Explain it like I'm five
Your AI editor is smart, but without a recipe it guesses. Sometimes that guess is great. Sometimes it invents a half-broken button and calls it done.
cursor-kenji is a big box of recipes (we call them skills). Install once. After that:
- You type something normal β "check my security", "make this form nicer", "ship this feature".
- Cursor picks the matching recipe.
- The AI follows that recipe step by step, instead of freestyling.
You do not need to memorize skill names. Talking like a human is enough.
It ships 110 Cursor agent skills, 36 slash commands, and 6 subagents β tuned for React / Next.js / Supabase, useful on almost any stack. Works in Cursor, Claude Code, and (with a lighter install) Codex + Gemini CLI. Brand new? Read the plain-language guide β.
Install (30 seconds)
npx skills add kensaurus/cursor-kenji
Restart Cursor. Done.
No Cursor yet? Download it. No
skillsCLI?npm install -g skills, or see manual install.
What should I say? (use cases)
| You say⦠| What kicks in | What you get |
|---|---|---|
| "orient me" / "what's in this repo?" | workflow-onboard |
A short tour of the codebase |
| "build this feature" | workflow-build-feature |
Spec β tests β code β smoke β PR |
| "fix this bug and ship it" | workflow-fix-and-ship |
Debug β fix β verify β PR β deploy |
| "audit my security" | audit-security |
OWASP-style findings with file:line |
| "is this production-ready?" | audit-resilience + audit-realworld |
Timeouts, retries, parity checks |
| "make this page less AI-looking" | enhance-web-ui / enhance-web-ux |
Cleaner layout, real content hierarchy |
| "make the forms accessible" | enhance-web-forms |
Labels, validation, keyboard-friendly |
| "plan a security hardening pass" | plan-security-audit |
A burndown you approve before edits |
| "complete everything" | complete-everything |
No parked leftovers β judge verifies "done" |
| "ship it and watch it" | workflow-ship-and-observe |
Deploy β verify live β observe / rollback |
Full menu with every skill name β Every skill below.
The five toys in the box
| Thing | Kid explanation | How you use it |
|---|---|---|
| Skill | A recipe for one job | Just describe the job in chat |
| Command | A shortcut button | Type /commit, /pr, /plan |
| Subagent | A helper who peels off to do one task | Say "review this PR" |
| Rule | A house rule the AI always obeys | Drop a .mdc into your project |
| MCP server | A phone line to your database / GitHub / browser | Copy a template + paste your keys |
Everything follows the Agent Skills spec and is checked on every commit (npm test covers all 122 installable skills). MCP templates pin exact versions against package-hallucination attacks.
How the recipes fit together (the loop)
You almost never run one skill alone. Think of a simple loop β look β change β prove β ship β with seatbelts on the whole time:
Orient Assess Change Prove Ship
(get to know) β (measure first) β (build/fix) β (test for real) β (go live)
β β
βββββββββββββββββββββ findings loop back βββββββββββββββββββββββββββββββ
β²
Guardrails always on
(rules Β· hooks Β· "are we actually done?")
| Stage | Kid version | Skill families |
|---|---|---|
| Orient | Walk around the house before rearranging furniture | workflow-onboard, /research |
| Assess | Look carefully β maybe take notes, don't smash walls yet | audit-*, plan-* |
| Change | Build new things or improve old ones | design-*, enhance-*, backend-*, housekeep-design |
| Prove | Kick the tires. Don't say "done" unless it really is | test-*, complete-everything, completion-judge |
| Ship | Put it in the world and watch it | workflow-ship-and-observe, deploy-*, debug-* |
| Guardrails | Seatbelts that stay on between sessions | rules, completion hook, enhance-agent-guardrails |
Rule of thumb: assess before you change, prove before you ship, never skip a stage.
What's Inside
The whole kit, at a glance:
| Count | What it does | |
|---|---|---|
| Skills | 110 | Auto-triggering playbooks (audit, enhance, debug, test, build, plan) |
| Cursor Skills | 12 | IDE tools (canvas, hooks, rules, PR splitter) |
| Commands | 36 | Slash shortcuts (/commit, /pr, /burndown-full, β¦) |
| Subagents | 6 | Background helpers (code-reviewer, debugger, db-migratorβ¦) |
| Completion hook | 1 | Opt-in stop gate: continues only unfinished durable closure state |
| MCP Servers | 16 | Supabase Β· GitHub Β· Sentry Β· Playwright Β· AWS Β· Slack |
| Project Rules | 6 | Drop-in .mdc for .cursor/rules/ (plus 3 global, 5 RN bundle optional) |
| Notepads | 2 | Context templates (architecture, design tokens) |
| Shell Aliases | 8 | newskill, cursor-sync, gc, gp |
Every skill is listed below β first a family count table, then the full name + one-line summary for each. Trigger phrases β docs/CATALOG.md Β· quick lookup β docs/TRIGGER-CHEATSHEET.md.
