Co2 Skills — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Co2 Skills (Plugin) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
Score fell 8 points between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
https://compound-context.com
| Logo | Description |
|---|---|
| co2.svg | an OPINIONATED approach to software development using AI coding agents. It emphasizes the importance of comprehensive and structured context to reduce AI hallucination and AI slop: |
📝 User Story to drive UI and UX design + Non-Functional Requirement to drive business logic and technical design + Constraints to drive technical design and implementation.
🔄 Versioning to keep track of the changes and updates in the context as the project progresses.
📦 Multi application support where each application will have its own context. This is to support:
🔗 Traceability from the generated code to the artifacts in the context to the User Stories, Non-Functional Requirements and Constraints.
🧠 Comprehensive context to reduce AI hallucination and AI slop, which includes:
To install the plugin: ~~~bash
/plugin marketplace add rashidee/co2-skills
/plugin install co2-skills@co2 ~~~
_This is the initial step where you want to ensure the AI coding agent has all the information needed to work._
_For a brand-new project, the context (root CLAUDE.md + one PRD.md per application) is produced through an iterative, file-based brainstorming session instead of a one-shot generation:_
/util-projectinit "<your application idea>" — sets up the brainstorm kit in the project folder:<topic>.brainstorm.md — your session document (seeded with your idea)brainstorm-protocol.md — the turn-based session protocolco2-context-generation-guide.md — the artifact rules the agent follows when drafting/brainstorm-loop slash command (ships with the plugin)# Context section of <topic>.brainstorm.md with your application idea — even one paragraph is enough; the agent probes for the rest./brainstorm-loop — each round the agent refines the drafts (CLAUDE.md in Phase A, then every application's PRD.md in Phase B) and appends focused questions to the session document; you answer in the document and flip a status row to commit your turn.Session completion to COMPLETED when satisfied — the context tree is finalized. Continue with /util-projectsync.💡 The loop is token-efficient: it blocks on a 60-second file poll and only acts on your status flip — saves alone never trigger the agent, and idle waiting costs essentially zero tokens. It is non-destructive — existing session files are never overwritten.
⚠️ Shared by the team - Checked in the repository
⚠️ Per developer - NOT CHECKED IN the repository
⚠️ Per developer - NOT CHECKED IN the repository
util-preparek8senv skillPRD.md is the main input for the development phase, which contains the User Stories, Non-Functional Requirements and Constraints. It is also the main reference for all the skills in this phase. The PRD.md should be updated and versioned as the project progresses.
💡 For a new project, the initial PRD.md of every application is generated by the brainstorm session above (Phase B). From then on you maintain it manually and evolve it with /util-updprd.Example of the PRD.md structure: ~~~markdown
[v1.0.0]
[v1.0.0]
[v1.0.1]
[v1.0.0]
[v1.0.0]
... ~~~
_Since PRD.md is based on human input, it may require some validation and each new points added need to be tagged with unique ID for traceability:_
The skills to invoke the clean-up process are:
| Skill | Example Skill Invocation | Objective | Output |
|---|---|---|---|
| util-projectinit | /util-projectinit "app idea" | New Project Bootstrap (Brainstorm Setup) | Sets up a file-based brainstorming session in the project folder: generates <topic>.brainstorm.md from the appdev template (seeded with your idea), copies brainstorm-protocol.md and co2-context-generation-guide.md, and ensures the /brainstorm-loop command is installed. You fill in the session document and run /brainstorm-loop manually — the loop converges CLAUDE.md (Phase A) and per-application PRD.md (Phase B) round by round. Non-destructive — never overwrites existing session files. |
| util-projectsync | /util-projectsync | Project Structure Sync & Validation | Validates dependencies (circular, missing, logical) across all applications in CLAUDE.md. Creates missing application folders, scaffolds PRD.md and BUG.md from templates, and adds missing module sections. Inserts [TODO] annotations in CLAUDE.md for validation failures. |
| util-usanalyzer | /util-usanalyzer app1 | Quality Check | Identify any quality issues in the PRD.md such as incomplete stories, bad references, contradictions and duplicates. Output a report with the identified issues and suggestions for improvement. Example: "User Story 1 is incomplete because it does not have the acceptance criteria." |
| util-ustagger | /util-ustagger app1 v1.0.3 | Traceability | Each newly added point in PRD.md will be tagged with a unique 9-character ID code, which can be used for traceability in the later stages of the development. Example: [USL000009], [NFRL000009], [CONL000009], [REFL000009] |
| util-updprd | /util-updprd "add password reset for all users" | Requirement Change | Applies a free-form requirement change to the PRD.md files across the project. Determines the impacted applications, modules and subsections, decides per item whether to add/cancel/modify User Stories, NFRs, Constraints, References and Tests, auto-classifies the change as major/minor/patch, and layers the new/updated items under a NEW version tag on top of the existing versions in each PRD.md (prior versions kept immutable). Tags new items via util-ustagger and appends a CHANGELOG.md entry per impacted application. |
