Implement Conductor Skills Integration (#144)

hminooei · web-flow · commit 080a3697da33 · 2026-03-18T14:44:49.000-07:00
* feat(skills): Implement Skills Integration

* chore: Remove design doc from PR

* refactor(skills): Convert catalog to Markdown body

* fix(conductor): update skill reference paths to .agents/skills

* fix(conductor): update skill download to support folders

* fix(skills): update catalog URLs to point to directories

* feat(conductor): update skills integration with design doc requirements

* feat(conductor): add GCP OWASP Top 10 skills to catalog

* feat(conductor): use precise detection signals for OWASP skills

* feat(conductor): add file and dependency signals to OWASP skills

* chore(conductor): remove obsolete setup_state.json reference

* feat(skills): add gcp-apis and Firebase skills to catalog

* chore(skills): cleanup inactive skills from catalog

* chore(skills): remove gcp-apis skill from catalog

* feat(conductor): add /skills reload instruction to setup and newTrack

* fix(conductor): update skills catalog path to absolute path

* address review comments

* feat(conductor): use interactive ask_user for skill recommendations in newTrack

* chore: remove GCP OWASP Top 10 Skills from catalog

* feat(conductor): update skill installation and style guide selection logic

* feat(conductor): add devops skills to catalog

* fix(conductor): ensure agent activates relevant skills in implement.toml

* fix(conductor): update skill activation phrasing per feedback

* fix(conductor): use exact 'ask the model to activate' phrasing

* chore(conductor): explicit pause on skill reload

* fix(conductor): explicitly specify not to use ask_user tool in skill reload confirmation
diff --git a/commands/conductor/implement.toml b/commands/conductor/implement.toml
@@ -81,6 +81,12 @@ CRITICAL: You must validate the success of every tool call. If any tool call fai
         -   **Track Context:** Using the **Universal File Resolution Protocol**, resolve and read the **Specification** and **Implementation Plan** for the selected track.
         -   **Workflow:** Resolve **Workflow** (via the **Universal File Resolution Protocol** using the project's index file).
     c. **Error Handling:** If you fail to read any of these files, you MUST stop and inform the user of the error.
+    d. **Activate Relevant Skills:**
+        - Check for the existence of installed skills in `.agents/skills/` (Workspace tier) and `~/.agents/extensions/conductor/skills/` (Extension tier).
+        - If either exists, list the subdirectories to identify available skills.
+        - Based on the track's **Specification**, **Implementation Plan**, and the **Product Definition**, determine if any installed skills are relevant to the track.
+        - **CRITICAL:** For every relevant skill identified, ask the agent to activate it and read its `SKILL.md` and reference files.
+        - You MUST explicitly apply and prioritize the guidelines, commands, and constraints from these files during the execution of the track's tasks.
 
 4.  **Execute Tasks and Update Track Plan:**
     a. **Announce:** State that you will now execute the tasks from the track's **Implementation Plan** by following the procedures in the **Workflow**.
diff --git a/commands/conductor/newTrack.toml b/commands/conductor/newTrack.toml
@@ -134,7 +134,40 @@ PLAN MODE PROTOCOL: Parts of this process run within Plan Mode. While in Plan Mo
                 - Label: "Revise", Description: "I want to modify the implementation steps."
     Await user feedback and revise the `plan.md` content until confirmed.
 