Every skill, in plain English
Scroll the family counts, then the full list. You don't memorize names β describe the job in chat and Cursor matches. Want exact trigger phrases? docs/CATALOG.md.
Auto-generated from each skill's SKILL.md β run npm run gen:skill-index after adding a skill. 122 skills listed below.
Skill families at a glance
| Family | Count | In one sentence |
|---|---|---|
| π Audit β look before you change | 18 | Check the codebase β security, UX, performance, paymentsβ¦ |
| π Plan β audit first, change only after you approve | 17 | Write a fix plan you approve before any code changes |
| π¨ Enhance β improve what already exists | 12 | Polish UI, forms, motion, SEO, PWA on an existing app |
| β¨ Design β build something new | 10 | Create new UI, APIs, emails, themes from scratch |
| π§± Backend β server & data patterns | 5 | Auth, caching, queues, realtime, observability |
| π± Mobile β React Native / Capacitor | 5 | RN screens, emulators, Capacitor, App Store prep |
| π Data β charts & pipelines | 2 | Charts, dashboards, ETL / cron jobs |
| π Docs β write it down clearly | 2 | READMEs, PRDs, RFCs with a reader-first voice |
| π§Ή Housekeeping β clean up design drift | 1 | Merge a drifted design system into one source of truth |
| π Workflows β multi-step recipes | 17 | End-to-end recipes (build, fix, ship, green the repo) |
| β Test & QA β prove it works | 4 | Unit, Playwright, red-team, QA |
| π Deploy β ship & verify | 2 | npm release + post-deploy smoke tests |
| π Debug β find & fix what's broken | 3 | Errors, Sentry, frontendβbackend mismatches |
| π¦ Mushi Mushi β bug triage helpers | 2 | Integrate the Mushi Mushi bug-report pipeline |
| π‘οΈ Protocols β session guardrails | 1 | Keep browser automation from freezing |
| βοΈ Authoring β build skills & MCP | 2 | Author new skills or MCP servers |
| π€ Third-party (upstream-maintained) | 3 | Vendored upstream skills (Emil, UI/UX Pro Max, Vercel WIG) |
| π§© Core & cross-cutting | 4 | Close everything, burndown, post-launch loops |
| π±οΈ Cursor IDE skills | 12 | Canvas, hooks, rules, PR splitter, CLI helpers |
| Total | 122 |
Full list (every skill)
π Audit β look before you change (18)
| Skill | What it does |
|---|---|
audit-accessibility |
Automated WCAG 2.2 accessibility audit using Playwright browser MCP to crawl every page, inject axe-core via browser_evaluate, test⦠|
audit-backend-architecture |
Read-only audit AND decision advisor for backend/distributed-systems architecture, topology-gated so a Next.js/Supabase monolith and a⦠|
audit-bundle-size |
Analyse and shrink JavaScript bundle size for any web app |
audit-cicd |
Audit CI/CD pipelines (GitHub Actions) for cost, speed, and safety |
audit-code-quality |
Detect and fix code anti-patterns, and audit codebase consistency |
audit-code-review |
Review code for quality, security, and maintainability following best practices |
audit-db-schema |
Audit database schema for consistency, validation, and industry standards |
audit-fe-api |
Audit frontend API calls against backend implementation for any project |
audit-i18n |
Audit and fix internationalisation for any web or mobile app |
audit-langfuse-llm |
Run a PDCA quality audit on LLM/AI features: traces, prompts, costs, evals, grounding, hallucination |
audit-payment-system |
Read-only audit for payment/money-movement systems, scope-gated so a simple Stripe-Checkout site and an in-house ledger/gateway each see⦠|
audit-performance |
Audit and optimize application performance |
audit-realworld |
Audit a full-stack app against the RealWorld ("Conduit") reference β its formal API spec, shared Bruno/Hurl E2E suite, and closest-stackβ¦ |
audit-resilience |
Read-only audit for the non-functional "20%" AI agents systematically skip: timeouts, retries with backoff+jitter, circuit breakers,β¦ |
audit-security |
Audit code for security vulnerabilities and best practices |
audit-uiux-design-system |
Audit visual UI coherency, design token compliance, and component modularity against a design system for any project |
audit-ux |
Audit user experience quality using research-backed frameworks: Nielsen Norman Group's 10 usability heuristics, Intuit Content Design⦠|
audit-ux-journeys |
Cross-page UX audit for user stories, task completion, and information architecture β the layer audit-ux (per-page heuristics) doesn't cover |
π Plan β audit first, change only after you approve (17)
| Skill | What it does |
|---|---|
plan-aeo-readiness |
Audit a site for answer-engine and generative-engine visibility (citation by ChatGPT, Claude, Perplexity, AI Overviews), then produce a⦠|
plan-antislop |
