Agent skill

Coding Standards

by shinpr in shinpr/ai-coding-project-boilerplate

Detects code smells, anti-patterns, and readability issues. An agent skill from shinpr/ai-coding-project-boilerplate.

MITAuto-check: notesDevelopment

Install Coding Standards

skills CLI
$ npx skills add shinpr/ai-coding-project-boilerplate --skill coding-standards -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install shinpr/ai-coding-project-boilerplate coding-standards --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/shinpr/ai-coding-project-boilerplate.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills-en/coding-standards .claude/skills/coding-standards && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
coding-standards
GitHub stars
232
Token cost
~3.8k tokens
SKILL.md length
1,890 words
Files
2 (incl. references)
Skills in repo
42
Repo updated
First seen
Licence
MIT

At a glance

Detects code smells, anti-patterns, and readability issues. An agent skill from shinpr/ai-coding-project-boilerplate.

  • Works in 7 steps: Writing similar code 3 or more times -… → Multiple responsibilities mixed in a… → Defining same content in multiple files… → …
  • Implementing features
  • SKILL.md covers Technical Anti-patterns (Red…, Basic Principles, Comment Writing Rules and Error Handling Fundamentals, plus 9 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Coding Standards is an agent skill from shinpr/ai-coding-project-boilerplate. Detects code smells, anti-patterns, and readability issues. Use when implementing features, reviewing code, or refactoring.

Its SKILL.md is about 3.8k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/security-checks.md`).

It sits in Development, covering Code quality, Refactoring and Plain language and style rules. The repository describes itself as: Agentic coding TypeScript boilerplate for Claude Code: sub-agent workflows with built-in quality checks and context engineering. The licence is MIT.

When your agent uses it

  • Implementing features
  • Tasks that involve Code quality
  • Tasks that involve Refactoring

Example prompts

  • “Use the coding-standards skill to detect code smells, anti-patterns, and readability issues. An agent skill from shinpr/ai-coding-project-boilerplate”
  • “/coding-standards”

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

  1. Writing similar code 3 or more times - Violates Rule of Three
  2. Multiple responsibilities mixed in a single file - Violates Single Responsibility Principle (SRP)
  3. Defining same content in multiple files - Violates DRY principle
  4. Making changes without checking dependencies - Potential for unexpected impacts
  5. Disabling code with comments - Should use version control
  6. Error suppression - Hiding problems creates technical debt
  7. Type assertions standing in for a guarantee - Declaring a type that neither a runtime check nor an existing contract establishes

What it can do on your machine

Read from SKILL.md and the folder at commit 56913a2. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Coding Standards loads about 3.8k tokens when it runs, and up to ~4.8k if it reads all its reference files. Until then it costs about 35 tokens; SKILL.md has 1,890 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~35
When it runs · the whole SKILL.md, loaded when a task matches
~3.8k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~4.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteMentions a .env fileSKILL.md:174
    - Pure configuration file changes (.env, config, etc.)

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from shinpr/ai-coding-project-boilerplate at commit 56913a2, republished under its MIT licence (© shinpr). 1,890 words, ~3,757 tokens.

Download SKILL.mdSave it as .claude/skills/coding-standards/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
coding-standards
description
Detects code smells, anti-patterns, and readability issues. Use when implementing features, reviewing code, or refactoring.

Universal Coding Standards

Technical Anti-patterns (Red Flag Patterns)

When any pattern below is detected, pause implementation and record: the triggered pattern, affected current requirement, smallest compliant alternative, and verification needed to resume. Resume when the alternative removes the pattern or a documented requirement justifies retaining it.

Code Quality Anti-patterns
  1. Writing similar code 3 or more times - Violates Rule of Three
  2. Multiple responsibilities mixed in a single file - Violates Single Responsibility Principle (SRP)
  3. Defining same content in multiple files - Violates DRY principle
  4. Making changes without checking dependencies - Potential for unexpected impacts
  5. Disabling code with comments - Should use version control
  6. Error suppression - Hiding problems creates technical debt
  7. Type assertions standing in for a guarantee - Declaring a type that neither a runtime check nor an existing contract establishes
Design Anti-patterns
  • "Make it work for now" thinking - Accumulation of technical debt
  • Patchwork implementation - Unplanned additions to existing code
  • Optimistic implementation of uncertain technology - Designing unknown elements assuming "it'll probably work"
  • Symptomatic fixes - Surface-level fixes that don't solve root causes
  • Unplanned large-scale changes - Lack of incremental approach

Basic Principles

Inspect until the evidence identifies the lowest-total-complexity solution that delivers the required user, operator, or maintainer value while keeping the system correct and maintainable.

