██████╗ ██████╗ ██████╗ ██╗ ██╗ ██╔════╝██╔═══██╗██╔═══██╗██║ ██╔╝ ██║ ██║ ██║██║ ██║█████╔╝ ██║ ██║ ██║██║ ██║██╔═██╗ ╚██████╗╚██████╔╝╚██████╔╝██║ ██╗ ╚═════╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═╝
Optimising the vibe in vibecoding.
Install · How it Works · FAQ · llms.txt
AI agents / LLMs: read llms.txt.
You've got brilliant ideas (that definitely are original and unique). You set up Claude Code, crack your joints, and fire up your favourite IDE (VSCode). You ask Claude, politely, to write the code for this feature that you believe is game-changing.
But wait, how do you know that Claude is writing... right?
With little to zero software engineering knowledge, expertise, and skills, you can now outsource the blood, sweat, and tears of learning discrete mathematics, algorithms, and programming languages to this simple skill: /cook. Now, your coding agent can write the highest-quality code.
Note
🚀 New in v1.1.0 · iPhone and iPad standards, a cryptography concern, and smaller payloads
cook now covers iOS/iPadOS, ships its security rules in the public install, and refreshes the standards to October 2026 versions. Re-run the installer to pick it up.
Update with curl -fsSL https://raw.githubusercontent.com/ndisisnd/cook/main/install.sh | bash · Release notes
cook is the knowledge layer. Before your coding agent starts planning or writing code changes, ask it to fire up cook. The skill checks your codebase, searches the most relevant coding references, compresses them, and outputs to your coding agent ready to be used.
Every run is saved — if the code changes are on the same programming languages, matches file extensions (e.g. .tsx), or similar types (e.g. creating a component), cook won't call the entire library of references again but simply refers to a cache of existing runs so it's faster and cheaper.
Run this in your terminal:
curl -fsSL https://raw.githubusercontent.com/ndisisnd/cook/main/install.sh | bashThis installs cook to ~/.claude/skills/cook/. To install somewhere else:
COOK_DIR=/path/to/destination bash install.shRequirements: curl, tar, python3
cook is a plain Agent Skill, so one install serves both agents. The installer symlinks ~/.agents/skills/cook → ~/.claude/skills/cook, which is where Codex looks for user skills. One copy on disk, one source of truth, nothing to keep in sync.
In Codex you can call it explicitly with $cook, pick it from the /skills list, or simply describe your task and let Codex select it implicitly from the skill description. The /cook slash syntax is Claude Code-only.
Flags and prose arguments behave identically in both agents. $cook --react fix re-renders in Codex does exactly what /cook --react fix re-renders does in Claude Code — the arguments are passed through as plain text and cook parses them itself, rather than relying on the harness.
flowchart TD
invoke["<b>/cook</b><br/>file paths · prose · git context"]
fp["<b>Fingerprint</b><br/>hash the raw signals"]
cache{"cache hit?"}
classify["<b>Classify intent</b><br/>feature · bug · refactor …"]
route["<b>Route</b><br/>match concerns + domains"]
load["<b>Load rules</b><br/>global P0 → concerns → domains"]
compile["<b>Compile</b><br/>stitch into one payload"]
invoke --> fp --> cache
cache -->|hit| compile
cache -->|miss| classify --> route --> load --> compile
- Ask your coding agent to invoke
/cook:cookwill check file paths, prose descriptions, git context. - Build a fingerprint: the raw signals are hashed and checked against the cache. A match skips classification entirely — straight to compile.
- Classify intent: if it's a miss,
cookclassifies the intent (e.g. "add a feature" vs. "fix a bug"), then routes to the relevant domain and concern standards. - Load global rules: Global rules are always loaded first (e.g. SOLID principles, DRY, security) — no exceptions, regardless of cache state.
- Load concern rules: Concern rules are cross-cutting rules like security, error handling, performance, and API design.
- Load domain rules: Domain rules for your programming language are loaded. Multiple domains can match at once.
- Cache the result: Routing decisions are written to cache so the next identical surface hits instantly.
- Compile and output: A Python compiler stitches all the loaded rule files into one markdown blob for your agent to ingest.
cookends here!
You can invoke /cook with explicit flags or prose to control exactly what gets loaded.
Refer to FLAG_LIST.md for the full list of flags
The --flag namespace is derived from vocab/tag-vocabulary.json and may grow as the vocabulary grows. Treat this list as a snapshot; the vocab file is the source of truth.
Shelf (1): --global — loads standards/global/SKILL.md + all 9 concern refs (P0 + full concern set). Use when you want the global floor without auto-detection.
Concerns (9): --security, --auth, --crypto, --performance, --architecture, --api-design, --error-handling, --debug, --cicd — each loads one ref from standards/global/refs/; no P0.
Domains (13): --react, --nextjs, --css, --flutter, --dart, --swift, --ios, --macos, --typescript, --nodejs, --database, --supabase, --graphql — loads the full domain shelf (SKILL.md + all refs).