Audit a codebase, UI, or copy for machine-generated tells across prose, visual/UI, code, and structure/IA, then produce a phased de-slop⦠|
plan-capacitor-hardening |
Audit a Capacitor/Ionic hybrid app for native-layer security gaps, then produce a phased hardening plan |
plan-data-integrity |
Audit a project for destructive-operation and migration safety gaps, then produce a phased safeguard plan |
plan-dependency-provenance |
Audit dependencies for hallucinated or slopsquatted packages, supply-chain risk, and licensing/provenance gaps, then produce a phased⦠|
plan-docs-sync |
Audit documentation against actual code behavior and plan corrections β no rewrites in this pass |
plan-error-handling |
Audit a codebase for silent failures, swallowed exceptions, and observability gaps across Sentry and Langfuse, then produce a phased fix⦠|
plan-input-validation |
Audit every trust boundary for unvalidated input, injection, and forged-request gaps, then produce a phased hardening plan |
plan-llm-cost-guardrails |
Audit an LLM-powered app for runaway-cost and quota-abuse exposure, then produce a phased guardrail plan |
plan-mobile-readiness |
Audit a Capacitor/React Native app for App Store and Google Play submission readiness, then produce a phased pre-submission plan |
plan-perf-audit |
Measure-don't-guess performance audit across web, mobile, backend, and data layers β produces burndown and optimization plan with no fixesβ¦ |
plan-rls-audit |
Audit a Supabase/Postgres project for Row-Level Security and access-control gaps, then produce a phased remediation plan |
plan-secrets-audit |
Audit a codebase and git history for exposed credentials and mis-scoped keys, then produce a phased rotation-and-remediation plan |
plan-security-audit |
OWASP Top 10 security audit with Supabase-first methodology β RLS pass, bundle/secret scan, auth-path tracing, dependency CVEs |
plan-stub-checker |
Exhaustive audit for stubs, dead buttons, fake/placeholder components, unwired handlers, dead links, orphans, and severed integrations ββ¦ |
plan-test-coverage |
User-story-driven test coverage audit and plan β no test writing in this pass |
plan-uiux-unification |
Exhaustive, non-destructive UI/UX and design-system audit that produces a burndown and unification plan β no code changes until each phaseβ¦ |
π¨ Enhance β improve what already exists (12)
| Skill | What it does |
|---|---|
enhance-agent-guardrails |
Install guardrails-as-code into a repo so AI/vibe-coding can't keep reintroducing the same classes of problems (leaked secrets, injection,β¦ |
enhance-capacitor-ui |
Cross-surface UIUX separation skill for hybrid web apps that ship as PWA + iOS + Android via Capacitor (or Tauri / Expo Web / Ionic /β¦ |
enhance-motion |
Audit an existing app's design system and current motion, then apply coherent, performant, accessible motion using the right-sized 2026β¦ |
enhance-pwa |
Add or upgrade PWA features to any web app: service worker, offline mode, install prompt, push notifications, and background sync |
enhance-readme |
Turn a plain-text README into a visually rich showcase with a theme-aware hero image, a feature tour grid, an optional animated guided-tour⦠|
enhance-web-forms |
Build or upgrade web forms to production quality: accessible structure (labels, fieldsets, autocomplete, correct input types),β¦ |
enhance-web-landing |
Build landing pages, portfolios, and marketing sites that don't look AI-generated |
enhance-web-redesign |
Upgrades existing websites and apps to premium quality |
enhance-web-seo |
Audit and fix SEO for any web app. Checks meta tags, Open Graph and Twitter Card tags, JSON-LD structured data, robots.txt, sitemap.xml,β¦ |
enhance-web-ui |
Artistic, research-grounded UI enhancement skill for making an existing page feel intentional, spacious, and human-crafted |
enhance-web-ux |
Generative, NN/g-grounded page enhancement skill |
enhance-web-web3d |
Add 3D and scroll-driven motion to an existing website or web app β Three.js / React Three Fiber for the scene, GSAP ScrollTrigger forβ¦ |
β¨ Design β build something new (10)
| Skill | What it does |
|---|---|
design-api |
Design RESTful and GraphQL APIs following current best practices for naming, versioning, error shapes, and auth patterns |
design-canvas |
Create museum-quality visual art in .png and .pdf formats using design philosophy |
design-email |
Design and implement transactional and marketing email templates |
design-frontend |
Create distinctive, production-grade frontend interfaces that avoid generic AI aesthetics |
design-generative-art |
Create algorithmic art using p5.js, Canvas API, or SVG with seeded randomness and interactive parameters |
design-mobile-first |
