Agent skill

Clean Code

by xenitV1 in xenitV1/claude-code-maestro

The Foundation Skill. An agent skill from xenitV1/claude-code-maestro.

MITAuto-check passedDevelopment

Install Clean Code

skills CLI

$ npx skills add xenitV1/claude-code-maestro --skill clean-code -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install xenitV1/claude-code-maestro clean-code --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/xenitV1/claude-code-maestro.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/clean-code .claude/skills/clean-code && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "clean-code" agent skill from https://github.com/xenitV1/claude-code-maestro/tree/main/skills/clean-code into .claude/skills/clean-code/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "clean-code", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/xenitV1/claude-code-maestro/tree/main/skills/clean-code

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add xenitV1/claude-code-maestro --skill clean-code -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install xenitV1/claude-code-maestro clean-code --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/xenitV1/claude-code-maestro.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/clean-code .agents/skills/clean-code && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "clean-code" agent skill from https://github.com/xenitV1/claude-code-maestro/tree/main/skills/clean-code into .agents/skills/clean-code/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "clean-code", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add xenitV1/claude-code-maestro --skill clean-code -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install xenitV1/claude-code-maestro clean-code --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/xenitV1/claude-code-maestro.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/clean-code .cursor/skills/clean-code && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "clean-code" agent skill from https://github.com/xenitV1/claude-code-maestro/tree/main/skills/clean-code into .cursor/skills/clean-code/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "clean-code", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/xenitV1/claude-code-maestro.git --path skills/clean-code

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add xenitV1/claude-code-maestro --skill clean-code -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install xenitV1/claude-code-maestro clean-code --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/xenitV1/claude-code-maestro.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/clean-code .gemini/skills/clean-code && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "clean-code" agent skill from https://github.com/xenitV1/claude-code-maestro/tree/main/skills/clean-code into .gemini/skills/clean-code/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "clean-code", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install xenitV1/claude-code-maestro clean-code

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add xenitV1/claude-code-maestro --skill clean-code -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/xenitV1/claude-code-maestro.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/clean-code .github/skills/clean-code && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "clean-code" agent skill from https://github.com/xenitV1/claude-code-maestro/tree/main/skills/clean-code into .github/skills/clean-code/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "clean-code", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add xenitV1/claude-code-maestro --skill clean-code -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install xenitV1/claude-code-maestro clean-code --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/xenitV1/claude-code-maestro.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/clean-code .opencode/skills/clean-code && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "clean-code" agent skill from https://github.com/xenitV1/claude-code-maestro/tree/main/skills/clean-code into .opencode/skills/clean-code/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "clean-code", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: clean-code
GitHub stars: 229
Token cost: ~1.5k tokens
SKILL.md length: 588 words
Files: 1
Skills in repo: 13
Repo updated: Jan 24, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

The Foundation Skill. An agent skill from xenitV1/claude-code-maestro.

Works in 4 steps: Verify before import - npm search or pip… → Prefer battle-tested - lodash, date-fns,… → Check npm audit / pip-audit before… → …
ALL code output - prevents hallucinations
SKILL.md covers 🚨 IRON LAWS, 📦 PROTOCOL 1: SUPPLY CHAIN…, 🔐 PROTOCOL 2: SECURITY-FIRST… and 🏗️ PROTOCOL 3: NO LAZY…, plus 6 more sections
Calls npm and pip

What it does

Clean Code is an agent skill from xenitV1/claude-code-maestro. The Foundation Skill. LLM Firewall + 2025 Security + Cross-Skill Coordination. Use for ALL code output - prevents hallucinations, enforces security, ensures quality.

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Development, covering Code quality. The licence is MIT.

When your agent uses it

ALL code output - prevents hallucinations
Enforces security
Ensures quality

Example prompts

“/clean-code”

Requirements

Node.js

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

Verify before import - npm search or pip show for unfamiliar packages
Prefer battle-tested - lodash, date-fns, zod over obscure alternatives
Check npm audit / pip-audit before adding new dependencies
Pin versions in production - no ^ or ~ for critical deps

What it can do on your machine

Read from SKILL.md and the folder at commit 924315b. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- npm
- pip
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use npm and pip, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Clean Code loads about 1.5k tokens when it runs. Until then it costs about 44 tokens; SKILL.md has 588 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~44
When it runs · the whole SKILL.md, loaded when a task matches: ~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from xenitV1/claude-code-maestro at commit 924315b, republished under its MIT licence (© xenitV1). 588 words, ~1,498 tokens.

