
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
@namch/agent-assistant
Advanced tools
Multi-agent orchestration framework for AI coding assistants (Cursor, Copilot, Antigravity, Claude Code).
Multi-agent orchestration for AI coding assistants
Transform one AI into a coordinated team of 20 specialist agents with structured workflows, quality gates, and 218+ domain skills.
Agent Assistant is an orchestration layer between you and your AI coding tool. Instead of one model doing everything, it transforms the AI into a multi-agent workflow:
┌──────────┐ ┌──────────────┐ ┌─────────────┐ ┌────────────┐ ┌──────────┐
│ You │────▶│ Command │────▶│ Orchestrator│────▶│ Specialist │────▶│ Output │
│ │ │ /cook /fix │ │ │ │ Agents │ │ │
└──────────┘ └──────────────┘ └─────────────┘ └────────────┘ └──────────┘
│ │
▼ ▼
┌─────────────┐ ┌────────────┐
│ Rules │ │ Skills │
│ (8 files) │ │ (218+) │
└─────────────┘ └────────────┘
| Component | Count | Purpose |
|---|---|---|
| Specialist Agents | 20 | Domain experts (backend, frontend, security, tester, ...) |
| Command Workflows | 40+ | Development workflows (/cook, /fix, /plan, /deploy, ...) |
| Domain Skills | 218 | On-demand knowledge (React, APIs, databases, DevOps, ...) |
| Matrix Domains | 19 | Skill categories (backend, frontend, security, ...) |
| Quality Gates | 5 | Compile, lint, test, security, review |
| Rule Files | 8 | Orchestration protocols and laws |
| Without Agent Assistant | With Agent Assistant |
|---|---|
| One AI, one style, no gates | 20 experts + workflows + quality checks |
| Easy to miss tests/security | Built-in test, review, security flows |
| Inconsistent patterns | Shared rules, skills, and conventions |
| High token usage | 85% token cost reduction |
| Ad-hoc prompts | Structured, repeatable workflows |
Use Agent Assistant when you want structured, repeatable, production-oriented AI-assisted coding instead of ad-hoc prompts.
| Metric | Improvement |
|---|---|
| ⏰ Time-to-Production | 70% faster |
| 🐛 Bug Rate | 70% reduction |
| 🔒 Security Issues | 70% reduction |
| 💰 Token Cost | 85% savings |
| Tool | Status | Integration |
|---|---|---|
| Claude Code (claude.ai/code) | ✅ Full Support | CLI → ~/.claude/ |
| Cursor | ✅ Full Support | CLI → ~/.cursor/ |
| GitHub Copilot (VS Code) | ✅ Full Support | CLI → ~/.copilot/ + VS Code |
| Antigravity / Gemini | ✅ Full Support | CLI → ~/.gemini/ |
Install globally
npm install -g @namch/agent-assistant
Install for your tool
# Single tool
agent-assistant install cursor
agent-assistant install copilot
agent-assistant install antigravity
agent-assistant install claude
# All supported tools
agent-assistant install --all
Verify installation
agent-assistant list
git clone https://github.com/nals-ai/agent-assistant.git
cd agent-assistant
node cli/install.js install --all # Installs for all tools globally
| Component | Cursor | Copilot | Claude Code | Antigravity |
|---|---|---|---|---|
| Entry point | ~/.cursor/rules/ | VS Code prompts | ~/.claude/CLAUDE.md | ~/.gemini/GEMINI.md |
| Commands | ~/.cursor/commands/ | ~/.copilot/commands/ | ~/.claude/commands/ | workflows |
| Framework | ~/.cursor/skills/agent-assistant/ | ~/.copilot/skills/agent-assistant/ | ~/.claude/skills/agent-assistant/ | ~/.gemini/antigravity/ |
| Agents | ~/.cursor/agents/ | ~/.copilot/agents/ | ~/.claude/agents/ | ~/.gemini/agents/ |
| Skills | ~/.cursor/skills/ | ~/.copilot/skills/ | ~/.claude/skills/ | in framework |
/docs:core # Generate 5 core technical docs
/docs:business # Generate 4 business docs
This creates files in ./documents/ that agents use when implementing features. Without these docs, agents work generically. With them, agents follow YOUR project's patterns.
