Skills DirectorySkills Directory
SkillsLearnSecurityCategoriesDocsCommunityBlog
Sign InSubmit Skill
Skills Directory

Security-tested agent skills for Claude, coding agents, and AI workflows.

Directory

  • Browse Skills
  • All Skills A–Z
  • Claude Skills
  • Claude Code Skills
  • Agent Skills
  • Categories
  • Submit a Skill

Learn

  • Learn Hub
  • Install Claude Skills
  • Write SKILL.md
  • Skills vs MCP
  • Directories Compared

Security

  • Security
  • Methodology
  • Secure Claude Skills
  • Security Badges

Company

  • About
  • Community
  • Blog
  • API Docs
  • Advertise

2026 Skills Directory. All rights reserved.

Back to skills

Mermate

CSecurity

Master orchestrator for the Mermate application (mermaid-gpt v5.0.0) — the 5-tab agentic artifact progression Simple Idea → Markdown Spec → Mermaid → TLA+ → TypeScript. Carries the authoritative model of the pipeline state machine, the run-lineage contract, Opseeq stage reporting, and the coordination map to all tab and infrastructure sub-skills. Invoke for ANY work in this repository — coding, debugging, refactoring, extending any tab, route, agent flow, or the MCP bridge.

3 stars
0 votes
0 copies
1 views
Added 9/11/2026
developmenttypescriptpythonrustgonodeexpressdebuggingrefactoringapifrontend

Works with

terminalapimcp

Security Analysis

C67/100
mediumUses curl or wget to download content
criticalDownloads and executes remote scripts — classic supply chain attack

Scanned 9/11/2026

Install to Claude Code

$npx -y skills add DylanCkawalec/Mermate --skill mermate --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Mermate?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Mermate
[![Security: C — Skills Directory](https://www.skillsdirectory.com/api/skills/dylanckawalec-mermate/badge)](https://www.skillsdirectory.com/skills/dylanckawalec-mermate)

More formats (shields.io, HTML) on the badges page.

Download Zip
Files
SKILL.md
---
name: mermate
description: Master orchestrator for the Mermate application (mermaid-gpt v5.0.0) — the 5-tab agentic artifact progression Simple Idea → Markdown Spec → Mermaid → TLA+ → TypeScript. Carries the authoritative model of the pipeline state machine, the run-lineage contract, Opseeq stage reporting, and the coordination map to all tab and infrastructure sub-skills. Invoke for ANY work in this repository — coding, debugging, refactoring, extending any tab, route, agent flow, or the MCP bridge.
---

# Mermate

## Binding Persona
Operate under the standards of Leslie Lamport (Turing Award 2013), as established in `specification-master-agent`. The application itself is a state machine; treat it as one. The backend is the single source of truth — the frontend never guesses. Reject cleverness that obscures which state a run is in, and reject any change that lets the UI infer what the server must declare.

## The System (Ground Truth)
Mermate is a Node/Express app (`server/index.js`, port 3333, `npm start`) serving a static frontend (`public/`) with a Python MCP sidecar (`mcp_service/`). Its purpose: refine a raw idea into a verified artifact chain through five tabs, each a state in one progression:

```
idea ──▶ md ──▶ mmd ──▶ tla ──▶ ts        (rust is an optional terminal extension)
```

- Frontend controller: `public/js/mermaid-gpt-app.js` — `STAGE_REGISTRY` (lines 28–130) is the single source of truth for every stage's identity, visuals, input config, wait bands, and IPO contract. Never duplicate stage semantics elsewhere.
- Agent panel: `public/js/mermaid-gpt-agent.js` — two-phase flow (run → pause for notes → finalize), detached sessions surviving refresh via `GET /api/agent/attach/:sessionId`.
- Backend routes: `server/routes/{render,tla,ts,tsx,rust,agent,search,transcribe,specula,openclaw,bundle,trace,runs}.js`, mounted in `server/index.js`.
- Content routing: `server/services/input-router.js` classifies input into `text | md | mmd | hybrid` and selects the pipeline.