Download SKILL.mdSave it as .claude/skills/clean-code/SKILL.md (or your agent's skills folder).

name: clean-code
description: The Foundation Skill. LLM Firewall + 2025 Security + Cross-Skill Coordination. Use for ALL code output - prevents hallucinations, enforces security, ensures quality.

<domain_overview>

🛡️ CLEAN CODE: THE FOUNDATION

Philosophy: This skill is the FOUNDATION - it applies to ALL other skills. Every piece of code must pass these gates. ALGORITHMIC ELEGANCE MANDATE (CRITICAL): Never prioritize "clever" code over readable, intent-revealing engineering. AI-generated code often fails by introducing unnecessary abstractions or using vague naming conventions that obscure logic. You MUST use intent-revealing names for every variable and function. Any implementation that increases cognitive complexity without a proportional gain in performance or scalability must be rejected. Avoid "Hype-Driven Development"—proven patterns trump trending but unstable frameworks. </domain_overview> <iron_laws>

🚨 IRON LAWS

1. NO HALLUCINATED PACKAGES - Verify before import
2. NO LAZY PLACEHOLDERS - Code must be runnable
3. NO SECURITY SHORTCUTS - Production-ready defaults
4. NO OVER-ENGINEERING - Simplest solution first

</iron_laws> <security_protocols>

📦 PROTOCOL 1: SUPPLY CHAIN SECURITY

LLMs hallucinate packages that sound real but don't exist.

Verify before import - npm search or pip show for unfamiliar packages
Prefer battle-tested - lodash, date-fns, zod over obscure alternatives
Check npm audit / pip-audit before adding new dependencies
Pin versions in production - no ^ or ~ for critical deps 2025 AI Package Risks:

Never import AI "wrapper" libraries without verification
LLM SDKs: Use official only (openai, anthropic, google-generativeai)
Vector DBs: Stick to established (pinecone, weaviate, chromadb)

🔐 PROTOCOL 2: SECURITY-FIRST DEFAULTS

Frontend Security:

Forbidden	Required
`dangerouslySetInnerHTML`	DOMPurify sanitization
Inline event handlers	Event delegation
`eval()`, `new Function()`	Static code only
Storing tokens in localStorage	httpOnly cookies
Backend Security:
Forbidden	Required
-----------	----------
`CORS: *`	Explicit origin whitelist
Raw SQL strings	Parameterized queries
`chmod 777`	Principle of least privilege
Hardcoded secrets	Environment variables + validation
API Security (2025):

Rate limiting on ALL public endpoints
Input validation at the gate (Zod/Pydantic)
Output sanitization for AI-generated content
PASETO > JWT for new projects </security_protocols> <modularity_and_placeholder_rules>

🏗️ PROTOCOL 3: NO LAZY PLACEHOLDERS

Forbidden Patterns:

javascript

// ❌ BANNED
// TODO: Implement this
// ... logic goes here
function placeholder() { }
throw new Error('Not implemented');

Required:

Every function must be runnable
If too complex, break into smaller complete functions
"Hurry" is not an excuse - write minimal viable implementation

📐 PROTOCOL 4: MODULARITY & STRUCTURE

The 50/300 Rule:

Functions > 50 lines → Break down

Files > 300 lines → Split into modules SOLID Principles:

Principle	Quick Check
Single Responsibility	Does this do ONE thing?
Open/Closed	Can I extend without modifying?
Liskov Substitution	Can subtypes replace parent?
Interface Segregation	Are interfaces minimal?
Dependency Inversion	Do I depend on abstractions?
</modularity_and_placeholder_rules>
<complexity_and_dependencies>

Show full SKILL.md (247 more words)Show less

🎯 PROTOCOL 5: COMPLEXITY CAP

Native First:

javascript

// ❌ Don't install is-odd
npm install is-odd
// ✅ Use native
const isOdd = n => n % 2 !== 0;

Anti-Patterns:

AbstractFactoryBuilderManager for simple functions
10 layers of abstraction for CRUD
"Future-proofing" for requirements that don't exist YAGNI: You Aren't Gonna Need It. Build for today's requirements.