# Simple feature (2-3 agents, minimal gates)
/cook:fast "add dark mode toggle"
# Complex feature (5-8 agents, all quality gates)
/cook:hard "implement OAuth 2.0 authentication"
# Code review
/review "audit authentication module"
# Create implementation plan
/plan "build notification system"
# Debug an issue
/debug "payment fails on Safari"
# Generate tests
/test:hard "user registration flow"
| Variant | When to Use | What It Does |
|---|---|---|
:fast | Simple tasks | Quick execution, 2-3 agents |
:hard | Complex features | Full workflow, 5-8 agents, all quality gates |
| Command | Description | Variants |
|---|---|---|
/cook | Implement features | :fast, :hard |
/code | Write code snippets | :fast, :hard |
/fix | Fix bugs and refactor | :fast, :hard |
| Command | Description | Variants |
|---|---|---|
/test | Generate tests | :fast, :hard |
/review | Code review | :fast, :hard |
/debug | Systematic debugging | :fast, :hard |
| Command | Description | Variants |
|---|---|---|
/plan | Implementation planning | :fast, :hard |
/brainstorm | Requirements discovery | :fast, :hard |
/design | UI/UX design | :fast, :hard |
| Command | Description | Files Created |
|---|---|---|
/docs:core | Technical documentation | 5 knowledge-*.md files |
/docs:business | Business documentation | 4 business-*.md files |
/docs:audit | Security/compliance audit | 4 audit-*.md files |
| Command | Description |
|---|---|
/deploy:check | Pre-deployment validation |
/deploy:preview | Deploy to staging |
/deploy:production | Deploy to production |
/deploy:rollback | Revert to previous version |
| Command | Description |
|---|---|
/ask | Q&A about codebase |
/auto | Auto-detect best command |
Agent Assistant includes 20 specialist agents organized by domain:
| Agent | Role |
|---|---|
backend-engineer | APIs, server logic, data |
frontend-engineer | UI, React, a11y, performance |
mobile-engineer | iOS/Android, React Native |
game-engineer | Game loop, 3D, performance |
| Agent | Role |
|---|---|
tech-lead | Orchestration, routing |
database-architect | Schema, migrations, tuning |
| Agent | Role |
|---|---|
tester | Test strategy, automation |
reviewer | Code review, compliance |
debugger | Root cause analysis |
security-engineer | OWASP, threat modeling |
| Agent | Role |
|---|---|
planner | Implementation plans, risks |
brainstormer | Requirements, clarification |
business-analyst | User stories, stakeholders |
| Agent | Role |
|---|---|
designer | UI/UX, design system |
devops-engineer | CI/CD, infrastructure |
docs-manager | README, API docs |
performance-engineer | Profiling, optimization |
researcher | Docs, sources, comparisons |
scouter | Codebase exploration |
project-manager | Sprints, risks, delivery |
Agent Assistant uses Matrix Skill Discovery—a centralized system that automatically injects relevant skills into agents based on their declared profile.
Instead of hardcoding skills in agents:
# OLD approach (no longer used)
skills: [api-patterns, database-design, nodejs-best-practices]
Agents declare a profile:
# Matrix Skill Discovery
profile: "backend:execution"
The system automatically resolves and injects skills:
Agent declares profile → Matrix resolves domains → Skills injected at runtime
| Metric | Hardcoded Skills | Matrix Discovery |
|---|---|---|
| Add new skill | Update 10+ files | Update 1 file |
| Skill consistency | Manual | Guaranteed |
| Agent file size | ~200 lines | ~150 lines |
| Single source | ❌ | ✅ |
matrix-skills/
├── _index.yaml # Registry + agent profiles + resolution rules
├── backend.yaml # 20 backend skills
├── frontend.yaml # 18 frontend skills
├── architecture.yaml # 9 architecture skills
├── quality.yaml # 17 QA skills
├── security.yaml # 6 security skills
├── design.yaml # 10 design skills
├── planning.yaml # 9 planning skills
├── devops.yaml # 15 DevOps skills
├── data.yaml # 7 database skills
├── performance.yaml # 1 performance skill
├── research.yaml # 11 research skills
├── mobile.yaml # 8 mobile skills
├── gaming.yaml # 3 gaming skills
├── management.yaml # 4 management skills
├── ai-ml.yaml # 13 AI/ML skills
├── cloud.yaml # 11 cloud skills
├── languages.yaml # 17 language skills
├── tools.yaml # 31 utility skills
└── mcp.yaml # 8 MCP skills
- skill_id: api-patterns
category: core
priority_score: 9
relevance_mapping:
agents: [backend-engineer, tech-lead]
profiles: ["backend:*"]
description: "REST/GraphQL design, versioning, pagination"
skills/{skill-id}/SKILL.mdmatrix-skills/{domain}.yamlagent-assistant/
├── agents/ # 20 specialist agents
│ └── {agent}.md # Agent definition (profile-based)
├── commands/ # 40+ command workflows
│ ├── cook/ # Feature implementation
│ │ ├── fast.md # Quick execution
│ │ └── hard.md # Full workflow
│ ├── fix/ # Bug fixing
│ ├── plan/ # Planning
│ ├── docs/ # Documentation
│ └── deploy/ # Deployment
├── rules/ # 8 orchestration rules
