Agent Toolbox

A growing collection of reusable AI agent skills, policies, and workflows for everyday development. Start with clear commit messages and explicit security boundaries, then adapt the tools to your project.

Quick start · Start contributing · Contribution guide

Quick start

Use an AI coding assistant that can read repository files and run Git commands. These skills are Markdown instructions; no package installation is needed. Node.js is only needed for the demo tests.

1. Copy .codex/skills/good-commit/SKILL.md into the same path in your own Git repository.

2. Make a small change, such as clarifying a setup sentence in your README.

3. Ask your assistant:

   Read .codex/skills/good-commit/SKILL.md and propose a commit message for my current changes.
   

4. Review the proposed message. For that README edit, an illustrative result is:

   docs(readme): 📝 clarify setup instructions
   

The proposal does not stage, commit, or push changes. If anything is staged, the message describes the staged patch only. To use /skill-commit, merge the shortcut instructions from AGENTS.md into your project's existing instructions.

Read the partially staged changes walkthrough for a worked example.

Start contributing

Small documentation fixes and first-time contributions are welcome. Start with the contribution guide, check the issue discussion and existing PRs, then choose a focused task:

• Document a breaking-change commit and migration (#8).
• Show how to separate unrelated changes (#7).
• Explain read-only database access with a fictional example (#3).

Browse open beginner issues. Questions and documentation reviews are useful contributions too.

🎬 Good Commit Demo

See how the Good Commit skill proposes a Conventional Commit message from your Git changes without automatically committing or pushing.

What's included

Resource	Purpose
Good Commit	Propose Conventional Commit messages with a scope and semantic emoji.
Security Guardian	Define approval requirements, file access boundaries, and database access rules.
Project instructions	Route the /skill-commit shortcut to the commit skill.
Todo demo	Provide a small JavaScript example for trying the commit workflow.

Get started

git clone https://github.com/zmo2s/agent-toolbox.git
cd agent-toolbox

Explore the resources below, or copy the ones you need into your own project.

Security Guardian

The Security Guardian skill describes a default-deny, least-privilege policy for agent-assisted work:

For the threat model, trust boundaries, recommended mitigations, and limitations of instruction-based safeguards, see the Security Guardian threat model.

• Explain each command's purpose, scope, and risks before requesting approval.
• Require approval before file modifications and keep access within approved directories, including symlink targets.
• Never silently rewrite Git history, install packages, run remote scripts, or disable security controls.
• Require authorization for network access; prohibit deployment and external publishing under the policy as written.
• Keep secrets out of responses and logs, and never use production credentials.
• Access databases only through a configured user with database-enforced read-only permissions. If none is configured, stop without falling back to another account.
• Report verified findings, suspected risks, and checks actually performed.

Use it in your project

1. Copy .codex/skills/security-guardian/ into your repository's .codex/skills/ folder.
2. Review the policy and define the approved directories and task scope.
3. Explicitly instruct your agent to read and follow it before starting work.
4. Configure actual filesystem, network, and database permissions to match your intended restrictions.

Example instruction:

Use the security-guardian skill at .codex/skills/security-guardian/SKILL.md for this task. Limit file access to this repository. Explain proposed commands and changes, and wait for my approval before executing them.

This skill provides policy instructions, not enforced security controls. It does not enforce permissions, prevent every unsafe action, or replace sandboxing and human review.

Good Commit

The Good Commit skill inspects Git changes and proposes a concrete message. A bare request does not authorize staging, committing, or pushing.

Edit the todo demo or a test, then send:

/skill-commit

The project's AGENTS.md routes this text shortcut to the skill. It is a project instruction, not a native slash-menu autocomplete entry.

You can also ask:

Use the good-commit skill to prepare a commit message for my current changes.

Responses use blue markers (🔷 / 🔹) to distinguish the proposal, changes, checks, and Git status. Every copyable commit subject uses:

<type>(<scope>): <emoji> <description>

For example:

fix(core): 🐛 reject empty todo titles
docs(security): 📝 add guardian policy with read-only database rules

The skill distinguishes staged and unstaged changes, flags breaking changes, and proposes separate commits for unrelated work.

See the no-changes example for the response when the working tree is clean.

To reuse it, copy .codex/skills/good-commit/SKILL.md and merge the shortcut instructions from AGENTS.md into your project's existing instructions.

Run the demo tests

With Node.js installed:

npm test

Structure

agent-toolbox/
├── .codex/skills/
│   ├── good-commit/SKILL.md
│   └── security-guardian/SKILL.md
├── AGENTS.md
├── src/todo.js
├── test/todo.test.js
├── package.json
├── LICENSE
└── README.md

Contributing

Ideas, improvements, and pull requests are welcome! Help improve existing policies, add reusable skills, or share practical workflows.

Start with the contribution guide for fork and branch instructions, skill structure, and checks before opening a PR. Small documentation fixes are welcome too.

Keep each PR focused, explain the problem it solves, and include usage examples and any checks you performed. For security-related changes, describe what the policy asks an agent to do and which protections require external enforcement.

License

See LICENSE for the license terms.