Agentic Coding Patterns

Community-maintained patterns, prompts, skills, agent instructions, workflows, and lessons learned for responsible agentic coding.

Status: Active development | License: CC0-1.0 | Repo: https://github.com/GSA-TTS/agentic-coding-patterns

Agentic Coding Ecosystem

This repository is part of a three-repo ecosystem:

Repo	Purpose	When to Use
Quickstart	Get running	First day setup, SBX + USAi config
Playbook	Do it right	Repo setup, standards, best practices
Patterns (you are here)	Share & learn	Community patterns, lessons learned

This is the collaboration hub. Share what's working, learn from others, and help build a community knowledge base.

---

Quick Reference

I want to...	Go to
Use a pattern	Browse INDEX.yaml or skills/, prompts/, workflows/
Contribute a pattern	Read CONTRIBUTING.md → Copy template → Run make validate
Integrate with AI tools	See AI Agent Integration Guide
Security issues	See SECURITY.md — direct fixes preferred
Run validation locally	make setup && make validate

For sandbox harness integrations, start with the reference OpenCode or Pi kit. Pi currently provides CLI installation only, not wired USAi model configuration. See the kit catalog for other integrations and the retirement decision for migration from Prime Agent.

Purpose

This repository is a community space for sharing reusable patterns, workflows, and lessons learned.

• Behavioral standards live in the Playbook (don't duplicate them here)
• Environment setup lives in the Quickstart
• Community patterns and lessons live here

Content here is a starting point for reuse and review — it's community knowledge sharing.

What Belongs Here

• ✅ Reusable skills for common tasks (code review, documentation, testing)
• ✅ Prompt templates for planning, implementation, review
• ✅ Agent instruction patterns (AGENTS.md examples)
• ✅ Multi-step workflows
• ✅ Lessons learned from real usage
• ✅ Tool-specific examples (OpenCode, Claude, Copilot, Cursor)

What Does NOT Belong Here

• ❌ Secrets, credentials, API keys, tokens
• ❌ PII (Personally Identifiable Information)
• ❌ CUI (Controlled Unclassified Information)
• ❌ Internal URLs or system details
• ❌ Customer data or operational details
• ❌ Uncited compliance claims

Repository Structure

agentic-coding-patterns/
├── skills/              # Reusable procedures (code review, testing, documentation)
├── prompts/             # Standalone prompts for specific tasks
├── agents/              # Agent instruction patterns (AGENTS.md)
├── workflows/           # Multi-step end-to-end processes
├── lessons-learned/     # Community experiences and retrospectives
├── templates/           # Templates for creating new patterns
├── examples/            # Tool-specific integration examples
├── schemas/             # JSON Schemas for validation
└── docs/                # Documentation and guides

Quick Start

For Contributors

# Clone the repo
git clone https://github.com/GSA-TTS/agentic-coding-patterns.git
cd agentic-coding-patterns

# Install dependencies
make setup

# Optional: Install pre-commit hooks (recommended for regular contributors)
make install-hooks

# Validate content
make validate

# Generate INDEX.yaml
make generate

# Run tests with coverage report
make coverage

Note: Pre-commit hooks are opt-in. Use make install-hooks to enable automatic checks on commit. CI enforces all checks regardless of local hook installation.

For Users

Human users:

1. Browse available patterns in INDEX.yaml or by directory

2. Use the pattern discovery CLI:

   # Search by tag
   python scripts/search_patterns.py --tag security
   
   # Filter by status (e.g. experimental — the default for new patterns).
   # Note: `recommended` is populated only via the peer-review promotion gate
   # (see docs/security-skill-promotion-checklist.md); no patterns are promoted yet,
   # so `--status recommended` currently returns nothing.
   python scripts/search_patterns.py --status experimental
   
   # Combined filters
   python scripts/search_patterns.py --tag security --tool opencode

3. Copy pattern directory to your project

4. Adapt frontmatter and content to your needs

5. Review and test before production use

AI agents:

1. Parse INDEX.yaml for pattern discovery (see AI Agent Guide)
2. Use the CLI for filtering: python scripts/search_patterns.py --json --tag <tag>
3. Filter patterns by type, status, tags, and portability flags
4. Read frontmatter to understand input/output contracts
5. Validate against prohibited_content before using

INDEX.yaml structure:

schema_version: "1.0"
repo: GSA-TTS/agentic-coding-patterns
patterns:
  skills: [{id, path, title, status, type}, ...]
  prompts: [...]
  agents: [...]
stats:
  total_patterns: <N>

Content Status Levels

Status	Meaning	Use When
experimental	New, untested in production	Exploring, testing
recommended	Proven useful, peer-reviewed	Production use
deprecated	Superseded by newer pattern	Migration only

Default for new contributions: experimental

Security Skills Pack

A curated set of skills for security review and secure authoring. Every skill declares categories: [security], which triggers extra governance: a required human review, a deny-by-default tool/network/write/script policy, and explicit risk_tier. Policy authority lives in the playbook — this pack references it rather than restating it.