| util-preparek8senv | /util-preparek8senv [env] | K8s Infrastructure Preparation | Generates K8s StatefulSet manifests for all 3rd party supporting applications for a single target environment. Creates/updates ENVIRONMENT.md with per-environment configs. Output directly in environment/ folder (no per-environment subfolders — gitignored, each machine maintains its own copy). |
_The four artifact generation steps below (Data Model → HTML Mockup → Technical Specification → Test Specification) can each be run individually, or orchestrated in one shot:_
~~~bash /conductor-feature-prepare <app_name> [version:<version>] [module:<module>] ## Runs util-ustagger, modelgen-, mockgen-, specgen-* and testgen-functional in sequence ~~~
When multiple versions are resolved, they are processed sequentially in ascending semver order — all artifacts for version N are fully generated before version N+1 begins. Say "resume preparation" to continue from where a previous session left off.
_The skill goal is to generate the data model for each module for you to review before proceeding to next step._
Example skill invocation for data model generation: ~~~bash /modelgen-relational <app_name> ## For relational database model (SQL) /modelgen-nosql <app_name> ## For NoSQL document database model (MongoDB, Couchbase, DynamoDB, Firestore, CosmosDB) ~~~
Example of the Model Markdown file structure: ~~~markdown
MODEL.md ## A summary of the data model for all the modules ~~~
_The skill goal is to generate the HTML mockup for each screen for you to review before proceeding to next step._
Example skill invocation for HTML mockup generation: ~~~bash /mockgen-tailwind <app_name> ## For generating HTML mockup using Tailwind CSS + HTMX + Alpine.js /mockgen-shadcn <app_name> ## For generating React + shadcn/ui mockups (Vite + React Router, built to dist/) ~~~
context/mockup/ folder<root>/mockup — ONE zero-dependency Node.js server (npm start, no install needed) that serves the mockups of ALL applications, with a landing page listing every application and role (roles are unclickable until their mockups are ready) and a configurable port (PORT env var or mockup.config.json)/{app_slug}) with links to each screen, and each screen will have a link back to the related User Stories, Non-Functional Requirements and Constraints in PRD.md for traceability.Example of the HTML mockup output: ~~~markdown
~~~
_The skill goal is to generate the technical specification for the application, which includes the architecture, components, APIs, etc. for you to review before proceeding to next step._
>⚠️ At this point, you should already have determined the technology stack as the technical specification generation will be based on the specific technology stack skill
Example skill invocation for technical specification generation: ~~~bash /specgen-spring-jpa-jtehtmx <app_name> ## For generating Spring Boot 3 web application technical specification with JTE, Tailwind and htmx. /specgen-spring-jpa-restapi <app_name> ## For generating Spring Boot 3 REST API technical specification. /specgen-laravel-eloquent-bladehtmx <app_name> ## For generating Laravel 12 web application technical specification with Blade, Tailwind and htmx /specgen-react-mui <app_name> ## For generating React 19 SPA technical specification with TypeScript, Vite, Material UI and more. /specgen-react-tailwind <app_name> ## For generating React 19 SPA technical specification with TypeScript, Vite, Tailwind CSS, Headless UI and more. /specgen-nextjs-react-tailwind <app_name> ## For generating Next.js 15 full-stack web application technical specification with App Router, Server Actions, Drizzle + SQLite, tiered auth (OIDC / hand-rolled sessions / Better Auth), Tailwind CSS v4 and shadcn/ui. /specgen-flutter-riverpod <app_name> ## For generating Flutter 3 mobile application technical specification with Riverpod, Hive, Dio, go_router and Firebase Messaging. /specgen-ts-cli <app_name> ## For generating Node.js CLI application technical specification with TypeScript, Commander.js and tsup. /specgen-node-cli-web <app_name> ## For generating self-hosted Node.js web application technical specification distributed as a global npm CLI — Hono, embedded React SPA, Drizzle + SQLite, hand-rolled sessions and tsup. ~~~
Example of the technical specification output: ~~~markdown- context
SPECIFICATION.md ## A summary of the technical specification for all the modules ~~~
_The skill goal is to generate the test specification for the application, which includes the test cases and scenarios to validate the functionality and performance of the application, for you to review before proceeding to next step._
Example skill invocation for test specification generation: ~~~bash /testgen-functional <app_name> ## For generating Playwright E2E test plan and per-module test specifications as Markdown blueprints. ~~~
Example of the test specification output: ~~~markdown
TEST_PLAN.mmd ## A summary of all the test cases and scenarios in Mermaid syntax ~~~
_The skill goal is to prepare the Kubernetes infrastructure by generating K8s manifests for all 3rd party supporting applications (databases, message queues, caches, SSO, API gateways, etc.) across all environments defined in CLAUDE.md._
>⚠️ This step should be run before application development to ensure the infrastructure is ready.