Sub-ref flags: --<domain>:<ref> loads a single ref from a domain shelf without loading the domain SKILL.md. The ref is a file stem under standards/<domain>/refs/. Pair it with the bare domain flag to add the SKILL.md floor + only the named ref (the full shelf is suppressed): --react --react:hooks → standards/react/SKILL.md + standards/react/refs/hooks.md only. Name several sub-refs to pick a wider subset: --react --react:hooks --react:state-management.
| Invocation | What loads |
|---|---|
/cook |
Auto-detect from git + manifests; loads global P0 + matched concerns + matched domains |
/cook --global |
standards/global/SKILL.md + all 9 concern refs; no auto-detection |
/cook --security |
standards/global/refs/security.md only; no P0 |
/cook --react --nextjs |
Both shelves in full; no P0 |
/cook --react:hooks |
standards/react/refs/hooks.md only; no SKILL.md, no P0 |
/cook --react --react:hooks |
standards/react/SKILL.md + standards/react/refs/hooks.md only |
/cook --react fix re-renders in the dashboard |
standards/react/SKILL.md + only the refs the LLM picks from react/_INDEX.md; no P0, no cache |
/cook refactor the OAuth callback |
LLM scans every _INDEX.md and loads matching refs across the whole library; no P0, no cache |
/cook --notarealflag |
Error — non-zero exit, usage printed with the full valid flag list, nothing loaded |
P0 trade-off: any explicit flag or prose argument skips the global P0 floor — the contract is "load exactly what I named." Use --global to opt back in explicitly. Default /cook keeps the floor.
Cook can keep an opt-in log of what it fires. It's off by default and never changes what loads.
cook --init # initialise a LOCAL store for this repo (creates + enables)
cook --enable-telemetry # start logging (local store if inited, else global)
cook --disable-telemetry # stop logging (records are kept)
cook --status # print stats to the consoleWhen enabled, each successful fire appends one record — the intent, the raw prompt, and the standards extracted (folder → the standards loaded within it) — to telemetry/telemetry.json. cook --status reports the total fire count and ranked breakdowns by individual standard, folder, and intent.
Scope is local-first. Run cook --init inside a repo to give it its own log at <repo>/telemetry/telemetry.json — that repo's cook calls then record there. Any repo you haven't initialised falls back to the global store under the cook install dir (alongside the cache). Both are gitignored and never shipped by the installer; they're purely local. Add --global to any telemetry command to force the global store.
| Standards | What's covered |
|---|---|
| Global | Universal rules loaded on every task: architecture, API design, error handling, security, auth, cryptography, performance, debugging, and CI/CD. The security rules (injection, XSS, CSP, SSRF, uploads, MCP/LLM output, supply chain) and the crypto concern (AEAD, key rotation, TLS) ship in the public install, reviewed against OWASP, NIST and IETF guidance. Targets OWASP Top 10 2025 and NIST SP 800-63B-4 |
| CSS | Deliberately lightweight, principle-driven presentation-layer standards — CSS is styles, not correctness-critical, so the SKILL favours judgment and consistency over rigid rules: six battle-tested principles (keep specificity low, scope by default, tokenize, lay out with Flexbox/Grid, use the platform, compose over override) plus a minimal accessibility/security floor. Depth lives in on-demand refs: architecture (@layer, methodology, @scope), layout (Grid/subgrid/container queries/logical properties), theming (custom properties, oklch()/light-dark()), performance (compositor animation, content-visibility, fonts), accessibility, tooling (Stylelint/PostCSS/Sass), security, and Baseline Widely Available features, and a TailwindCSS sub-standard (v4 @theme, cn()/tailwind-merge, cva). Co-loads with the framework shelves |
| Dart | Language correctness, sealed/record/pattern matching, async, naming conventions, tooling (build_runner, dart format), and testing (mocktail, fake_async) |
| Database | PostgreSQL 16-18 schema design, safe expand-contract migrations (lock_timeout, NOT VALID, CONCURRENTLY), query optimisation, indexing, RLS, and Redis caching strategy (TTL, eviction, pipeline safety) |
| Flutter | Widget best practices, state management (Bloc/Riverpod/GetX), navigation (GoRouter), architecture (feature-domain), networking (Dio), error handling (Either/dartz), and DI (GetIt) |
| GraphQL | Schema design, resolver patterns, security (depth/complexity limits), performance (DataLoader, N+1 prevention), testing, and tooling (codegen, graphql-eslint) |
| iOS | Native iOS/iPadOS app development: SwiftUI app and scene lifecycle (iOS 27 SDK UIScene and launch-screen mandates), NavigationStack and sheets, iPad and iPhone Duo adaptivity, Dynamic Type/VoiceOver/Liquid Glass, background tasks, APNs, Live Activities and widgets, permissions/ATT/privacy manifests, Keychain, Sign in with Apple and passkeys, account deletion, signing/TestFlight/App Review, and XCUITest. iOS-only (not macOS) |