  • Evidence-Bounded Refactoring - Refactor code that blocks the current outcome, is changed by the current task, or fails an applicable quality check; use small behavior-preserving steps. Report other findings with their owning boundary and evidence without expanding the active change
  • Current-Requirement Code Only - Introduce code paths, capabilities, infrastructure, abstractions, or speculative edge-case handling when a current requirement, verified constraint, or evidence-backed material risk requires them (YAGNI)
  • Design Convergence - Deliver the current required outcome with the least new design surface. Before introducing persistent state, a public or cross-boundary contract, a behavioral mode, a reusable abstraction, or a component split, record what the existing capabilities already deliver, what they fail to deliver for the current outcome, and why the addition is the smallest thing that closes that gap

Judge total complexity across every activated surface: user decisions, settings, modes, concepts, outputs, persistent state, and implementation paths, together with their UX, runtime, implementation, testing, documentation, and maintenance cost. Compare only dimensions that differ between viable approaches. Prefer reuse or no new mechanism when it delivers the same confirmed value and proof at lower total complexity.

Comment Writing Rules

  • Code first: Names, types, and structure are the primary medium; add a comment only when it carries what the code cannot express. When in doubt, improve the name instead of commenting
  • Comment the "why", not the "what": Explain reasoning, trade-offs, constraints/edge cases, or public API contracts
  • Timeless Content: Comments contain current reasoning, constraints, edge cases, or API contracts; version control retains development history
  • Timeless: Write only content that remains valid whenever read
  • Conciseness: Keep explanations to necessary minimum

Error Handling Fundamentals

Fail-Fast Principle

Fail quickly on errors to prevent processing continuation in invalid states. Propagate the failure or return an explicit typed error with the original diagnostic context.

For detailed implementation methods (Result type, custom error classes, layered error handling, etc.), refer to language and framework-specific rules.

Rule of Three - Criteria for Code Duplication

How to handle duplicate code based on Martin Fowler's "Refactoring":

Duplication CountActionReason
1st timeInline implementationCannot predict future changes
2nd timeConsider future consolidationPattern beginning to emerge
3rd timeImplement commonalizationPattern established
Criteria for Commonalization

Cases for Commonalization

  • Business logic duplication
  • Complex processing algorithms
  • Areas likely requiring bulk changes
  • Validation rules

Cases to Keep Separate

  • Accidental matches (coincidentally same code)
  • Possibility of evolving in different directions
  • Significant readability decrease from commonalization
  • Simple helpers in test code

Change Boundary and Reference Representativeness

Prompt paths are investigation starting points. Include another repository file when evidence shows that it implements the accepted outcome, is a required dependency or wiring path, or must change to preserve a contract affected by the work. Callers, consumers, tests, configuration, imports, and data flow are useful evidence rather than a required checklist.

When adopting a pattern, API, or dependency, inspect the relevant feature and repository uses that share its responsibility and current contract. Prefer the compatible implementation in that responsibility. Frequency helps locate candidates but does not make a pattern authoritative; when approaches coexist, use their callers, lifecycle, and compatibility to distinguish the current pattern from a legacy or unrelated one.

Resolve external dependency versions from manifests, lockfiles, and compatible consumers. Escalate only when those sources cannot resolve a choice that changes compatibility or architecture.

Common Failure Patterns and Avoidance Methods

Pattern 1: Error Fix Chain

Symptom: Fixing one error causes new errors Cause: Surface-level fixes without understanding root cause Avoidance: Identify root cause with 5 Whys before fixing

Pattern 2: Circumventing Type Guarantees

Symptom: any or as declares a type that no check or contract establishes Cause: Impulse to avoid type errors Avoidance: Apply the evidence criteria in Type Safety Fundamentals.

