PhotoStructure coding skills

A dual Codex and Claude Code plugin marketplace for disciplined planning, proof-based review, focused Git history, web and Electron security, modern C++ native development, and maintainable Rust projects. Every skill is packaged natively for both products.

The coding plugin contains general engineering workflows, including a plain-language editing pass for technical prose. The security plugin pairs proof-gated JavaScript/TypeScript web and Electron vulnerability review with applicability-aware OWASP ASVS and Electron Security Checklist hardening assessments. The cpp plugin provides the corresponding defect-review and build-hardening pair for modern C++ and Node.js native addons. The rust plugin sets up or assesses idiomatic safe Rust projects, including Cargo policy, strict usable linting, testing, CI, packaging, and publishing preparation.

Skills

The workflows are documented in depth at photostructure.com/coding. License and source attribution remain alongside the skills that adapt or synthesize external guidance.

Install in Codex

Add this GitHub repository as a marketplace, then install any plugins you want:

codex plugin marketplace add photostructure/coding-skills
codex plugin add coding@photostructure
codex plugin add security@photostructure
codex plugin add cpp@photostructure
codex plugin add rust@photostructure

Enter /plugins in the Codex CLI to browse configured marketplaces and manage plugins. Start a new task after installation so Codex discovers the bundled skills.

Type $ in a prompt to select a skill explicitly. Installed plugin skills are namespaced by plugin, for example:

$coding:replan
$coding:review
$coding:stage
$coding:write-clearly
$security:web-security-review
$security:web-security-hardening
$cpp:resource-review
$cpp:project-setup
$rust:project-setup

Codex can also invoke a skill implicitly when the request matches its description.

Test locally in Codex

Use a disposable, empty directory as CODEX_HOME so development installs do not affect your normal Codex configuration. Set that environment variable using your shell's normal syntax, then run:

codex plugin marketplace add /absolute/path/to/coding-skills
codex plugin list
codex plugin add coding@photostructure
codex plugin add security@photostructure
codex plugin add cpp@photostructure
codex plugin add rust@photostructure
codex plugin list

Confirm the versions reported by codex plugin list match each plugin's .codex-plugin/plugin.json, then start a fresh Codex task under the same disposable CODEX_HOME and verify the $ skill picker lists every skill in the table above. Remove only that disposable directory when finished.

Install in Claude Code

The original Claude Code marketplace and manifests remain supported:

/plugin marketplace add photostructure/coding-skills
/plugin install coding@photostructure
/plugin install security@photostructure
/plugin install cpp@photostructure
/plugin install rust@photostructure

Invoke Claude Code skills with their plugin namespace:

/coding:replan
/coding:review
/coding:gitplan
/coding:write-clearly
/security:web-security-review
/security:web-security-hardening
/cpp:resource-review
/cpp:project-setup
/rust:project-setup

Test locally in Claude Code

Point Claude Code at the repository root instead of the GitHub shorthand:

/plugin marketplace add /absolute/path/to/coding-skills
/plugin install coding@photostructure
/plugin install security@photostructure
/plugin install cpp@photostructure
/plugin install rust@photostructure

Start a new task after installing or updating a plugin before testing its skills.

The gitplan and stage skills teach an agent to curate the index. For the same discipline by hand, photostructure/git-tools has git addgrep, git restage, and git post-fmt as plain shell scripts for your $PATH.

