Stop Vibe Coding in Silos: ADLC Team Skills Brings Shared Coding Standards to Claude Code and Codex
Agent skills that bring team coding standards to Claude Code and Codex
ADLC Team Skills is an open-source 'Team Layer' for the Twelve-Factor Agentic SDLC, designed to turn AI agents from isolated guessers into compliant, accountable team members. It installs skills, slash commands, and session-start events into coding agents like Claude Code and Codex, and provides a universal orchestration layer that auto-discovers skills from any source. The tool enforces four pillars: strategy and team directives, product and architecture governance, spec-driven workflows, and verification-first evals, helping teams move from chaotic 'vibe coding' to a shared cognitive layer with version-controlled standards and evaluation benchmarks.
Speed is solved; Trust and Verification is the new bottleneck in AI engineering.
- foundry27
DO NOT INSTALL THIS VIA NPX OR OPEN THIS REPO IN VSCODE. This repo has been infected by malware.
It seems like it was added in commit 74f317d at 11:06 UTC today, with five new hidden files being added under .claude and .vscode that together seem designed to either a) autorun a vscode tasks.json entry, or b) run a Claude session start hook, that will execute a large obfuscated payload. The payload looks like it will fingerprint your system and try to exfil your GitHub tokens.
Edit:
- It also exfils your AWS credentials (~/.aws/credentials, ~/.aws/config), named AWS profiles, and AWS secret managers and SSM parameter store contents
- Same with K8s secrets, with specific searches for GitHub and npm tokens, AWS keys, GCP keys, Azure keys, Stripe keys, Slack tokens, and Twilio keys
- Same with HashiCorp vault contents
- It will try to use your GitHub tokens (if they have the workflow permission) to run actions on your repository and try to exfiltrate secrets from there
- It will try to read a whole bunch of files from your local environment. I didn’t manage to extract the exact file list, unfortunately.
- If the normal C&C server is not available, it tries to create / select a GitHub repo, and commits your data as results-*.json files 100kb at a time
- It also has a bunch of stealth and persistence measures that I’m not qualified to really analyze. Don’t assume that deleting the files is necessarily enough.
Rotate your keys, folks.
- tosh
I know it sounds a bit counter-intuitive but
try a fresh coding session without skills, agents.md, system prompt and additional tools
I think you will be positively surprised how good current models like GPT 5.6 Sol are when they are not oversteered and context spammed
Here is a task (python templating) with 9 runs with OpenCode, Pi and smol
https://smolenv.com/t/nested-template-includes-60636/
you can read each run step by step and see what the agents are doing and how the system prompt and available tools are steering their behaviour to take longer and higher cost
(disclaimer: I'm working on smol)
- cautiouscat
IMO, these agentic guard rails aren't the answer. It seems like we're seeing that the more you stuff context, the more the agents forget and don't follow the guidelines.[1]
Things like ArchUnit, static analyzers, and other deterministic tools can help with lower level things like architecture. For higher up stuff, I am increasingly feeling like agents don't guarantee anything and in many cases its just the opposite. This is where a thoughtful engineer and reviewer can keep things in check.
It's possible I'm off base here, but I can't make heads or tails of the LLM written readme.
- appplication
I see what this is going for but can’t help but feel like it’s overwrought. It feels a bit like the most likely outcomes are increased token burn, review surface, and time per task vs not using this.
Who knows, maybe that’s a good thing.
- jillesvangurp
I created a simple git repository with company skills. Basically just a collection of skills around tools and practices we share. One of the skills is "update company skills" this simply pulls the changes from git and wires them into the user's ~/.codex directory. You can probably do something similar for claude code.
This is far from perfect but we're in this weird transition phase where none of the major AI tool providers are really focusing much on team use of their stuff. But I expect that will start changing soon.
Current tools mostly focus on individuals doing things in isolation. And of course in a team there's more to collaborating than throwing stuff at each other via github. A central repository of company skills is merely our way of improvising a solution.
I find it interesting that Anthropic hired a few of the key people behind Zulip recently. Team chat with tightly integrated AI tools could be a missing piece here. Team communication flows and processes, including ways of working and guardrails are sort of the next piece of the puzzle here. Going from everyone doing their own thing to teams and companies doing things together is going to be a bit of a journey.