Pattern 3: Implementation Without Sufficient Testing

Symptom: Many bugs after implementation Cause: Ignoring Red-Green-Refactor process Avoidance: Start behavior changes with a failing test that demonstrates the required outcome

Pattern 4: Ignoring Technical Uncertainty

Symptom: Frequent unexpected errors when introducing new technology Cause: Assuming "it should work according to official documentation" without prior investigation Avoidance:

  • Record certainty evaluation at the beginning of task files
  • Treat certainty as low when repository evidence, a version-matched primary source, or a runnable local check cannot confirm an outcome-relevant behavior; create the smallest verification that resolves that behavior before implementation
Pattern 5: Insufficient Existing Code Investigation

Symptom: Duplicate implementations, architecture inconsistency, integration failures, adopting outdated patterns Cause: Insufficient understanding of existing code before implementation; referencing only nearby files without verifying representativeness Avoidance Methods:

  • Before implementation, search for similar functionality using domain, responsibility, and configuration-pattern keywords
  • Similar functionality found -> Use or extend that implementation when it satisfies the current contract
  • Similar functionality is technical debt -> Repair it when it blocks the current outcome, was caused by the current change, or lies in confirmed scope; otherwise report it separately. Create an ADR when the repair requires an architectural decision
  • No similar functionality exists -> Implement new functionality following existing design philosophy
  • Record every decision and its rationale in the artifact the current workflow assigns to it
  • Reference representativeness check: See the "Change Boundary and Reference Representativeness" section above

Debugging Techniques

5 Whys - Root Cause Analysis

Trace each answer to observed evidence until reaching a cause whose correction prevents the original failure. Record each question, evidence, and the final causal link; stop when the next answer would be speculation and name the evidence needed.

Show full SKILL.md (804 more words)Show less

Type Safety Fundamentals

Type Safety Principle: Base type narrowing on runtime checks or an established contract. A type guard must guarantee only what its checks establish.

  • Use unknown for input whose structure is not established, and validate the properties needed by the consumer.
  • Use generics, unions, or intersections to express type relationships and variants.
  • Place assertions based on verified SDK or framework contracts at the relevant boundary. When static analysis cannot express that contract, scope any suppression to the affected rule and document the contract evidence and the assertion's scope.

Type Complexity Management

  • Field Count: Up to 20 (split by responsibility if exceeded, external API types are exceptions)
  • Optional Ratio: Up to 30% (separate required/optional if exceeded)
  • Nesting Depth: Up to 3 levels (flatten if exceeded)
  • External API Types: Relax constraints and define according to reality (convert appropriately internally)

Refactoring Techniques

Basic Policy

  • Small Steps: Keep the nearest applicable tests and static checks passing after each behavior-preserving refactor
  • Safe Changes: Change one refactoring responsibility at a time and verify its observable behavior before the next responsibility
  • Behavior Guarantee: Ensure existing behavior remains unchanged while proceeding

Implementation Procedure: Understand Current State -> Gradual Changes -> Behavior Verification -> Final Validation

Priority: Duplicate Code Removal > Large Function Division > Complex Conditional Branch Simplification > Type Safety Improvement

Implementation Completeness Assurance

Impact Tracing

Before implementation, trace callers, dependencies, and data flow (generation -> modification -> reference) of the changed code until another file cannot change the change boundary defined in Change Boundary and Reference Representativeness. Carry the direct and indirect impact that the implementation or its verification relies on into that work.

Unused Code Deletion Rule

When unused code is detected, determine from current requirements and reachable call paths whether it is used before task completion.

  • Yes -> connect it to that call path and verify the requirement
  • No -> remove it; version control retains the prior implementation

Target: Code, documentation, configuration files

Red-Green-Refactor Process (Test-First Development)

Recommended Principle: Start behavior changes with a test that fails for the required reason

Development Steps:

  1. Red: Write test for expected behavior (it fails)
  2. Green: Pass test with minimal implementation
  3. Refactor: Improve code while maintaining passing tests

Direct-verification cases:

  • Pure configuration file changes (.env, config, etc.)
  • Documentation-only updates (README, comments, etc.)
  • Emergency production incident response (post-incident tests mandatory)

Test Design Principles

Test Case Structure
  • Tests consist of three stages: "Arrange," "Act," "Assert"
  • Test names state the trigger and observable result
  • One test case verifies only one behavior
Test Data Management
  • Manage test data in dedicated directories
  • Define test-specific environment variable values
  • Use synthetic, non-sensitive values for credentials, tokens, personal data, and payment data in tests
  • Keep test data minimal, using only data directly related to test case verification purposes
Mock and Stub Usage Policy

Recommended: Mock external dependencies in unit tests

  • Merit: Ensures test independence and reproducibility
  • Practice: Mock DB, API, file system, and other external dependencies