│ ├── BOOTSTRAP.md # Entry point
│ ├── ORCHESTRATION-LAWS.md # 10 inviolable laws
│ ├── EXECUTION-PROTOCOL.md # Phase execution
│ ├── ADAPTIVE-EXECUTION.md # Tier 1/2 decisions
│ ├── AGENT-RULES.md # Agent guidelines
│ ├── SKILL-DISCOVERY.md # Matrix algorithm
│ ├── ERROR-RECOVERY.md # Error handling
│ └── QUICK-REFERENCE.md # Lookup tables
├── matrix-skills/ # 19 domain files + registry
│ ├── _index.yaml # Central registry (218 skills)
│ └── {domain}.yaml # Domain-specific skills
├── skills/ # 218 domain skills
│ └── {skill-id}/SKILL.md # Skill definition
├── documents/ # Generated documentation
│ ├── knowledge-*.md # Core docs
│ ├── business/ # Business docs
│ └── audit/ # Audit docs
├── cli/ # CLI installer
│ └── install.js # Main installer
├── code-assistants/ # IDE-specific configs
├── AGENT-TEMPLATE.md # Agent template
├── CLAUDE.md # Claude Code entry
├── CURSOR.md # Cursor entry
├── COPILOT.md # Copilot entry
├── GEMINI.md # Antigravity entry
└── package.json
The Orchestrator is the central brain that coordinates all work:
╔═══════════════════════════════════════════════════════════════════════════════╗
║ ORCHESTRATOR — THE CENTRAL BRAIN ║
║ ║
║ ✅ YOU DO: Delegate, coordinate, verify, synthesize ║
║ ❌ YOU NEVER: Write code, debug, test, design, or implement directly ║
╚═══════════════════════════════════════════════════════════════════════════════╝
| Tier | Name | When Used | Context |
|---|---|---|---|
| TIER 1 | Sub-agent | When tool available | ISOLATED (fresh memory) |
| TIER 2 | Embody | Fallback only | SHARED (same memory) |
Rule: TIER 1 is MANDATORY when available. TIER 2 is FALLBACK only.
Agent Assistant generates comprehensive documentation through the /docs command family. This documentation helps AI agents understand YOUR project's specific patterns and conventions.
| Without Docs | With Docs |
|---|---|
| Agents work with generic patterns | Agents follow YOUR conventions |
| Inconsistent implementations | Consistent with codebase |
| Rework due to misunderstanding | First-time quality |
| Token waste on context | Efficient, targeted responses |
./documents/)Generated by /docs:core — Technical documentation for AI agents.
| File | Purpose | Lines |
|---|---|---|
knowledge-overview.md | Project introduction, goals, tech stack | ~400 |
knowledge-architecture.md | System design, components, patterns | ~500 |
knowledge-domain.md | Data models, API contracts, entities | ~550 |
knowledge-source-base.md | Directory structure, file purposes | ~450 |
knowledge-standards.md | Code style, naming, commit format | ~500 |
./documents/business/)Generated by /docs:business — Business-oriented documentation.
| File | Purpose | Lines |
|---|---|---|
business-prd.md | Product requirements document | ~450 |
business-features.md | Feature specifications | ~600 |
business-workflows.md | User journeys and flows | ~550 |
business-glossary.md | Term definitions (80+ terms) | ~500 |
./documents/audit/)Generated by /docs:audit — Security and compliance documentation.
| File | Purpose |
|---|---|
audit-security.md | Security assessment |
audit-compliance.md | Compliance status |
audit-dataflow.md | Data flow analysis |
audit-recommendations.md | Security recommendations |
# Generate all core technical docs (recommended first step)
/docs:core
# Generate business documentation
/docs:business
# Generate security/compliance audit docs
/docs:audit
# Single tool
agent-assistant uninstall cursor
agent-assistant uninstall copilot
agent-assistant uninstall antigravity
# All tools
agent-assistant uninstall --all
Your custom skills and configurations are preserved.
git pull origin main
agent-assistant install --all # or specific tool
Add skill folders to your tool's skills directory:
~/.cursor/skills/~/.copilot/skills/~/.gemini/antigravity/skills/Custom skills are picked up automatically.
skills/{skill-id}/SKILL.mdmatrix-skills/{domain}.yaml- skill_id: my-new-skill
category: specialized
priority_score: 7
relevance_mapping:
agents: [backend-engineer]
profiles: ["backend:execution"]
description: "Brief description for AI recognition"
Contributions are welcome!
git checkout -b feature/your-featuregit commit -m 'feat: add X'| Type | Description |
|---|---|
feat | New feature |
fix | Bug fix |
docs | Documentation |
refactor | Code refactoring |
test | Tests |
chore | Maintenance |
If you find this project helpful, consider buying me a coffee!
Agent Assistant — Orchestrate. Delegate. Verify. Deliver.
FAQs
Multi-agent orchestration framework for AI coding assistants (Cursor, Copilot, Antigravity, Claude Code, Codex) with Hybrid Skill Orchestration Layer (HSOL).
The npm package @namch/agent-assistant receives a total of 45 weekly downloads. As such, @namch/agent-assistant popularity was classified as not popular.
We found that @namch/agent-assistant demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.