-### 2.4 Create Track Artifacts and Update Main Plan
+### 2.4 Skill Recommendation (Interactive)
+1.  **Analyze Needs:**
+    -   Read `skills/catalog.md` from the directory where the Conductor extension is installed (typically `~/.gemini/extensions/conductor/skills/catalog.md`).
+    -   Analyze the confirmed `spec.md` and `plan.md` against the `Detection Signals` in the loaded `skills/catalog.md`.
+    -   Identify any relevant skills that are NOT yet installed (check `~/.agents/extensions/conductor/skills/` and `.agents/skills/`).
+2.  **Recommendation Loop:**
+    -   **If relevant missing skills are found:**
+        -   **Ask:** "Would you like to install these skills now?" using the `ask_user` tool (do not repeat in chat):
+            - **questions:**
+                - **header:** "Install Skills"
+                - **question:** "I've identified some skills that could help with this track. Would you like to install any of them?"
+                - **type:** "choice"
+                - **multiSelect:** true
+                - **options:** (Populate with the recommended skills, providing a `label` and a `description` explaining the relevance for each).
+        -   **Install:** If the user selects any skills, then for each selected skill:
+            -   **Determine Installation Path:**
+                - If `alwaysRecommend` is true, set the path to `~/.agents/extensions/conductor/skills/<skill-name>/`.
+                - Otherwise, set the path to `.agents/skills/<skill-name>/`.
+            -   Create directory at the determined path.
+            -   **Determine Download Strategy:**
+                - If `party` is '1p':
+                    - If `version` is provided, download that specific version.
+                    - Otherwise, download the latest copy at the exact `url`.
+                - If `party` is '3p', MUST use the provided `commit_sha` to download the specific vetted commit.
+            -   Download the content of the skill folder from the `url` specified in `catalog.md` (using the determined strategy) to the determined path.
+            -   **CRITICAL:** If the URL is a file path, find the parent folder. If it is a Git URL, use `git clone` or `sparse-checkout` to get the folder.
+    -   **If no missing skills found:** Skip this section.
+
+### 2.4.1 Skill Reload Confirmation
+1.  **Execution Trigger:** This step MUST only be executed if you installed new skills in the previous section.
+2.  **Notify and Pause:** **CRITICAL:** You MUST explicitly instruct the user: "New skills installed. Please run `/skills reload` to enable them. Let me know when you have done this." Do NOT use the `ask_user` tool here.
+3.  **Wait for Confirmation:** You MUST pause your execution here and wait for the user to confirm they have run the command and reloaded the skills before proceeding.
+
+### 2.5 Create Track Artifacts and Update Main Plan
 
 1.  **Check for existing track name:** Before generating a new Track ID, resolve the **Tracks Directory** using the **Universal File Resolution Protocol**. List all existing track directories in that resolved path. Extract the short names from these track IDs (e.g., ``shortname_YYYYMMDD`` -> `shortname`). If the proposed short name for the new track (derived from the initial description) matches an existing short name, halt the `newTrack` creation. Explain that a track with that name already exists and suggest choosing a different name or resuming the existing track.
 2.  **Generate Track ID:** Create a unique Track ID (e.g., ``shortname_YYYYMMDD``).
diff --git a/commands/conductor/review.toml b/commands/conductor/review.toml
@@ -63,6 +63,10 @@ CRITICAL: You must validate the success of every tool call. If any tool call fai
     -   Read `product-guidelines.md` and `tech-stack.md`.
     -   **CRITICAL:** Check for the existence of `conductor/code_styleguides/` directory.
         -   If it exists, list and read ALL `.md` files within it. These are the **Law**. Violations here are **High** severity.
+    -   **Check for Installed Skills:**
+        -   Check for the existence of `.agents/skills/` (Workspace tier) and `~/.agents/extensions/conductor/skills/` (Extension tier).
+        -   If either exists, list the subdirectories to identify installed skills across both paths.
+        -   If relevant skills (e.g., `gcp-*`) are found, enable specialized feedback for those domains.
 2.  **Load Track Context (if reviewing a track):**
     -   Read the track's `plan.md`.
     -   **Extract Commits:** Parse `plan.md` to find recorded git commit hashes (usually in the "Completed" tasks or "History" section).
@@ -100,6 +104,8 @@ CRITICAL: You must validate the success of every tool call. If any tool call fai
     -   Are there new tests?
     -   Do the changes look like they are covered by existing tests?
     -   *Action:* **Execute the test suite automatically.** Infer the test command based on the codebase languages and structure (e.g., `npm test`, `pytest`, `go test`). Run it. Analyze the output for failures.
+5.  **Skill-Specific Checks:**
+    -   If specific skills are installed (e.g. GCP), verify compliance with their best practices.
 
