feat: consume skills from @workos/skills package#88
Merged
Conversation
Replace the CLI's bundled skill files with the @workos/skills npm package as the single source of truth. Reference content is now injected directly into the agent prompt, eliminating the Skill tool round-trip for faster execution. - Add @workos/skills as dependency - Update buildIntegrationPrompt to read reference markdown from the package and inject into prompt (replaces "use the X skill" pattern) - Remove Skill from allowedTools — no longer needed - Update plugin loading to point to @workos/skills package - Update getSkillsDir() to delegate to the package - Delete skills/ directory (17 skill files) - Delete .claude-plugin/ directory (plugin identity from package) - Remove skills and .claude-plugin from package.json files array
There was a problem hiding this comment.
Pull request overview
This PR consolidates skill content by switching the CLI to consume reference/skill assets from the published @workos/skills@0.2.1 package, removing the repo’s bundled skills/ content and local plugin manifest, and updating agent prompt construction to inject reference content directly.
Changes:
- Add
@workos/skills@0.2.1dependency and route skills directory resolution through the package. - Update the agent integration prompt builder to fetch and inline reference content (instead of instructing the agent to invoke a Skill tool).
- Remove the bundled skills and
.claude-plugin/plugin.json, and update docs/checklists.
Reviewed changes
Copilot reviewed 23 out of 24 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/lib/agent-runner.ts | Switches integration prompt creation to async and injects @workos/skills reference content directly. |
| src/lib/agent-interface.ts | Removes Skill from allowedTools and points plugin loading at the @workos/skills package location. |
| src/commands/install-skill.ts | Delegates skills directory discovery to @workos/skills. |
| package.json | Adds @workos/skills dependency and stops publishing bundled .claude-plugin and skills directories. |
| pnpm-lock.yaml | Locks @workos/skills@0.2.1 and its dependencies. |
| CLAUDE.md | Adds contributor Do/Don’t guidance and a PR checklist. |
| .claude-plugin/plugin.json | Deletes local plugin manifest (now expected to come from the skills package). |
| skills/workos-ruby/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-python/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-php/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-php-laravel/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-node/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-management/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-kotlin/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-go/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-elixir/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-dotnet/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-authkit-vanilla-js/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-authkit-tanstack-start/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-authkit-sveltekit/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-authkit-react/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-authkit-react-router/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-authkit-nextjs/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
| skills/workos-authkit-base/SKILL.md | Deletes bundled skill content (now sourced from @workos/skills). |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
… tool Update dotnet, elixir, go, python, and ruby custom run() functions to read and inject reference content from @workos/skills, matching the pattern used by buildIntegrationPrompt. This fixes the Skill tool being unavailable since it was removed from allowedTools.
Scans all integration index.ts files to ensure none tell the agent to invoke a skill. Also verifies allowedTools excludes Skill. Prevents regression if new integrations copy old patterns.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 29 out of 30 changed files in this pull request and generated 2 comments.
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- buildIntegrationPrompt now builds the env var list based on config.environment.requiresApiKey instead of always listing WORKOS_API_KEY (fixes misleading prompt for React SPA) - Remove raw API key and client ID values from dotnet and ruby prompts to prevent credential leakage into log files
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 29 out of 30 changed files in this pull request and generated 3 comments.
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Update stale comment in dotnet (credentials no longer in prompt) - Fix ruby prompt to not claim env vars are pre-configured - Strengthen guard test regex to match escaped backticks
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 29 out of 30 changed files in this pull request and generated no new comments.
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…rence The switch from skill invocation to direct injection dropped the base template that provides task ordering, decision trees, verification checklists, and error recovery patterns. Load both workos-authkit-base and the framework-specific reference to restore the full context.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
@workos/skills@0.2.1as dependency — single source of truth for all skill contentbuildIntegrationPromptto read reference content from the package and inject directly into the agent prompt (replaces Skill tool invocation)SkillfromallowedTools— no longer needed@workos/skillspackagegetSkillsDir()to delegate to the package forworkos skills install/list/uninstallskills/directory (17 skill files) and.claude-plugin/manifestContext
Previously the CLI bundled its own copy of all skill SKILL.md files. These diverged from the marketplace plugin (
@workos/skills) over time. Now the CLI depends on the published@workos/skillspackage as the single source of truth.The agent prompt injection approach eliminates the Skill tool round-trip — reference content goes directly into the prompt for faster execution.
Test plan
pnpm test— 1006 tests passpnpm build— succeedsworkos skills list— showsworkosandworkos-widgetsfrom packageworkos skills install/uninstall— works with package-sourced skills@workos/skills@0.2.1(not local link)