Designs mobile-first responsive interfaces with touch optimization β breakpoint strategy, touch targets, safe areas, and gesture handling,β¦ |
design-motion |
Design and implement purposeful motion β micro-interactions, page transitions, scroll animations, and hover effects β using Framer Motion,β¦ |
design-prd |
Generate Product Requirements Documents through structured conversation for any project |
design-system |
Build and maintain cohesive design systems and component libraries with tokens, theming, and documented variants |
design-theme |
Apply cohesive visual themes to artifacts (slides, docs, landing pages) |
π§± Backend β server & data patterns (5)
| Skill | What it does |
|---|---|
backend-db-performance |
Optimize database queries, schemas, and performance |
backend-error-handling |
Implement solid error handling patterns |
backend-observability |
Instrument features so errors, traces, and logs are correlated from the first line |
backend-patterns |
Apply modern backend patterns β auth middleware, caching strategies, background queues, rate limiting, and serverless/edge function designβ¦ |
backend-realtime |
Implement real-time features using WebSockets, Supabase Realtime, Server-Sent Events, and live data |
π± Mobile β React Native / Capacitor (5)
| Skill | What it does |
|---|---|
mobile-capacitor-platform |
Handle Capacitor platform depth beyond UI: plugins, OTA, deep links, push, offline, native CI/CD, App Store / Play Store submission, Apple⦠|
mobile-emulator-start |
Boots a clean Android emulator + Metro (Expo dev-client / bare React Native) with the right ordering: inspect existing IDE terminals first,β¦ |
mobile-emulator-test |
QA a native Android build end-to-end on the emulator |
mobile-rn-performance |
Fix React Native / Expo performance, build, and upgrade issues |
mobile-rn-screen |
Polish an existing React Native screen to feel intentional, native, and human-crafted |
π Data β charts & pipelines (2)
| Skill | What it does |
|---|---|
data-pipeline |
Wire ETL, ingestion, cron, edge-function, and queue jobs correctly |
data-visualization |
Build interactive, accessible charts, graphs, and data dashboards using Recharts, D3, or Victory |
π Docs β write it down clearly (2)
| Skill | What it does |
|---|---|
docs-coauthor |
Co-author structured documents (specs, PRDs, RFCs, ADRs) through a 3-stage workflow: context gathering, drafting, and reader testing |
docs-writer |
Write clear, developer-friendly documentation β READMEs, API references, code comments, and changelog entries β tailored to the audienceβ¦ |
π§Ή Housekeeping β clean up design drift (1)
| Skill | What it does |
|---|---|
housekeep-design |
Consolidate a design system that has drifted across many vibe-coding sessions and developer handoffs into one single source of truth |
π Workflows β multi-step recipes (17)
| Skill | What it does |
|---|---|
workflow-build-feature |
End-to-end feature build workflow: spec β TDD β implement β smoke test β PR |
workflow-coding-discipline |
Apply behavioral guardrails when writing, editing, refactoring, or debugging code |
workflow-environment-ready |
Prove the working environment is actually runnable before starting a long or autonomous task, so a multi-hour run does not fail at the⦠|
workflow-feature-flag |
Plan and execute a disciplined feature-flag rollout for any app |
workflow-feedback-to-closure |
Turn raw feedback β bug reports, user complaints, review comments, Sentry issues, QA findings, audit/red-team output β into deduplicated,β¦ |
workflow-fix-and-ship |
Complete bug-fix lifecycle in one sweep: triage production signals (Sentry / logs) β reproduce β fix (debug-error) β verify full-stackβ¦ |
workflow-git-commit |
Generate clear, descriptive commit messages following conventional commits format |
workflow-green-repo |
Drive an entire repository to a fully green baseline β typecheck, lint, tests, and build all passing from a clean checkout β when the userβ¦ |
workflow-housekeep |
Repo housekeeping: sync READMEs to match current architecture, remove dead files (logs, screenshots, deprecated code, build artifacts),β¦ |
workflow-launch-ready |
Full launch preparation sweep for a new app or major release |
workflow-onboard |
First-contact orientation for an unfamiliar codebase |
workflow-parallel-agents |
Run multiple agents in parallel via git worktrees, cloud agents, or multi-model comparison |
workflow-pr |
Manage the full PR lifecycle β create, review, address bot feedback, resolve conflicts, and merge |
workflow-quality-gate |
Pre-release quality gate that sequences test-red-team, audit-security, audit-bundle-size, audit-performance, and test-unit into a single⦠|
workflow-refactor |
