Community-maintained patterns, prompts, skills, agent instructions, workflows, and lessons learned for responsible agentic coding.

Status: Active development | License: CC0-1.0 | Repo: https://github.com/GSA-TTS/agentic-coding-patterns

This repository is part of a three-repo ecosystem:

This is the collaboration hub. Share what's working, learn from others, and help build a community knowledge base.

This repository is a community space for sharing reusable patterns, workflows, and lessons learned.

• Behavioral standards live in the Playbook (don't duplicate them here)
• Environment setup lives in the Quickstart
• Community patterns and lessons live here

Content here is a starting point for reuse and review — it's community knowledge sharing.

• ✅ Reusable skills for common tasks (code review, documentation, testing)
• ✅ Prompt templates for planning, implementation, review
• ✅ Agent instruction patterns (AGENTS.md examples)
• ✅ Multi-step workflows
• ✅ Lessons learned from real usage
• ✅ Tool-specific examples (OpenCode, Claude, Copilot, Cursor)

• ❌ Secrets, credentials, API keys, tokens
• ❌ PII (Personally Identifiable Information)
• ❌ CUI (Controlled Unclassified Information)
• ❌ Internal URLs or system details
• ❌ Customer data or operational details
• ❌ Uncited compliance claims

agentic-coding-patterns/
├── skills/              # Reusable procedures (code review, testing, documentation)
├── prompts/             # Standalone prompts for specific tasks
├── agents/              # Agent instruction patterns (AGENTS.md)
├── workflows/           # Multi-step end-to-end processes
├── lessons-learned/     # Community experiences and retrospectives
├── templates/           # Templates for creating new patterns
├── examples/            # Tool-specific integration examples
├── schemas/             # JSON Schemas for validation
└── docs/                # Documentation and guides

# Clone the repo
git clone https://github.com/GSA-TTS/agentic-coding-patterns.git
cd agentic-coding-patterns

# Install dependencies
make setup

# Optional: Install pre-commit hooks (recommended for regular contributors)
make install-hooks

# Validate content
make validate

# Generate INDEX.yaml
make generate

# Run tests with coverage report
make coverage

Note: Pre-commit hooks are opt-in. Use make install-hooks to enable automatic checks on commit. CI enforces all checks regardless of local hook installation.

Human users:

1. Browse available patterns in INDEX.yaml or by directory

2. Use the pattern discovery CLI:

   # Search by tag
   python scripts/search_patterns.py --tag security
   
   # Filter by status (e.g. experimental — the default for new patterns).
   # Note: `recommended` is populated only via the peer-review promotion gate
   # (see docs/security-skill-promotion-checklist.md); no patterns are promoted yet,
   # so `--status recommended` currently returns nothing.
   python scripts/search_patterns.py --status experimental
   
   # Combined filters
   python scripts/search_patterns.py --tag security --tool opencode

3. Copy pattern directory to your project

4. Adapt frontmatter and content to your needs

5. Review and test before production use

AI agents:

1. Parse INDEX.yaml for pattern discovery (see AI Agent Guide)
2. Use the CLI for filtering: python scripts/search_patterns.py --json --tag <tag>
3. Filter patterns by type, status, tags, and portability flags
4. Read frontmatter to understand input/output contracts
5. Validate against prohibited_content before using

INDEX.yaml structure:

schema_version: "1.0"
repo: GSA-TTS/agentic-coding-patterns
patterns:
  skills: [{id, path, title, status, type}, ...]
  prompts: [...]
  agents: [...]
stats:
  total_patterns: <N>

Default for new contributions: experimental

A curated set of skills for security review and secure authoring. Every skill declares categories: [security], which triggers extra governance: a required human review, a deny-by-default tool/network/write/script policy, and explicit risk_tier. Policy authority lives in the playbook — this pack references it rather than restating it.

• Governance model: docs/security-skill-governance.md
• Agent routing (which skill for which trigger): docs/AI-AGENT-GUIDE.md
• Taxonomy: categories is a closed vocabulary (see schemas/skill.schema.json); security is the axis that gates this pack.

Human-review gate: security skills are human_review_required: true. An agent may apply one, but promotion experimental → recommended and any change to a security skill require human sign-off — see the human-review gates.

A set of communications skills for explaining software development, agentic coding, and security controls to executive / non-engineering audiences — accurately, without hype, and without making an engineer wince at the inaccuracies. They are evidence-grounded: security and process claims cite the playbook and quickstart as ground truth, and they preserve the honest limits (the sandbox is isolation, not a perfect guarantee; the precise secrets caveat; the agent cannot approve or merge its own work).

These compose into the design-artifact workflow's technical-explainer profile. Any team can use them independently of a leadership-briefing use case — they are a reusable capability for turning technical material into accurate executive explanations. Reference material (an executive concept library, six audience profiles, and evidence/measurement guidance) ships alongside the skills.

See CONTRIBUTING.md for full guidelines.

Quick version:

1. Use a template from templates/
2. Fill in frontmatter (all required fields)
3. Write clear, reusable content
4. No secrets, PII, or CUI
5. Run make validate before commit
6. Submit PR with review checklist

All patterns MUST:

• Define prohibited_content in frontmatter
• Use placeholders for environment-specific values
• Pass sensitive term scanning
• Include human review checklist

See docs/safety-guidance.md for details.

make validate    # Run all validators
make test        # Run tests
make ci          # Full CI check

Patterns track compatibility via portability frontmatter:

• opencode: OpenCode SKILL.md format
• cursor: Cursor .cursorrules
• claude_projects: Claude Projects
• chatgpt: ChatGPT custom instructions
• generic_llm: Generic LLM prompting

This repository is released under CC0-1.0 (public domain). Content is provided as-is with no warranties.

• Questions: Open a GitHub issue or start a discussion
• Browse docs: See docs/ for guides
• Improvement ideas: Open an issue or submit a PR
• Relationship to other repos: See docs/repository-ecosystem.md

• Contributing Guide — How to add patterns
• AI Agent Integration Guide — Programmatic pattern access
• Security Policy — Direct fixes preferred
• Playbook — Standards and best practices
• Quickstart — Execution environment setup

Note: Review and test all patterns before production use. Tailor to your specific requirements.

This repository uses pre-commit hooks for code quality and security:

# Install pre-commit (if not already installed)
pip install pre-commit

# Install the git hook scripts
pre-commit install

# (Optional) Run against all files
pre-commit run --all-files

Hooks configured:

• gitleaks — Secret detection (critical for example code)
• ruff — Python linting and formatting with security rules
• markdownlint-cli2 — Markdown formatting
• Pattern validation — Frontmatter schema validation
• Basic hygiene — YAML/JSON/TOML validation, trailing whitespace, etc.

GitHub Actions security scanning (CI, not a local hook):

zizmor runs in CI via .github/workflows/zizmor.yml on workflow-file changes — it is intentionally not a local pre-commit hook. You can also run it manually:

zizmor .github/workflows/

Install locally (optional): cargo install zizmor or brew install zizmor.

See .pre-commit-config.yaml for full configuration.