Unit-test boundary: Use deterministic substitutes for external connections; exercise real external boundaries in integration or E2E tests selected for that contract

Test Failure Response Decision Criteria

Fix tests: Wrong expected values, references to non-existent features, dependence on implementation details, implementation only for tests Fix implementation: Valid specifications, business logic, important edge cases Both readings remain compatible with the available requirements: Return the unresolved behavior decision — state the two candidate behaviors, the source that would settle which is correct, and the condition for stopping rather than picking one

Test Granularity Principles

Core Principle: Observable Behavior Only

Test through observable boundaries: Public APIs, return values, exceptions, external calls, and persisted state. Reach private methods, internal state, and algorithm details only through those observable boundaries.

Security Principles

Secure Defaults
  • Store credentials and secrets through environment variables or dedicated secret managers
  • Use parameterized queries (prepared statements) for all database access
  • Use established cryptographic libraries provided by the language or framework
  • Generate security-critical values (tokens, IDs, nonces) with cryptographically secure random generators
  • Encrypt sensitive data at rest and in transit using standard protocols
Input and Output Boundaries
  • Validate all external input at system entry points for expected format, type, and length
  • Encode output appropriately for its rendering context (HTML, SQL, shell, URL)
  • Return only information necessary for the caller in error responses; log detailed diagnostics server-side
Access Control
  • Apply authentication to all entry points that handle user data or trigger state changes
  • Verify authorization for each resource access, not only at the entry point
  • Grant only the permissions required for the operation (files, database connections, API scopes)
Knowledge Cutoff Supplement (2026-03)
  • OWASP Top 10:2025 shifted from symptoms to root causes; added "Software Supply Chain Failures" (A03) and "Mishandling of Exceptional Conditions" (A10)
  • Recent research indicates AI-generated code shows elevated rates of access control gaps — treat authentication and authorization as high-priority review targets
  • OpenSSF published "Security-Focused Guide for AI Code Assistant Instructions" — recommends language-specific, actionable constraints over generic advice
  • For detailed detection patterns, see references/security-checks.md

© shinpr, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in .claude/skills-en/coding-standards of shinpr/ai-coding-project-boilerplate.

  • SKILL.md
  • references/security-checks.md

Open the folder on GitHubat commit 56913a2

Compare with similar skills

Coding Standards next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Coding Standards compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Coding Standards this skillshinpr/ai-coding-project-boilerplate232—~3.8kAutomated safety check: NotesMIT
Cyclomatic Complexitysaurabhkumar8112/cyclomatic-complexity-skill405—~761Automated safety check: PassApache-2.0
Clean Codejd-solanki/slidev-theme-dracula1611 repos~3.8kAutomated safety check: PassMIT
Coding Principlesshinpr/claude-code-workflows690—~2.4kAutomated safety check: PassMIT
Rnd Code Simplifychendongqi/OPB-Skills125—~2.2kAutomated safety check: PassNone
Systematic Code Refactoringluongnv89/claude-howto42k—~3kAutomated safety check: PassMIT

Similar skills

  • Cyclomatic Complexity

    saurabhkumar8112/cyclomatic-complexity-skill

    Refactor code to reduce cyclomatic complexity so it stays readable, maintainable, and aligned with the long-term vision of the codebase, not just optimized for AI comprehension.

    405 GitHub stars~761 tokensUpdated 1 mo ago
    DevelopmentAuto-check passed
  • Clean Code

    jd-solanki/slidev-theme-dracula

    Write readable, maintainable code through disciplined naming, small functions, and clean error handling.

    161 GitHub starsUsed in 1 repo~3.8k tokens
    DevelopmentAuto-check passed
  • Coding Principles

    shinpr/claude-code-workflows

    Language-agnostic coding principles for maintainability, readability, and quality.

    690 GitHub stars~2.4k tokensUpdated 6 days ago
    DevelopmentAuto-check passed
  • Rnd Code Simplify

    chendongqi/OPB-Skills

    Expert code simplification and refactoring specialist that autonomously enhances code clarity, consistency, and maintainability while preserving exact functionality.

    125 GitHub stars~2.2k tokensUpdated 7 mo ago
    DevelopmentAuto-check passed
  • Systematic Code Refactoring

    luongnv89/claude-howto

    Guides refactoring in phases based on Martin Fowler's method: research, test coverage check, planning and small tested steps, with your approval at each phase.