Guide for refactoring code to improve quality without changing behavior |
workflow-ship-and-observe |
Take merged, repository-green code all the way to a verified, monitored production release for any app stack |
workflow-spec-tdd |
Stop vibe-coding with a spec β plan β TDD loop before writing a line |
β Test & QA β prove it works (4)
| Skill | What it does |
|---|---|
test-playwright |
Close the PDCA loop on the work you just did |
test-qa |
Generic webapp QA fallback β use only when no project-specific QA skill applies (project-local QA skills take precedence; useβ¦ |
test-red-team |
Adversarial red-team of a running web, React Native, or Capacitor hybrid app |
test-unit |
Write effective unit tests with best practices for any project |
π Deploy β ship & verify (2)
| Skill | What it does |
|---|---|
deploy-npm |
Release npm packages end-to-end: Changesets version bump, CHANGELOG update, GitHub Actions OIDC publish, and post-release verification |
deploy-verify |
Post-deploy smoke test combining all 5 MCPs (Sentry + Supabase + Langfuse CLI + Playwright + Firecrawl) into one workflow |
π Debug β find & fix what's broken (3)
| Skill | What it does |
|---|---|
debug-error |
Systematic debugging workflow for errors and bugs |
debug-fe-be-integration |
Debug frontend-backend integration issues for any project by analyzing backend logs, identifying incorrect API calls, and fixing both sides |
debug-sentry-monitor |
Monitor, triage, fix, and proactively enhance Sentry error monitoring for any project |
π¦ Mushi Mushi β bug triage helpers (2)
| Skill | What it does |
|---|---|
mushi-health |
Pass/fail health check across every Mushi Mushi pipeline component β CLI credentials, API reachability, edge functions, BYOK key pool, QAβ¦ |
mushi-integration |
Full end-to-end Mushi Mushi integration smoke test: bug capture β AI triage β story mapping β TDD test generation β approval β execution ββ¦ |
π‘οΈ Protocols β session guardrails (1)
| Skill | What it does |
|---|---|
protocol-browser-anti-stall |
Prevent browser automation from freezing, getting stuck, or waiting excessively during page navigation and interaction, and enforce manual,β¦ |
βοΈ Authoring β build skills & MCP (2)
| Skill | What it does |
|---|---|
meta-mcp-builder |
Scaffold and implement Model Context Protocol (MCP) servers that expose external services, APIs, and data sources as typed tools and⦠|
meta-skill-creator |
Create or update Cursor agent skills (SKILL.md) |
π€ Third-party (upstream-maintained) (3)
| Skill | What it does |
|---|---|
thirdparty-emil-design-eng |
Third-party skill β Emil Kowalski's design engineering philosophy (UI polish, component design, animation craft) |
thirdparty-ui-ux-pro-max |
Third-party skill β design intelligence for professional UI/UX (the full style catalog, palettes, typography, UX guidelines) |
thirdparty-web-interface-guidelines |
Third-party skill β reviews UI code for Vercel Web Interface Guidelines compliance (accessibility, focus, forms, animation, performance,β¦ |
π§© Core & cross-cutting (4)
| Skill | What it does |
|---|---|
burndown-full |
Drive a planned change to 100% coverage across an entire codebase when a prior agent run stopped early |
complete-everything |
Close an approved plan with zero plan-related deferrals: implement every unfinished item, absorb every connected⦠|
iterate-agent-harness |
Turn an agent's own failure β a premature stop, a false "done", a reward- hacked check, a missed file, a broken handoff β into a durableβ¦ |
iterate-post-launch |
Close the post-launch improvement loop for any shipped app |
π±οΈ Cursor IDE skills (12)
| Skill | What it does |
|---|---|
babysit |
Keep a PR merge-ready by triaging comments, resolving clear conflicts, and fixing CI in a loop |
canvas |
A Cursor Canvas is a live React app the user opens beside the chat |
create-hook |
Create Cursor hooks |
create-rule |
Create Cursor rules for persistent AI guidance |
create-skill |
Guide users through creating effective Agent Skills for Cursor |
create-subagent |
Create custom subagents for specialized AI tasks |
migrate-to-skills |
Convert 'Applied intelligently' Cursor rules (.cursor/rules/.mdc) and slash commands (.cursor/commands/.md) to Agent Skills format⦠|
shell |
Run the rest of a /shell request as a literal shell command |
split-to-prs |
Split current work into small reviewable PRs |
statusline |
Configure a custom status line in the CLI |
update-cli-config |
View and modify Cursor CLI configuration in ~/.cursor/cli-config.json |
update-cursor-settings |
Modify Cursor/VSCode user settings in settings.json |
Quick Start
Pick whichever fits how you work. The first one covers most people.
