security-guardrails

Agent Powerups

Oh My Zsh for coding agents.

Quickstart · Agent Quickstart · Plugins · Installation · Security Model · Contributing

Agent Powerups is an Oh My Zsh-style collection of reusable skills, slash commands, MCP configs, hooks, AGENTS.md templates, and workflows for coding agents.

Today, this repo ships:

• reusable skills
• safe local CLI (apx) with runnable local checks
• persistent Gemini relay for always-active secondary-agent delegation
• validation and requirement-check scripts
• verified local GitHub MCP check, smoke, and install flow
• command, hook, workflow, examples, and AGENTS.md templates
• plugins with native install, marketplace metadata, and apx plugins inspection (apx plugins list)
• user-intent profiles with apx profiles for curated skill/plugin sets

Native install is direct for humans. Safety boundaries stay around external tools, secrets, shell profiles, and MCP enablement.

What Is Here

Path	Status	Notes
skills/	shipped	Reusable agent workflows such as systematic-debugging and writing-plans
mcp/	shipped	Local-first GitHub MCP config with check, smoke, and explicit install commands
agents-md/	shipped	Starter AGENTS.md templates
commands/	shipped	Review-first command prompts plus safe runnable checks
hooks/	shipped	Review-before-use hook recipes plus safe runnable checks
workflows/	shipped	Scenario guides
plugins/	shipped	Plugins with local-first discovery, validation, native install, and marketplace metadata (apx plugins list)
scripts/	shipped	Validation and tool-check helpers for this repo
examples/	shipped	Minimal safe setup examples

Agent Quickstart

If you are an agent working in a repo with Agent Powerups available, route tasks to capabilities yourself instead of waiting to be told:

1. Match first. On Claude Code the host already lists skills natively — match the task to the narrowest fitting skill (plus obvious fits like no-fluff). On Codex, Gemini, or generic agents, start with apx discover.

2. Discover the rest — anything not natively loaded (MCP configs, hooks, AGENTS.md templates, installed-only assets):

   apx discover "<the user's task>" --target <codex|claude-code|gemini|generic> --json
   apx info <chosen-asset>     # what it is, when to use it, source path, next action
   

3. Read, apply, verify. Read the asset's SKILL.md (or file) before applying it; run apx check <asset> only if it declares external requirements; then verify the result against the task.

4. Gate risky assets. MCP configs and hooks are review-before-use — surface them for approval, never auto-enable.

Quickstart

Using npm (Recommended)

npm install -g agent-powerups
apx install claude --full