non-ASCII paths silently breaking ssh/scp on Windows, hot-swapping a JAR and getting ClassNotFoundException, CRLF poisoning shell scripts, PowerShell console encoding corrupting CJK data, and quoting hell through four nested interpreters.
docker-springboot-production · EN	Shipping a Spring Boot app with a dev-grade Docker setup: MySQL 8.4 rejecting the old auth flag, # in a password truncated by the shell, Redisson failing AUTH against a passwordless Redis, wrong file-upload domain after deploy.
database-operation-safety · EN	A data-changing UPDATE/DELETE that quietly touches the wrong rows, because a filter condition in the instruction was read as background prose.
wechat-pay-v3-yudao · EN	Getting WeChat Pay V3 integration wrong: certificate placement, silent @ConfigurationProperties binding failures, callback verification, callback idempotency, and mixing up the callback result type with the order result type.
wechat-pay-v3-yudao/mock-zero-tolerance.md · EN	Shipping payment code that "works" against mocks. Written after three real rollbacks — and specifically about how AI assistants resurrect mock code.
weighted-lottery-engine · EN	Weighted-random draw engines that are unfair, unreproducible, or cannot change probability at runtime: optimistic-lock stock, a three-level fallback so a draw never returns null, a 10,000-draw sandbox, and anti-cheat design.
yudao-hot-config-pattern · EN	Campaign parameters that require a redeploy to change. The pattern: an independent endpoint plus a lightweight modal, editable at any time with zero intrusion into the existing code paths.
yudao-codegen-pitfalls · EN	Trusting generated CRUD code: output landing in the parent POM, hyphens in package names, duplicate menu component names, dictionaries that were never inserted, empty modules breaking the build.
yudao-appapi-integration · EN	Wiring a mini-program client to the framework's member/auth system the long way — including the double-prefix 404 and the mock-enable flag that silently turns every user into an admin.
browser-automation-without-extension · EN	Losing hours when the browser extension that drove your agent stops working. How to attach to the user's already-logged-in browser over CDP instead: tab drift, os error 10060, the stray blank instance that hijacks your connection, React dropdowns and dialogs that ignore synthetic clicks, hover-only buttons, the file-input that matches six elements, anti-bot walls, and why a link preview stuck on "Verifying…" does not block submission. Includes a verified list of other browser-driving agents and tools.
obsidian-karpathy-memory · EN	Losing a project's memory to chat history. The Obsidian + Karpathy LLM-wiki arrangement (index / hot-cache / log / topic pages / raw sources), the three rules that stop it rotting, four copy-paste prompts (initialize, resume in a new session, write back, record an operation route), and exactly what to install first — which is Obsidian and, optionally, Git.
yudao-admin-branding · EN	White-labelling the admin console by hand and missing half the places the old name appears; also why a framework dashboard should be emptied before handover.

Plus one workflow and one resource:

• workflows/quick-delivery.md — turning a previous delivery into a new client's branded instance in half a day.
• resources/prompt-templates.md — the prompt shapes I reuse for requirements, code review and debugging.

How to use them

Skills are just directories containing a SKILL.md. Copy the ones you want into your agent's skills folder:

# Claude Code (user scope)
cp -r skills/* ~/.claude/skills/

# Codex
cp -r skills/* "$CODEX_HOME/skills/"

Or drop a single folder into .claude/skills/ inside a project. Each skill is self-contained; nothing here phones home or needs credentials.

Notes on provenance and privacy

• Extracted from real projects, then sanitised: no client names, no domains, no server addresses, no merchant IDs, no keys, no customer data. Placeholders such as <your-server-ip> or your-domain.com are what you will find.
• Numbers and incidents are kept because they are the point; identities are not.
• Everything is my own write-up. Where a lesson came from a framework's behaviour, the framework is named (e.g. yudao / ruoyi-vue-pro, which is open source) — no proprietary code is included.

Roadmap

• English translations of the skill bodies done: 11 of 11 (every skill has a SKILL.en.md beside it)
• The mysql-ops-mcp pattern as a skill: read-only data access for agents
• A checklist skill for "deliverable" — what must exist before a handover counts as done

License

MIT — see LICENSE. Use them, fork them, adapt them.

---

Zhen He · Java / AI application engineer · GitHub · Case studies · LinkedIn