| Method | Command |
|---|---|
| skills.sh (recommended) | npx skills add kensaurus/cursor-kenji |
| npm installer | npx @kensaurus/cursor-kenji |
| Clone | git clone β¦ && ./install.sh |
npm installer modes:
npx @kensaurus/cursor-kenji # merge β add/overwrite this repo's items (Cursor)
npx @kensaurus/cursor-kenji --auto # detect installed tools and install to each
npx @kensaurus/cursor-kenji --claude # install for Claude Code (~/.claude/) instead
npx @kensaurus/cursor-kenji --codex # install for Codex CLI (~/.codex/AGENTS.md + prompts)
npx @kensaurus/cursor-kenji --gemini # install for Gemini CLI (~/.gemini/GEMINI.md + commands)
npx @kensaurus/cursor-kenji --all # install for all four supported tools in one run
npx @kensaurus/cursor-kenji --clean # mirror ~/.cursor to match this repo (backup first)
npx @kensaurus/cursor-kenji --dry-run # preview
npx @kensaurus/cursor-kenji --skill audit-ux # single skill
npx @kensaurus/cursor-kenji --link # dev: symlink for live skill authoring
Use more than one AI tool? Reach for --auto. It checks ~/.cursor, ~/.claude, ~/.codex, and ~/.gemini, then installs the right files to each one it finds. Running the bare command stays Cursor-only, so nothing changes for existing setups.
From a clone: npm run install:cursor Β· npm test validates skills + count + install smoke test.
Optional β Mushi Mushi bug-report triage + AI draft PRs (pairs with mushi-health, test-playwright):
npx skills add kensaurus/mushi-mushi
After install: (1) Restart Cursor (2) Copy mcp/mcp.json.template β ~/.cursor/mcp.json, fill YOUR_* keys (3) Describe any task β skills match on keywords.
Authoring skills? Each skill must pass Agent Skills spec validation (npm run validate:skills): name matches directory, description β€ 1024 chars, body < 500 lines.
Claude Code
One-click, no clone needed (works on Windows too):
npx @kensaurus/cursor-kenji --claude # Claude Code only
npx @kensaurus/cursor-kenji --all # all four supported tools
All skills, commands, agents, and rules install to Claude Code (~/.claude/), with .mdc rules installed as .md. Skills appear as /slash-commands β type / inside any claude session.
From a clone, the bash installer does the same:
# Install for Claude Code only
./install.sh --claude
# Install for both Cursor and Claude Code (default)
./install.sh
# Inside Claude Code β use skills as slash commands
/workflow-build-feature
/debug-error the login endpoint returns 401
/plan-security-audit
/docs-writer
Skills are read from ~/.claude/skills/<name>/SKILL.md. No restart required when you re-run the installer β Claude Code picks up file changes at the start of each new session.