Example skill invocation for K8s environment preparation: ~~~bash /util-preparek8senv [environment] ## Generates K8s manifests for all 3rd party apps for one target environment ~~~
namespace.yaml — Project namespace<service>.yaml — One StatefulSet-based manifest per 3rd party application (with PVC, ConfigMap, Secret, headless Service, NodePort Service)Example of the output: ~~~markdown
~~~
_The skill goal is to develop the application based on all the context generated above, and you can track the development progress using the output from this skill._
>⚠️ Requires the context artifacts (models, mockups, specifications, test specs) to already exist — run /conductor-feature-prepare <app_name> first if they don't. Say "resume implementation" to continue from where a previous session left off.
Example skill invocation for application development: ~~~bash /conductor-feature-develop <app_name> ## For orchestrating full-stack application development module-by-module using all generated artifacts. ~~~
tracegen-matrix as the final step, see below)_The skill goal is to link every PRD requirement ID (User Stories, NFRs, Constraints) and bug code to the source code that implements it._
>⚠️ This step is automatically invoked as the final traceability step of conductor-feature-develop and conductor-defect. You can also invoke it manually.
Example skill invocation for traceability matrix generation: ~~~bash /tracegen-matrix <app_name> [version] [module] ## Generates/updates the per-application traceability matrix ~~~
Implements:, NFR:, Constraints:, Bug fixes:) written during development and bug fixing, with a name-based source-scan fallback_The skill goal is to generate deployment artifacts (Dockerfile and deployment specification) for the application, for you to review before deploying._
>⚠️ This step is automatically invoked by conductor-feature-develop after all modules are completed. You can also invoke it manually.
Example skill invocation for deployment artifact generation: ~~~bash /depgen-k8s <app_name> [environment] ## For generating Dockerfile and Kubernetes manifests ~~~
<app_folder>/k8s/ (gitignored, each machine maintains its own copy) containing:.env to Kubernetes ConfigMap/SecretExample of the deployment artifact output: ~~~markdown
~~~
| Skill | Technology Stack |
|---|---|
depgen-k8s | Kubernetes (Spring Boot, Laravel, Node.js) |
Report bugs in <app_folder>/context/BUG.md following the module-based structure: ~~~markdown
[v1.0.4]
~~~
Example skill invocation for bug fixing: ~~~bash /conductor-defect <app_name> ## For orchestrating bug fixing from BUG.md ~~~
[BUG-XXX] tags to new bug entries in BUG.mdBUG_TEST_SPEC.md with verification steps and expected resultsBUG_FIX_PLAN.md with fix checklist<app_folder>/context/bug/<module-slug>/<BUG-XXX>/) containing:reproduce.spec.ts — Playwright reproduction scriptscreenshot_reproduce.png — Pre-fix screenshotBUG_TEST_SPEC.md — Test specification for verificationBUG_FIX_PLAN.md — Fix plan with checklist, files to modify, and timestamped fix logscreenshot_fixed.png — Post-fix screenshotExample of the BUG_MASTER.md structure: ~~~markdown
...