Repository layout

coding-skills/
├── .agents/
│   └── plugins/
│       └── marketplace.json       # native Codex marketplace
├── .claude-plugin/
│   └── marketplace.json           # Claude Code marketplace
├── plugins/
│   ├── coding/
│   │   ├── .codex-plugin/plugin.json
│   │   ├── .claude-plugin/plugin.json
│   │   ├── agents/reviewer.md       # Claude-enforced leaf reviewer
│   │   └── skills/
│   │       ├── <skill>/
│   │       │   ├── SKILL.md       # shared instructions
│   │       │   └── agents/
│   │       │       └── openai.yaml
│   │       ├── stage/scripts/stage_hunks.py
│   │       └── tpp/TPP-GUIDE.md
│   ├── security/
│   │   ├── .codex-plugin/plugin.json
│   │   ├── .claude-plugin/plugin.json
│   │   ├── agents/reviewer.md
│   │   └── skills/
│   │       └── <skill>/
│   │           ├── SKILL.md
│   │           ├── agents/openai.yaml
│   │           ├── references/
│   │           ├── ATTRIBUTION.md
│   │           └── LICENSE
│   ├── cpp/
│   │   ├── .codex-plugin/plugin.json
│   │   ├── .claude-plugin/plugin.json
│   │   ├── agents/reviewer.md
│   │   └── skills/
│   │       └── <skill>/
│   │           ├── SKILL.md
│   │           ├── agents/openai.yaml
│   │           ├── references/
│   │           ├── ATTRIBUTION.md
│   │           └── LICENSE
│   └── rust/
│       ├── .codex-plugin/plugin.json
│       ├── .claude-plugin/plugin.json
│       └── skills/project-setup/
│           ├── SKILL.md
│           ├── agents/openai.yaml
│           ├── references/
│           └── ATTRIBUTION.md
└── scripts/
    └── validate_repository.py

Validation

Run the repository validator from the root:

python3 scripts/validate_repository.py

Before publishing, also run the current Codex $skill-creator validator for every skill, the $plugin-creator validator for every plugin, parse both marketplace JSON files, check relative Markdown links, and run git diff --check. Test both marketplace installations in fresh tasks.

Review orchestration is bounded on both hosts. Claude Code uses each review-capable plugin's tool-restricted reviewer agent, which has neither the Agent nor Skill tool. Codex and other hosts use the same non-triggerable leaf methodology through a delegation-budget: 0 prompt contract and task-local context. Review skills keep a leaf-mode guard so an implicit skill match cannot restart orchestration. Setup-only plugins do not invent reviewer agents.

second-opinion is the deliberate exception to the host-neutral rule: its whole job is to shell out to the other vendor's CLI (plain codex exec with a $coding:review prompt from Claude Code, claude -p with a /coding:review prompt from Codex), so it names both hosts. The validator allows those exact review invocations in that one file and applies every other portability rule to it. It falls back to a same-model reviewer, and says so, when the other CLI is missing or unauthenticated.

Adapting the workflows

The skills are intentionally generic. Prefer durable project instructions in AGENTS.md; also honor CLAUDE.md when a repository uses it for Claude Code compatibility. Each skill's adaptation section identifies the project-specific invariants, references, or review checks worth adding.

Versioning and marketplace updates

Every native .codex-plugin/plugin.json uses strict Semantic Versioning. The initial native release is 1.0.0. Bump the patch version for compatible fixes, the minor version for backward-compatible capability additions, and the major version for breaking workflow or packaging changes.

The marketplace catalog has no version field. The unqualified photostructure/coding-skills source follows the repository's default branch when Codex adds or upgrades the marketplace snapshot. A plugin's manifest version identifies the installed cache entry; it does not pin the marketplace repository. Bump that version whenever published plugin content changes so the cached copy has a distinct identity.

For a reproducible marketplace snapshot, pin a Git tag, commit, or branch with owner/repo@ref or codex plugin marketplace add owner/repo --ref <ref>. Repository tags are release bookkeeping unless the marketplace source is explicitly pinned to one.

During unpublished local iteration, follow the current $plugin-creator cachebuster/reinstall workflow. Use stable SemVer values for published plugin content rather than treating every commit on the tracked branch as a release.

Further reading

• Claude picks the first idea that works. Make it pick the best one.
• Most AI code reviews are noise. Here's how to fix that.
• Commit like a librarian.
• Claude Code has amnesia. So do PRs, changelogs, and your future self.
• The LLM sycophancy antidote
• If something is odd, inappropriate, confusing, or boring, it is probably important.
• Uncertain, lazy, forgetful, & impatient: it's what you want your code to be.

License

MIT © Matthew McEachen, except the security and cpp plugin skills, which are distributed under CC BY-SA 4.0 because they adapt CC BY-SA reference material. The C++ skills also adapt SEI CERT standards prose under CC BY 4.0 and consult the C++ Core Guidelines under their custom license. See each skill's LICENSE and ATTRIBUTION.md for details. The rust plugin is original MIT-licensed guidance with its consulted sources recorded in ATTRIBUTION.md.