How it works
How it works
A Skill starts as a pattern found in real call sites. It is written down once in `skills/`, shipped in the Plugin and, for five of them, on npm.
- Step 1
Mine the pattern
A pattern is surveyed across real call sites in a shipped codebase. The Skill’s provenance abstract in
metadata.jsonrecords what was found, for example near-identical table filter hooks or a quote-wrapped secret that broke auth. - Step 2
Write the Skill
The
SKILL.mdfrontmatterdescriptionsays when the Skill applies. The body encodes the invariants, the anti-patterns and the@cogs/*package to use. - Step 3
Bundle it in the Plugin
.claude-plugin/marketplace.jsonlists every Skill directory. Installing thecogsPlugin in Claude Code makes all of them available at once. - Step 4
Load it on a matching prompt
Claude Code reads each Skill’s description and loads the Skill when your prompt matches, for example asking for a paginated table with shareable URLs loads
nuqs-table-url-state. - Step 5
Publish the mirror
bin/sync-skill-content.mjsgenerates a Skill mirror inpackages/skill-<name>/. The release workflow runs Changesets and publishes the Published skills to npm with OIDC trusted publishing. - Step 6
Use the package it describes
The Skill tells Claude Code to use the real package, such as
@cogs/nuqsfor table URL state or@cogs/config’sconfig-lintCLI for env files, instead of hand-rolling it again.
The platform side
A Product repo installs @cogs/auth and @cogs/auth-events. When a sign-in comes from a New device, it signs a new_device_login Send event with its Per-brand secret and posts it to the Send service, which renders the Brand’s Email template and sends it with SES.
Per-site SES identities, DKIM, MAIL FROM, Cloudflare DNS and Turnstile widgets come from the Terraform in infra/. @cogs/supabase-sync reconciles the same SMTP, captcha, rate-limit and redirect settings to every Site’s Supabase project.
Install the plugin or a package
The plugin installs from the catesworks/cogs marketplace in Claude Code; the published @cogs/* packages install from npm with no auth token. There is no hosted service and no account.