    42k GitHub stars~3k tokensUpdated 7 days ago
    DevelopmentAuto-check passed
  • Dignified Python Standards

    docling-project/docling

    Applies opinionated production Python conventions chosen by the project's Python version: modern type syntax, pathlib, explicit checks and interface guidance.

    68k GitHub stars~1.5k tokensUpdated yesterday
    DevelopmentAuto-check passed

More from shinpr/ai-coding-project-boilerplate

All 42 skills in this repo
  • Integration E2E Testing

    shinpr/ai-coding-project-boilerplate

    Selects and designs the smallest integration/E2E test set that proves accepted behavior at an observable boundary.

    232 GitHub stars~2.8k tokensUpdated 3 days ago
    Auto-check passed
  • Skill Optimization

    shinpr/ai-coding-project-boilerplate

    Evaluates and optimizes skill file quality using 9 content patterns and 10 editing principles.

    232 GitHub stars~3.5k tokensUpdated 3 days ago
    Auto-check passed
  • Frontend Technical Spec

    shinpr/ai-coding-project-boilerplate

    Defines React environment, component architecture, state/data flow, build verification, and frontend non-functional criteria from repository evidence.

    232 GitHub stars~1.9k tokensUpdated 3 days ago
    Auto-check: notes
  • Frontend Typescript Rules

    shinpr/ai-coding-project-boilerplate

    Applies React/TypeScript type safety, component design, and state management rules.

    232 GitHub stars~1.7k tokensUpdated 3 days ago
    Auto-check passed
  • Implementation Approach

    shinpr/ai-coding-project-boilerplate

    Selects implementation strategy (vertical slice, horizontal, or hybrid) with risk assessment.

    232 GitHub stars~3.2k tokensUpdated 3 days ago
    Auto-check passed
  • Subagents Orchestration Guide

    shinpr/ai-coding-project-boilerplate

    Coordinates subagents through scale-based planning, approval, implementation, verification, and escalation flows.

    232 GitHub stars~8k tokensUpdated 3 days ago
    Auto-check passed

Categories

Questions about Coding Standards

What does Coding Standards do?

Detects code smells, anti-patterns, and readability issues. An agent skill from shinpr/ai-coding-project-boilerplate. Coding Standards is an agent skill from shinpr/ai-coding-project-boilerplate. Detects code smells, anti-patterns, and readability issues.

When should I use Coding Standards?

Coding Standards fits situations like: implementing features; tasks that involve Code quality; tasks that involve Refactoring.

How do I install Coding Standards in Claude Code?

Run `npx skills add shinpr/ai-coding-project-boilerplate --skill coding-standards -a claude-code`. Or copy the skill folder (.claude/skills-en/coding-standards in shinpr/ai-coding-project-boilerplate) into .claude/skills/coding-standards in your project. Claude Code loads it when a task matches its description.

How do I install Coding Standards in Codex?

Run `npx skills add shinpr/ai-coding-project-boilerplate --skill coding-standards -a codex`. Or copy the skill folder (.claude/skills-en/coding-standards in shinpr/ai-coding-project-boilerplate) into .agents/skills/coding-standards in your project. Codex loads it when a task matches its description.

Can I use Coding Standards in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add shinpr/ai-coding-project-boilerplate --skill coding-standards -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/coding-standards, .gemini/skills/coding-standards, .github/skills/coding-standards and .opencode/skills/coding-standards in your project.

What does Coding Standards need to run?

SKILL.md names no scripts, command-line tools or credentials: Coding Standards is instructions for the agent only.

Does Coding Standards access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Coding Standards safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Coding Standards use?

Coding Standards is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Coding Standards use?

About 3.8k tokens (SKILL.md is roughly 15k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1k tokens, read only when the agent opens those files.

What are the alternatives to Coding Standards?

Skills that share tags, products or a category with Coding Standards: Cyclomatic Complexity (saurabhkumar8112/cyclomatic-complexity-skill, 405 stars), Clean Code (jd-solanki/slidev-theme-dracula, 161 stars), Coding Principles (shinpr/claude-code-workflows, 690 stars) and Rnd Code Simplify (chendongqi/OPB-Skills, 125 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Coding Standards?

shinpr (a GitHub user) maintains it in shinpr/ai-coding-project-boilerplate, which has 232 GitHub stars. The repository holds 42 skills in this directory. The repository was last updated on October 4, 2026.

Source: shinpr/ai-coding-project-boilerplate on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.