Codex CLI & Gemini CLI
Codex CLI and Gemini CLI don't have a skills system yet. Each reads a single global context file instead, so cursor-kenji maps to exactly what they load:
npx @kensaurus/cursor-kenji --codex # Codex CLI
npx @kensaurus/cursor-kenji --gemini # Gemini CLI
| Codex CLI | Gemini CLI | |
|---|---|---|
| Rules β context file | ~/.codex/AGENTS.md |
~/.gemini/GEMINI.md |
| Portable commands | ~/.codex/prompts/*.md |
~/.gemini/commands/*.toml |
Your rules/ get merged into that one auto-loaded file (the skill-routing index is skipped, since nothing here would load it). Three standalone playbooks β plan, research, and fix-issue β ship as native prompts/commands. Skills and subagents aren't written out, because neither tool can load them, so they'd only be dead files. Any existing AGENTS.md or GEMINI.md is backed up as .bak-<stamp> first, and re-running the installer is always safe.
The bash
install.sh --codex/--geminidelegates to the Node installer (needs Node β₯ 18) so the merge/port logic has a single source of truth.
Manual install
git clone https://github.com/kensaurus/cursor-kenji.git && cd cursor-kenji && ./install.sh
curl -sSL https://raw.githubusercontent.com/kensaurus/cursor-kenji/main/install.sh | bash
Keep fresh: npx skills add kensaurus/cursor-kenji or git pull && ./install.sh
Workflows
You rarely run just one skill. You chain them. The picture at the top (How the recipes fit together) is the whole idea β this section is the same loop with more detail.
Stage cheat-sheet
| Stage | What you do | Skill families |
|---|---|---|
| Orient | Get to know the repo before you touch it | workflow-onboard, /research |
| Assess | Measure, don't guess. audit-* may fix inline; plan-* only plans until you approve |
audit-*, plan-* |
| Change | Build new (design-*) or improve existing (enhance-*); merge design drift with housekeep-design |
design-*, enhance-*, backend-*, mobile-* |
| Prove | Tests + the no-false-done trio | test-*, verification-before-completion β completion-judge β complete-everything |
| Ship & operate | Release, watch, feed findings back into Assess | deploy-*, debug-*, workflow-ship-and-observe |
| Guardrails | Seatbelts between sessions | rules, completion hook, enhance-agent-guardrails |
Specialist audits worth knowing:
audit-realworldβ full-stack feature parityaudit-resilienceβ timeouts, retries, idempotency, PII (the stuff agents skip)audit-backend-architectureβ which distributed pattern to adopt vs skip as over-engineeringaudit-payment-systemβ double-charge, ledgers, webhooks, PCIaudit-ux-journeysβ can users actually find things and finish their stories? (IA + task completion)
Start here, by situation
Find the row that sounds like your day, then follow the chain:
| Your situation | Chain (β hands off to) |
|---|---|
| New to this repo | workflow-onboard β /research |
| Inherited a messy / drifted design system | audit-uiux-design-system β plan-uiux-unification β housekeep-design |
| Make the app feel alive | enhance-motion (existing app) Β· design-motion (from scratch) |
| Forms are clunky or inaccessible | enhance-web-forms β audit-accessibility |
| "Is it production-ready?" | audit-resilience + audit-realworld β workflow-quality-gate |
| Backend architecture β which pattern to use / am I over-engineering? | audit-backend-architecture β backend-patterns |
| Payment flow β double-charge, ledger, webhook, PCI safe? | audit-payment-system β audit-security / audit-resilience |
| Users get lost / can't finish a flow / nav feels wrong | audit-ux-journeys β enhance-web-ux / audit-ux |
| Stop AI / vibe-coding regressions | enhance-agent-guardrails β plan-security-audit |
| Close everything, zero deferrals | complete-everything β completion-judge |
| Ship it and watch it | workflow-ship-and-observe β debug-sentry-monitor β workflow-feedback-to-closure |
Bundled workflows
Say the phrase, and the whole sequence runs for you:
| Say this | Bundle | What runs |
|---|---|---|
| "complete everything" | complete-everything |
recover parked work β implement all β full verification β independent judge |
| "make the repo green" | workflow-green-repo |
discover gates β enumerate failures β batch fix β prove green |
| "ship it / go live" | workflow-ship-and-observe |
preflight β deploy β verify live revision β observe β stable/rollback |
| "triage this feedback" | workflow-feedback-to-closure |
gather β dedupe β tickets β fix β verify live β close |
| "build a feature" | workflow-build-feature |
spec β TDD β unit β smoke β PR |
| "fix this and ship" | workflow-fix-and-ship |
debug β fix β regression β PR β deploy |
| "is this ready?" | workflow-quality-gate |
red-team β security β bundle β perf β unit |
| "prepare for launch" | workflow-launch-ready |
SEO + PWA + bundle + i18n + quality gate |
| "orient me" | workflow-onboard |
codebase briefing in ~5 min |
Plan loops (audit only β approve before execution)
These 17 plan-* skills come in grouped loops. Each one audits, then hands you a plan β nothing changes until you approve it. See docs/PLAN-LOOPS.md for diagrams, slash aliases (/uiux-plan, /capacitor-plan, β¦), and how each maps to execution.