| macOS | Native macOS 26+ app development (Xcode 27): SwiftUI/AppKit structure, scenes/windows/menu-bar apps, App Sandbox and TCC, code-signing/notarization, distribution (Sparkle, MAS), Observation state, persistence (SwiftData/Core Data), localization, performance/accessibility, and HIG conventions. macOS-only (not iOS) |
| Next.js | Next.js 16.4 App Router and Pages Router: Server/Client Components, data fetching, Cache Components and caching, proxy.ts, Server Actions, security, performance, and testing |
| Node.js | Node.js 24 LTS runtime safety: event loop, streams, backpressure, graceful shutdown, async error handling, native TypeScript execution, --env-file, permission model, node: imports, and logging |
| React | React 19.3 and React Compiler: component patterns, hooks (useEffectEvent), state management (Zustand/Redux/TanStack Query), performance, security (XSS/CSP), testing (RTL/MSW/Vitest), and tooling (Vite 8) |
| Supabase | RLS policies (auth.uid/auth.jwt), anon vs service_role key boundary, Edge Functions (Deno, verify_jwt), Postgres functions (SECURITY DEFINER/INVOKER), and migration workflow |
| Swift | Swift 6.2+ language correctness: optionals, error handling, strict concurrency (actors, Sendable, @MainActor), value types, protocols/generics (some/any), ARC, naming, access control, plus testing (Swift Testing), tooling (SwiftLint/swift-format/SPM), performance, and C/Obj-C interop |
| TypeScript | TypeScript 6.x (7.x-compatible): type safety, narrowing, generics, modules, tsconfig and ESLint tooling, jest/vitest setup, and input validation patterns |
The tool itself. Re-run the installer — it fetches the latest tarball and unpacks it over your existing install:
curl -fsSL https://raw.githubusercontent.com/ndisisnd/cook/main/install.sh | bashWhat cook produced. cook reuses a cached routing decision whenever the task surface (the files, extensions, and prose it saw) matches a prior run. Change the surface — different files, a different prompt — and it re-routes and re-caches. There's nothing to refresh by hand; a new surface always gets a fresh run.
Does cook write any of my code? No. cook only reads your repo and outputs a standards payload. Your coding agent does the writing — cook just tells it what "good" looks like for the task at hand.
I ran /cook --react and the security rules I expected didn't load. Why? Any explicit flag or prose argument skips the global P0 floor — the contract is "load exactly what I named." Run plain /cook to keep the floor, or add --global to opt back in.
My task is full-stack — is there a --full-stack flag? No. There are no layer modes. cook matches concerns and domains by keyword, so a task that touches both UI and server just matches shelves from both sides at once.
Where do the standards come from, and are they current? They're a bundled library under standards/, curated per language. Security is covered by refs/security.md, refs/auth.md and refs/crypto.md in the Global shelf, plus platform rules in the other shelves. All of it ships in the public install. Every standards file carries a last_reviewed date, and scripts/check_freshness.py warns when one passes 90 days. The flag namespace in this README is a snapshot — vocab/tag-vocabulary.json is the source of truth and may grow.
cook's standards are a compression of prior art, not original research. The libraries lean on:
- OWASP — the security rules are built on the OWASP Cheat Sheet Series, the ASVS, the Top 10, and CWE mappings, spanning credentials, crypto, auth, input validation, XSS, API and transport security, supply chain, and more.
- Airbnb JavaScript Style Guide — a reference point for the JavaScript, TypeScript, and React conventions.
- Clean Code and Clean Architecture (Robert C. Martin), and the SOLID and DRY principles they popularized — the backbone of the global engineering floor.
- WCAG — the accessibility rules across the CSS and framework shelves.
- IETF specifications — HTTP and REST semantics, and RFC 7807 (Problem Details) for the API error-shape guidance.
- Established patterns the shelves codify — Dependency Injection / Inversion of Control, expand-contract database migrations, the DataLoader / N+1 pattern for GraphQL, and Semantic Versioning for release discipline.
- The community linters and formatters whose defaults the shelves encode — ESLint, Prettier, Biome, Stylelint, SwiftLint, swift-format,
dart format, Black, and Ruff. - The official language, framework, and platform docs each domain shelf draws from — among them React, Next.js, Node.js, Flutter/Dart, Swift, Apple's Human Interface Guidelines, PostgreSQL, Supabase, and GraphQL, plus the state and testing libraries they cover (Redux, Zustand, TanStack Query, Bloc, Riverpod; Jest, Vitest, Testing Library, MSW, Playwright, XCTest, and Swift Testing).
Trademarks and guidelines belong to their respective owners; cook restates and condenses their guidance for coding agents and claims no endorsement.
Dedicated to JC 💕