 ### 2.4 Output Findings
 **Format your output strictly as follows:**
diff --git a/commands/conductor/setup.toml b/commands/conductor/setup.toml
@@ -43,7 +43,7 @@ PLAN MODE PROTOCOL: This setup process runs entirely within Plan Mode. While in
 | :--- | :--- | :--- |
 | All files in `tracks/<track_id>/` (`spec`, `plan`, `metadata`, `index`) | **HALT** | "The project is already initialized. Use `/conductor:newTrack` or `/conductor:implement`." |
 | `index.md` (top-level) | **Section 3.0** | "Resuming setup: Scaffolding is complete. Next: generate the first track. (Note: If an incomplete track folder was detected, we will restart this step to ensure a clean, consistent state)." |
-| `workflow.md` | **Section 2.6** | "Resuming setup: Workflow is defined. Next: generate project index." |
+| `workflow.md` | **Section 2.6** | "Resuming setup: Workflow is defined. Next: select Agent Skills." |
 | `code_styleguides/` | **Section 2.5** | "Resuming setup: Guides/Tech Stack configured. Next: define project workflow." |
 | `tech-stack.md` | **Section 2.4** | "Resuming setup: Tech Stack defined. Next: select Code Styleguides." |
 | `product-guidelines.md` | **Section 2.3** | "Resuming setup: Guidelines are complete. Next: define the Technology Stack." |
@@ -371,7 +371,60 @@ PLAN MODE PROTOCOL: This setup process runs entirely within Plan Mode. While in
 4.  **Action:** Update `conductor/workflow.md` based on all user answers from both steps.
 