• Governance model: docs/security-skill-governance.md
• Agent routing (which skill for which trigger): docs/AI-AGENT-GUIDE.md
• Taxonomy: categories is a closed vocabulary (see schemas/skill.schema.json); security is the axis that gates this pack.

Skill	Risk	Use it for
secure-code-review	moderate	Reviewing a code change or diff for vulnerabilities
agentic-actions-auditor	high	Auditing a GitHub Actions workflow for unsafe triggers/privilege
least-privilege-review	moderate	Checking permissions/GITHUB_TOKEN scope for over-grant
untrusted-input-boundary-review	moderate	Prompt-injection / trust-boundary analysis of untrusted input
backdoor-review	high	Hunting for backdoors, auth bypass, hidden persistence
dependency-analysis	moderate	Supply-chain / dependency vulnerability assessment
compliance-claim-checker	low	Verifying a FedRAMP/NIST compliance claim against evidence
incident-evidence-review	high	Postmortem / incident evidence-discipline review
safe-shell-script-author	moderate	Authoring a shell script that must pass the unsafe-shell scanner

Human-review gate: security skills are human_review_required: true. An agent may apply one, but promotion experimental → recommended and any change to a security skill require human sign-off — see the human-review gates.

Executive Technical Explainer Skills

A set of communications skills for explaining software development, agentic coding, and security controls to executive / non-engineering audiences — accurately, without hype, and without making an engineer wince at the inaccuracies. They are evidence-grounded: security and process claims cite the playbook and quickstart as ground truth, and they preserve the honest limits (the sandbox is isolation, not a perfect guarantee; the precise secrets caveat; the agent cannot approve or merge its own work).

Skill	Use it for
technical-concept-translator	Explaining one concept (PR, sandbox, agent vs. model vs. harness, AGENTS.md, secret) to an executive
software-delivery-explainer	Showing where agents act and where the human control points are in the delivery process
agentic-value-analyst	Framing organizational value without hype; evidence-labeled claims, defensible metrics

These compose into the design-artifact workflow's technical-explainer profile. Any team can use them independently of a leadership-briefing use case — they are a reusable capability for turning technical material into accurate executive explanations. Reference material (an executive concept library, six audience profiles, and evidence/measurement guidance) ships alongside the skills.

Contributing

See CONTRIBUTING.md for full guidelines.

Quick version:

1. Use a template from templates/
2. Fill in frontmatter (all required fields)
3. Write clear, reusable content
4. No secrets, PII, or CUI
5. Run make validate before commit
6. Submit PR with review checklist

Safety Requirements

All patterns MUST:

• Define prohibited_content in frontmatter
• Use placeholders for environment-specific values
• Pass sensitive term scanning
• Include human review checklist

See docs/safety-guidance.md for details.

Validation

make validate    # Run all validators
make test        # Run tests
make ci          # Full CI check

Tool Compatibility

Patterns track compatibility via portability frontmatter:

• opencode: OpenCode SKILL.md format
• cursor: Cursor .cursorrules
• claude_projects: Claude Projects
• chatgpt: ChatGPT custom instructions
• generic_llm: Generic LLM prompting

License

This repository is released under CC0-1.0 (public domain). Content is provided as-is with no warranties.

Getting Help

• Questions: Open a GitHub issue or start a discussion
• Browse docs: See docs/ for guides
• Improvement ideas: Open an issue or submit a PR
• Relationship to other repos: See docs/repository-ecosystem.md

See Also

• Contributing Guide — How to add patterns
• AI Agent Integration Guide — Programmatic pattern access
• Security Policy — Direct fixes preferred
• Playbook — Standards and best practices
• Quickstart — Execution environment setup

---

Note: Review and test all patterns before production use. Tailor to your specific requirements.

Development Setup

Pre-commit Hooks

This repository uses pre-commit hooks for code quality and security:

# Install pre-commit (if not already installed)
pip install pre-commit

# Install the git hook scripts
pre-commit install

# (Optional) Run against all files
pre-commit run --all-files

Hooks configured:

• gitleaks — Secret detection (critical for example code)
• ruff — Python linting and formatting with security rules
• markdownlint — Markdown formatting
• Pattern validation — Frontmatter schema validation
• Basic hygiene — YAML/JSON/TOML validation, trailing whitespace, etc.

GitHub Actions security scanning (CI, not a local hook):

zizmor runs in CI via .github/workflows/zizmor.yml on workflow-file changes — it is intentionally not a local pre-commit hook. You can also run it manually:

zizmor .github/workflows/

Install locally (optional): cargo install zizmor or brew install zizmor.

See .pre-commit-config.yaml for full configuration.