🔄 PROTOCOL 6: DEPENDENCY HYGIENE

Freshness Check:

bash

npm outdated      # Check for updates
npm audit         # Check for vulnerabilities

The CVE Brake:

"Latest" is not always "Safest"
If latest has Critical CVE → Rollback to last secure version
Security > New Features 2025 Recommended:
Category Recommended
Validation zod, valibot
HTTP ky, ofetch
State zustand, jotai
ORM drizzle, prisma
Auth lucia, better-auth
</complexity_and_dependencies>
<ai_era_protocols>

Category	Recommended
Validation	zod, valibot
HTTP	ky, ofetch
State	zustand, jotai
ORM	drizzle, prisma
Auth	lucia, better-auth
</complexity_and_dependencies>
<ai_era_protocols>

🤖 PROTOCOL 7: AI-ERA CONSIDERATIONS

When Building AI Features:

Validate AI outputs - Never trust raw LLM responses
Rate limit AI calls - Prevent cost explosions
Sanitize before display - AI can generate malicious content
Log AI interactions - For debugging and compliance When AI is Writing Code:
Verify imports exist - AI hallucinates packages
Check types are correct - AI guesses at APIs
Test edge cases - AI misses boundary conditions
Review security - AI takes shortcuts </ai_era_protocols> <audit_and_reference>

✅ QUICK AUDIT CHECKLIST

Before committing ANY code:

No hallucinated imports (verified packages exist)
No security shortcuts (CORS, eval, hardcoded secrets)
No lazy placeholders (// TODO, empty functions)
Functions < 50 lines, files < 300 lines
Dependencies audited (npm audit clean)
Types are strict (no any)

🔗 CROSS-SKILL INTEGRATION

When Using...	Clean Code Adds...
`@frontend-design`	Security defaults, no eval, CSP awareness
`@backend-design`	Input validation, no raw SQL, Zero Trust
`@tdd-mastery`	No placeholders (tests enforce completeness)
`@planning-mastery`	Modularity guides task breakdown
`@brainstorming`	SOLID/YAGNI guide architecture decisions
`@debug-mastery`	Logging standards, no silent failures
</audit_and_reference>

Files

Just SKILL.md in skills/clean-code of xenitV1/claude-code-maestro.

Open the folder on GitHubat commit 924315b

Compare with similar skills

Clean Code next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Clean Code compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Clean Code this skillxenitV1/claude-code-maestro	229	—	~1.5k	Automated safety check: Pass	MIT	8 mo ago
Install Anti-Slop Oxlint Rulesdmmulroy/anti-slop	5.3k	1 repos	~2.2k	Automated safety check: Pass	MIT	28 days ago
WooCommerce Code Reviewwoocommerce/woocommerce	11k	3 repos	~1.1k	Automated safety check: Pass	Custom licence	today
Systematic Code Refactoringluongnv89/claude-howto	42k	—	~3k	Automated safety check: Pass	MIT	8 days ago
Constraint-Driven Developmentaddyosmani/agent-skills	103k	2 repos	~5.2k	Automated safety check: Pass	MIT	4 days ago
Skill Doli Code ReviewDolibarr/dolibarr	7.7k	1 repos	~1.1k	Automated safety check: Pass	MIT	today