... BUG_MASTER.md ## Master tracking file for all bugs in the application ~~~
<topic>.brainstorm.md, brainstorm-protocol.md, co2-context-generation-guide.md) also live at the project root when the project was bootstrapped via /util-projectinit.~~~
MOCKUP.html
SPECIFICATION.md
TEST_PLAN.mmd
~~~
| Document | Description |
|---|---|
| CONTRIBUTING.md | Full contributor guide — repository structure, skill anatomy, development workflow, quality checklist, branch strategy and commit conventions |
| NEW_SKILL.md | Issue template for proposing a new skill before starting development |
| BUG_REPORT.md | Issue template for reporting incorrect behaviour in an existing skill |
| FEATURE_REQUEST.md | Issue template for suggesting improvements to the workflow or existing skills |
| PULL_REQUEST_TEMPLATE.md | PR template with checklists for structure, content, output contract and testing |
We welcome contributions from the community! Here are some ways you can contribute:
specgen-*)This is the highest impact area for contribution. The CO2 workflow is designed to be technology-agnostic, but each specgen-* skill targets a specific technology stack. We currently support:
| Skill | Technology Stack |
|---|---|
specgen-spring-jpa-jtehtmx | Spring Boot 3 + JTE + Tailwind + htmx |
specgen-spring-jpa-restapi | Spring Boot 3 REST API |
specgen-laravel-eloquent-bladehtmx | Laravel 12 + Blade + Tailwind + htmx |
specgen-react-mui | React 19 + TypeScript 5 + Vite 6 + Material UI v6 |
specgen-react-tailwind | React 19 + TypeScript 5 + Vite 6 + Tailwind CSS v3 + Headless UI v2 + Heroicons |
specgen-nextjs-react-tailwind | Next.js 15 (App Router) + React 19 + TypeScript 5 + Tailwind CSS v4 + shadcn/ui + Drizzle ORM + SQLite + tiered auth (OIDC / hand-rolled sessions / Better Auth) + Biome + Vitest + Playwright |
specgen-flutter-riverpod | Flutter 3 + Dart 3 + Riverpod 2 + Hive 2 + Dio 5 + go_router 14 + Firebase Messaging |
specgen-ts-cli | Node.js CLI + TypeScript + Commander.js + tsup + pkg |
specgen-node-cli-web | Self-hosted Node.js web app as a global npm CLI — Node 22 + commander 12 + Hono 4 + embedded React 19/Vite 6 SPA + Tailwind CSS v4 + shadcn/ui + Drizzle ORM + SQLite + hand-rolled scrypt sessions + tsup + Biome + Vitest + Playwright |
specgen-sdk-java | Java SDK library — Maven Multi-Release fat JAR (JDK 8 baseline + JDK 11+ overlay) + OkHttp |
We are looking for contributors to create new specgen-* skills for other technology stacks, such as:
Each specgen-* skill takes the same inputs (PRD.md, data models, HTML mockups) and produces a SPECIFICATION.md summary and per-module SPEC.md files tailored to the target stack. If you are experienced in a technology stack not listed above, your contribution would help the community generate specifications for that stack.
depgen-*)We currently support:
| Skill | Deployment Stack |
|---|---|
depgen-k8s | Kubernetes (Spring Boot, Laravel, Node.js) |
We are looking for contributors to create new depgen-* skills for other deployment strategies, such as:
Each depgen-* skill takes the same inputs (SPECIFICATION.md, CLAUDE.md, application source code) and produces a Dockerfile and deployment manifests tailored to the target deployment strategy.
)** — Currently supports mockgen-tailwind (Tailwind + HTMX + Alpine.js) and mockgen-shadcn (React + Vite + shadcn/ui), both served by the single shared Mockup Hub at <root>/mockup`. Contributions welcome for alternative UI frameworks or design systems (e.g., Bootstrap, Material UI, Ant Design)Below are example applications developed using the CO2 workflow. More examples will be added over time to demonstrate the versatility of the workflow across different domains and technology stacks.:
🤖 Currently only Claude Code Agent is supported, but we are planning to support more AI coding agents in the future.
🪙 This workflow can consume a lot of tokens. It is designed to generate consistent and comprehensive context for the AI coding agent, which may require a large amount of tokens. Please be mindful of the token usage when using this workflow.
🆕 This workflow is currently designed for new application development, not maintenance of existing application. We are planning to support maintenance of existing application in the future, but for now please use this workflow for new application development only.
🚧 **THIS IS STILL A WORK IN PROGRESS**. We are continuously improving the workflow and the skills, so please expect some changes and updates in the future. We welcome any feedback and suggestions for improvement.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.