| Loop | Skills | When |
|---|---|---|
| Six-skill | uiux β stub β test-coverage β perf β₯ security β docs-sync | Inherited codebase / UI hardening |
| Pre-launch hardening | input-validation β secrets β RLS β data-integrity β dependency-provenance | Supabase/Stripe, pre-open-source |
| Observability & spend | error-handling + llm-cost-guardrails | LLM features, Sentry/Langfuse gaps |
| Mobile gate | capacitor-hardening β mobile-readiness | Capacitor/hybrid pre-store |
| Growth gate | aeo-readiness | AI citation visibility |
One-shot (six-skill plan only):
Run the six-skill plan loop β no changes until I approve each phase:
plan-uiux-unification β plan-stub-checker β plan-test-coverage β
plan-perf-audit + plan-security-audit (parallel) β plan-docs-sync.
More copy-paste recipes (adopt repo, de-slop a page, pre-launch sweep, split PRs) β docs/CATALOG.md#skill-composition-patterns Β· New to Cursor? β docs/GETTING-STARTED.md
How to Use
Four kinds of building blocks, four ways to reach them:
| Primitive | Invoke | Example |
|---|---|---|
| Skill | Describe the task | "audit my security" β audit-security |
| Command | /name in chat |
/commit, /research, /pr |
| Subagent | Mention trigger keyword | "review this PR" β code-reviewer |
| Rule | Copy .mdc into project |
Always-on conventions |
Force a skill: "use enhance-web-ux on /dashboard"
Skill taxonomy
Every skill has two labels: a family (its <prefix>-<topic> name) and a lifecycle stage (from the loop above). The table below shows which stage each family lives in. For the full entries with trigger phrases, see docs/CATALOG.md.
| Prefix | Stage | Purpose | Examples |
|---|---|---|---|
audit- |
π Assess | Read-only assessments (may fix inline) | audit-security, audit-resilience, audit-realworld |
plan- |
π Assess | Audit-and-plan burndowns β approve before execute (17) | plan-stub-checker, plan-rls-audit, plan-security-audit |
enhance- |
π οΈ Change | Improve existing UI/UX/motion/forms/SEO/PWA | enhance-motion, enhance-web-forms, enhance-web-ux |
design- |
π οΈ Change | New surfaces from scratch | design-frontend, design-motion, design-system |
backend- |
π οΈ Change | Server patterns & resilience | backend-patterns, backend-observability |
mobile- |
π οΈ Change | RN / Capacitor / emulator | mobile-rn-screen, mobile-capacitor-platform |
docs- |
π οΈ Change | Documentation | docs-writer, docs-coauthor |
workflow- |
β»οΈ Spans | Multi-phase process bundles | workflow-build-feature, workflow-spec-tdd, workflow-housekeep |
test- |
β Prove | QA and unit tests | test-playwright, test-red-team, test-unit |
deploy- |
π Ship | Release verify | deploy-verify, deploy-npm |
debug- |
π Operate | Failures and integration | debug-error, debug-sentry-monitor |
mushi- |
π Operate | Mushi Mushi integration | mushi-health, mushi-integration |
protocol- |
π‘οΈ Guardrail | Session guardrails | protocol-browser-anti-stall |
meta- |
βοΈ Author | Author skills/MCP | meta-skill-creator, meta-mcp-builder |
thirdparty- |
Varies | Upstream-maintained (vendored) | thirdparty-emil-design-eng, thirdparty-ui-ux-pro-max, thirdparty-web-interface-guidelines |
housekeep-design(design-system consolidation) is the execution arm ofplan-uiux-unification; it lives in the π οΈ Change stage alongsideenhance-*.
Third-party skills: prefixed
thirdparty-*withATTRIBUTION.mdβ do not add Kenji-specific sections to upstream bodies. Full guide β docs/THIRD-PARTY-SKILLS.md.
Note: Anthropic
file-docx/pdf/pptx/xlsxskills are not in this public repo. Keep personal copies in~/.cursor/skills/if needed.
Cursor-specific skills (12): babysit, canvas, `
No comments yet
Be the first to share your take.