## The State Machine (Binding Model)
- **Variables**: current stage, unlocked stage set, run lineage (`run_id`), artifact store (`flows/`, `runs/`, `archs/`).
- **Transitions**: only a stage endpoint may advance the machine, and it declares the new state in its `progressionUpdate` payload:
  ```json
  { "stage": "mmd|tsx|tla|ts|rust",
    "unlockedStages": ["idea","md","mmd", ...],
    "nextRecommended": "tla",
    "confidence": 0.0 }
  ```
- **Invariants** (violations are bugs, report them as such):
  1. **Server-declared readiness**: the frontend renders readiness exclusively from `progressionUpdate`; it never infers unlock state.
  2. **Lineage**: every artifact belongs to a `run_id`; runs are replayable/auditable through `runs/` JSON and `GET /api/mermate/trace/:run_id`.
  3. **Monotonic unlock**: stages unlock, they do not silently re-lock.
  4. **Non-blocking telemetry**: Opseeq reporting (`server/services/opseeq-bridge.js` `reportStage`) is fire-and-forget; it must never stall a pipeline stage.
  5. **Skeleton honesty**: a stage emits failure (`render_failed`, `tla_failed`, `ts_failed`) rather than a fabricated success.

## Skill Coordination (Decision-Point Mapping)
| Decision point | Mandatory sub-skill |
|---|---|
| Tab 1 work — idea intake, enhancement, voice | `mermate-tab-idea` |
| Tab 2 work — markdown spec intake/refinement | `mermate-tab-markdown` |
| Tab 3 work — Mermaid compile, render, depth | `mermate-tab-mermaid` |
| Tab 4 work — TLA+ generation, SANY/TLC | `mermate-tab-tla` |
| Tab 5 work — TypeScript runtime gen/test | `mermate-tab-typescript` |
| Agent sessions, Opseeq, MCP bridge, run lineage, boot/health | `mermate-agentic-infra` |
| MCP tool surface changes | `mermate-openclaw-mcp` (.agents) |
| Opseeq gateway config/troubleshooting | `mermate-opseeq-connect` (.agents) |
| Formal rigor on the TLA+ stage | `specification-master-agent` tree |

Never load more sub-skills than the current tab or decision requires. This master skill remains sole authority on cross-stage invariants.

## Behavioral Doctrine
1. Read the code before changing it: stage semantics live in `STAGE_REGISTRY` and the owning route file — cite them, don't reinvent them.
2. A change touching stage progression must preserve the `progressionUpdate` contract and the five invariants above, or it is refused with the gap named.
3. Telemetry (Opseeq) is optional infrastructure: boot and render must succeed with the gateway down (`fallback_events` in traces prove this).
4. Laziness discipline from `ponytail` applies to all edits: shortest correct diff, reuse existing services, no speculative scaffolding.

## Verification (run what matches the change)
- `npm test` — full suite (`node --test test/test-*.js`)
- `npm run test:fast` — fast unit tests
- `node --test test/test-e2e-tandem.js` — tandem hardening loop: render → TLA+ → TS with trace correlation; self-contained, spawns its own server
- `python3 -m unittest test/test_mermate_mcp_service.py` — MCP bridge
- `curl -s http://localhost:3333/api/health | python3 -m json.tool` — live boot sanity

Attribution

DylanCkawalecDylanCkawalec
View sourceMore from DylanCkawalec →
SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Related Skills

Browser Extension Developer

Use this skill when developing or maintaining browser extension code in the `browser/` directory, including Chrome/Firefox/Edge compatibility, content scripts, background scripts, or i18n updates.

281612 votes

Seo Optimizer

SEO optimization with keyword analysis, readability assessment, technical validation, content quality. Use for search rankings, blog posts, content audits, or encountering keyword density, readability scores, meta tags, schema markup errors.

2132 votes

Google Official Seo Guide

Official Google SEO guide covering search optimization, best practices, Search Console, crawling, indexing, and improving website search visibility based on official Google documentation

1862 votes

Tanstack Start

Build a full-stack TanStack Start app on Cloudflare Workers from scratch — SSR, file-based routing, server functions, D1+Drizzle, better-auth, Tailwind v4+shadcn/ui. Use whenever the user mentions TanStack Start, asks to scaffold a full-stack Cloudflare app with SSR, wants an SSR dashboard, or asks for a React 19 + Cloudflare Workers app with file-based routing and server functions — even if they don't name TanStack Start specifically. No template repo — Claude generates every file fresh per ...

9881 votes

Pentest

PTES-aligned adversarial security audit for backend, frontend, and mobile applications. Produces a CVSS-scored Hacker Report with verified PoCs and phased remediation.

5491 votes
View all in development →