 
-### 2.6 Finalization
+### 2.6 Select Skills (Interactive)
+1.  **Analyze and Recommend:**
+    -   Read `skills/catalog.md` from the directory where the Conductor extension is installed (typically `~/.gemini/extensions/conductor/skills/catalog.md`).
+    -   **Catalog Not Found Handling:** If the skills catalog cannot be found, announce "Skills catalog not found. Skipping skill selection." and **immediately jump** to Section 2.7.
+    -   Detect applicable skills based on `detectSignals` matched against project files and `conductor/tech-stack.md`.
+    -   Identify "Always Recommended" skills.
+2.  **Determine Mode:**
+    - **If no recommended skills are found:** Announce "No additional agent skills were recommended for this project context. Skipping skill installation." and skip to 2.7.
+    - **If recommended skills are found:** Use the `ask_user` tool to present recommendations and choose an installation path.
+    - **questions:**
+        - **header:** "Agent Skills"
+        - **question:**
+            Based on your project context, I recommend the following skills:
+            <List Recommended Skills with Descriptions>
+            How would you like to proceed?"
+        - **type:** "choice"
+        - **options:**
+            - Label: "Install All", Description: "Install all recommended skills."
+            - Label: "Hand-pick", Description: "Select specific skills from the catalog."
+            - Label: "Skip", Description: "Do not install any skills at this time."
+3.  **Gather Selection (Conditional):**
+    - **If user chose "Hand-pick":**
+        - **Action:** List all available skills from the catalog in the chat (including names and descriptions).
+        - **Prompt for Selection:** Use the `ask_user` tool with a single question:
+            - **header:** "Select Skills"
+            - **type:** "text"
+            - **question:** "Which skill(s) would you like to install? You can type the names (comma-separated) or paste a list."
+            - **placeholder:** "e.g., firebase-auth-basics, firebase-firestore-basics"
+        - **Interaction Flow:** Wait for the user's response, then parse the selected skills based on the names provided.
+4.  **Process Selection:**
+    -   If "Install All": Install all recommended skills.
+    -   If "Hand-pick": Parse the results from the `ask_user` call and install selected skills.
+    -   If "Skip": Proceed without installation.
+5.  **Installation Action:**
+    -   For each selected skill:
+        -   **Determine Installation Path:**
+            - If `alwaysRecommend` is true, set the path to `~/.agents/extensions/conductor/skills/<skill-name>/`.
+            - Otherwise, set the path to `.agents/skills/<skill-name>/`.
+        -   Create directory at the determined path.
+        -   **Determine Download Strategy:**
+            - If `party` is '1p':
+                - If `version` is provided, download that specific version.
+                - Otherwise, download the latest copy at the exact `url`.
+            - If `party` is '3p', MUST use the provided `commit_sha` to download the specific vetted commit.
+        -   Download the content of the skill folder from the `url` specified in `catalog.md` (using the determined strategy) to the determined path.
+        -   **CRITICAL:** If the URL is a file path, find the parent folder. If it is a Git URL, use `git clone` or `sparse-checkout` to get the folder.
+6.  **Continue:** Immediately proceed to the next section (2.6.1).
+
+### 2.6.1 Skill Reload Confirmation
+1.  **Execution Trigger:** This step MUST only be executed if you installed new skills in the previous section.
+2.  **Notify and Pause:** **CRITICAL:** You MUST explicitly instruct the user: "New skills installed. Please run `/skills reload` to enable them. Let me know when you have done this." Do NOT use the `ask_user` tool here.
+3.  **Wait for Confirmation:** You MUST pause your execution here and wait for the user to confirm they have run the command and reloaded the skills before proceeding.
+
+### 2.7 Finalization
 1.  **Generate Index File:**
     -   Create `conductor/index.md` with the following content:
         ```markdown
diff --git a/skills/catalog.md b/skills/catalog.md
@@ -0,0 +1,96 @@
+# Agent Skills Catalog
+
+This catalog defines the curriculum of skills available to the Conductor extension.
+
+## Firebase Skills
+Skills focused on setting up, managing, and using various Firebase services.
+
+### firebase-ai-logic-basics
+- **Description**: Official skill for integrating Firebase AI Logic (Gemini API) into web applications. Covers setup, multimodal inference, structured output, and security.
+- **URL**: https://raw.githubusercontent.com/firebase/agent-skills/main/skills/firebase-ai-logic-basics/
+- **Party**: 1p
+- **Detection Signals**:
+    - **Dependencies**: `firebase`, `firebase-admin`