Similar skills

Install Anti-Slop Oxlint Rules
dmmulroy/anti-slop
Installs, updates or migrates the vendored anti-slop Oxlint plugin in a repository, keeping local rule changes and the plugin's license and provenance files.
5.3k GitHub starsUsed in 1 repo~2.2k tokens
DevelopmentAuto-check passed
WooCommerce Code Review
woocommerce/woocommerce
Reviews WooCommerce code changes against the project's standards, flagging backend PHP architecture, naming, documentation, data integrity and testing violations.
11k GitHub starsUsed in 3 repos~1.1k tokens
DevelopmentAuto-check passed
Systematic Code Refactoring
luongnv89/claude-howto
Guides refactoring in phases based on Martin Fowler's method: research, test coverage check, planning and small tested steps, with your approval at each phase.
42k GitHub stars~3k tokensUpdated 8 days ago
DevelopmentAuto-check passed
Constraint-Driven Development
addyosmani/agent-skills
Records a project's quality bar in CONSTRAINTS.md and watches diffs for signs an agent quietly weakened it, such as suppressions, skipped tests or lowered thresholds.
103k GitHub starsUsed in 2 repos~5.2k tokens
DevelopmentAuto-check passed
Skill Doli Code Review
Dolibarr/dolibarr
Reviews Dolibarr PHP code for compliance with coding standards and security best practices, and fixes identified issues.
7.7k GitHub starsUsed in 1 repo~1.1k tokens
DevelopmentAuto-check passed
Ponytail Lazy Developer Mode
DietrichGebert/ponytail
Makes the agent pick the laziest solution that works: skip unneeded work, reuse what exists, prefer the standard library and platform features, and keep diffs small.
158k GitHub stars~871 tokensUpdated today
DevelopmentAuto-check passed

Questions about Clean Code

What does Clean Code do?

The Foundation Skill. An agent skill from xenitV1/claude-code-maestro. Clean Code is an agent skill from xenitV1/claude-code-maestro. The Foundation Skill.

When should I use Clean Code?

Clean Code fits situations like: ALL code output - prevents hallucinations; enforces security; ensures quality.

How do I install Clean Code in Claude Code?

Run `npx skills add xenitV1/claude-code-maestro --skill clean-code -a claude-code`. Or copy the skill folder (skills/clean-code in xenitV1/claude-code-maestro) into .claude/skills/clean-code in your project. Claude Code loads it when a task matches its description.

How do I install Clean Code in Codex?

Run `npx skills add xenitV1/claude-code-maestro --skill clean-code -a codex`. Or copy the skill folder (skills/clean-code in xenitV1/claude-code-maestro) into .agents/skills/clean-code in your project. Codex loads it when a task matches its description.

Can I use Clean Code in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add xenitV1/claude-code-maestro --skill clean-code -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/clean-code, .gemini/skills/clean-code, .github/skills/clean-code and .opencode/skills/clean-code in your project.

What does Clean Code need to run?

Going by SKILL.md and its folder, Clean Code needs the command-line tools its instructions call (npm and pip). Our summary lists: Node.js.

Does Clean Code access the network?

SKILL.md contains no URLs. Its commands use npm and pip, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Clean Code safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Clean Code use?

Clean Code is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Clean Code use?

About 1.5k tokens (SKILL.md is roughly 6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Clean Code?

Skills that share tags, products or a category with Clean Code: Install Anti-Slop Oxlint Rules (dmmulroy/anti-slop, 5.3k stars), WooCommerce Code Review (woocommerce/woocommerce, 11k stars), Systematic Code Refactoring (luongnv89/claude-howto, 42k stars) and Constraint-Driven Development (addyosmani/agent-skills, 103k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Clean Code?

xenitV1 (a GitHub user) maintains it in xenitV1/claude-code-maestro, which has 229 GitHub stars. The repository holds 13 skills in this directory. The repository was last updated on January 24, 2026.

Source: xenitV1/claude-code-maestro on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Clean Code

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

🛡️ CLEAN CODE: THE FOUNDATION

🚨 IRON LAWS

📦 PROTOCOL 1: SUPPLY CHAIN SECURITY

🔐 PROTOCOL 2: SECURITY-FIRST DEFAULTS

🏗️ PROTOCOL 3: NO LAZY PLACEHOLDERS

📐 PROTOCOL 4: MODULARITY & STRUCTURE

🎯 PROTOCOL 5: COMPLEXITY CAP

🔄 PROTOCOL 6: DEPENDENCY HYGIENE

🤖 PROTOCOL 7: AI-ERA CONSIDERATIONS

✅ QUICK AUDIT CHECKLIST

🔗 CROSS-SKILL INTEGRATION

Files

Compare with similar skills

Similar skills

More from xenitV1/claude-code-maestro

Related

Questions about Clean Code