+    - **Keywords**: `Firebase`, `AI Logic`, `Gemini API`, `GenAI`
+
+### firebase-app-hosting-basics
+- **Description**: Deploy and manage web apps with Firebase App Hosting. Use this skill when deploying Next.js/Angular apps with backends.
+- **URL**: https://raw.githubusercontent.com/firebase/agent-skills/main/skills/firebase-app-hosting-basics/
+- **Party**: 1p
+- **Detection Signals**:
+    - **Dependencies**: `firebase`, `firebase-admin`
+    - **Keywords**: `Firebase App Hosting`, `Next.js`, `Angular`
+
+### firebase-auth-basics
+- **Description**: Guide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.
+- **URL**: https://raw.githubusercontent.com/firebase/agent-skills/main/skills/firebase-auth-basics/
+- **Party**: 1p
+- **Detection Signals**:
+    - **Dependencies**: `firebase`, `firebase-admin`
+    - **Keywords**: `Firebase Authentication`, `Auth`, `Sign-in`
+
+### firebase-basics
+- **Description**: Guide for setting up and using Firebase. Use this skill when the user is getting started with Firebase - setting up local environment, using Firebase for the first time, or adding Firebase to their app.
+- **URL**: https://raw.githubusercontent.com/firebase/agent-skills/main/skills/firebase-basics/
+- **Party**: 1p
+- **Detection Signals**:
+    - **Dependencies**: `firebase`, `firebase-admin`
+    - **Keywords**: `Firebase`, `Setup`
+
+### firebase-data-connect-basics
+- **Description**: Build and deploy Firebase Data Connect backends with PostgreSQL. Use for schema design, GraphQL queries/mutations, authorization, and SDK generation for web, Android, iOS, and Flutter apps.
+- **URL**: https://raw.githubusercontent.com/firebase/agent-skills/main/skills/firebase-data-connect-basics/
+- **Party**: 1p
+- **Detection Signals**:
+    - **Dependencies**: `firebase`, `firebase-admin`
+    - **Keywords**: `Firebase Data Connect`, `PostgreSQL`, `GraphQL`
+
+### firebase-firestore-basics
+- **Description**: Comprehensive guide for Firestore basics including provisioning, security rules, and SDK usage. Use this skill when the user needs help setting up Firestore, writing security rules, or using the Firestore SDK in their application.
+- **URL**: https://raw.githubusercontent.com/firebase/agent-skills/main/skills/firebase-firestore-basics/
+- **Party**: 1p
+- **Detection Signals**:
+    - **Dependencies**: `firebase`, `firebase-admin`
+    - **Keywords**: `Firestore`, `Database`, `Security Rules`
+
+### firebase-hosting-basics
+- **Description**: Skill for working with Firebase Hosting (Classic). Use this when you want to deploy static web apps, Single Page Apps (SPAs), or simple microservices. Do NOT use for Firebase App Hosting.
+- **URL**: https://raw.githubusercontent.com/firebase/agent-skills/main/skills/firebase-hosting-basics/
+- **Party**: 1p
+- **Detection Signals**:
+    - **Dependencies**: `firebase`, `firebase-admin`
+    - **Keywords**: `Firebase Hosting`, `Static Hosting`
+
+## DevOps Skills
+Skills for designing, building, and managing CI/CD pipelines and infrastructure on Google Cloud.
+
+### cloud-deploy-pipelines
+- **Description**: Manage the entire lifecycle of Google Cloud Deploy, from designing and creating delivery pipelines to managing releases and debugging failures.
+- **URL**: https://raw.githubusercontent.com/gemini-cli-extensions/devops/main/skills/cloud-deploy-pipelines/
+- **Party**: 1p
+- **Detection Signals**:
+    - **Dependencies**: `skaffold`
+    - **Keywords**: `Cloud Deploy`, `delivery pipeline`, `skaffold.yaml`, `clouddeploy.yaml`
+
+### gcp-cicd-deploy
+- **Description**: Assistant for deploying applications to Google Cloud, supporting Static Sites (GCS), Cloud Run (Buildpacks or Images), and GKE.
+- **URL**: https://raw.githubusercontent.com/gemini-cli-extensions/devops/main/skills/gcp-cicd-deploy/
+- **Party**: 1p
+- **Detection Signals**:
+    - **Dependencies**: `gcloud`
+    - **Keywords**: `Cloud Run`, `GCS`, `Static Site`, `Deployment`, `Google Cloud`
+
+### gcp-cicd-design
+- **Description**: Assistant for designing, building, and managing CI/CD pipelines on Google Cloud, focusing on architectural design and implementation planning.
+- **URL**: https://raw.githubusercontent.com/gemini-cli-extensions/devops/main/skills/gcp-cicd-design/
+- **Party**: 1p
+- **Detection Signals**:
+    - **Keywords**: `CI/CD`, `Pipeline Design`, `Google Cloud`, `Architectural Design`
+
+### gcp-cicd-terraform
+- **Description**: Use Terraform to provision Google Cloud resources (GKE, Cloud Run, Cloud SQL) with standard GCS backend state management and IAM least-privilege.
+- **URL**: https://raw.githubusercontent.com/gemini-cli-extensions/devops/main/skills/gcp-cicd-terraform/
+- **Party**: 1p
+- **Detection Signals**:
+    - **Dependencies**: `terraform`
+    - **Keywords**: `Terraform`, `GCP`, `GCS Backend`, `Infrastructure as Code`, `IaC`
