
Security News
The Code You Didn't Write Is Still Yours to Defend
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.
adonisjs-maestro
Advanced tools
Reusable agent skills for AdonisJS, Lucid, Inertia, Japa, and full-cycle engineering orchestration.
Use the adonisjs-maestro CLI to install the right skills for your stack:
npx adonisjs-maestro
Non-interactive examples:
npx adonisjs-maestro --stack=vue --yes
npx adonisjs-maestro --stack=react --global --agent=codex --yes
npx adonisjs-maestro --skills=maestro,adonisjs,lucid,japa --yes
Available stacks:
| Stack | Skills |
|---|---|
monorepo | maestro, adonisjs, lucid, japa |
hypermedia | maestro, adonisjs, lucid, japa, edge |
react | maestro, adonisjs, lucid, japa, inertia-react |
vue | maestro, adonisjs, lucid, japa, inertia-vue |
custom | Choose individual skills |
Install the collection with the skills CLI:
npx skills add lncitador/adonisjs-maestro
For a global install:
npx skills add lncitador/adonisjs-maestro -g --yes
Restart your agent after installing so the new skills are loaded.
| Skill | Use it for |
|---|---|
maestro | Orchestrating full-cycle app work: intake, planning, implementation, verification, commit, push, and PR |
adonisjs | AdonisJS v7 backend work: migrations, models, transformers, controllers, routes, auth, policies, services, events, and review |
lucid | Lucid ORM and SQL layer: migrations, schema generation, models, relationships, query builders, transactions, factories, and seeders |
edge | Edge.js server-side templates in AdonisJS Hypermedia apps: layouts, components, forms, slots, and template state |
inertia-vue | Vue 3 frontend patterns in AdonisJS + Inertia projects |
inertia-react | React frontend patterns in AdonisJS + Inertia projects |
japa | Japa testing in AdonisJS apps: API tests, browser tests, console tests, fakes, swaps, and database setup |
| Skill | Stack | Use it for |
|---|---|---|
tuyau | api-monorepo | Tuyau end-to-end type-safe API client: codegen, typed routes, and RPC-style calls |
Use maestro when the task is broader than a single framework question.
INTAKE -> PLANNING -> BUILD -> VERIFY -> PUBLISH -> DONE
Examples:
/maestro plan and implement this AdonisJS + Inertia feature.
/maestro review this PR against the implementation plan.
/maestro verify, commit, push, and open a PR for this change.
maestro coordinates the other skills instead of replacing them. For example, an AdonisJS + Inertia Vue task should usually combine:
/maestro for phase control and workflow gates/adonisjs for backend contracts and routing/lucid for migrations, models, relationships, query builders, and factories/inertia-vue for frontend page/form patterns/japa for test strategy and fixturesUse a specialized skill directly when the request is narrow:
/adonisjs create a controller, route, and validator for posts.
/lucid create a migration, model relationship, and factory for posts.
/japa write a functional test with loginAs.
/inertia-vue fix this Form component.
/inertia-react type these generated Data props.
All skills live under skills/. Each folder contains a required SKILL.md file and optional resources:
skills/
├── maestro/
├── adonisjs/
├── lucid/
├── edge/
├── inertia-vue/
├── inertia-react/
└── japa/
The framework skills include references and runbooks for deeper context. The maestro skill intentionally has no scripts or references: it is an orchestration layer.
Use the Skills CLI to search, install, check, and update skills:
npm run typecheck
npm run build
npx skills find adonisjs
npx skills check
npx skills update
Before publishing changes, make sure each skill folder contains a valid SKILL.md with YAML frontmatter:
---
name: skill-name
description: Use when...
---
Keep optional resources (references/, scripts/, assets/, agents/) only when they directly support the skill.
Releases are created with release-it:
npm run release
The release command runs typecheck, tests, and build before bumping the package version, creating the release commit, and tagging it as v<version>. Pushing the tag triggers GitHub Actions to publish adonisjs-maestro to npm.
Configure npm Trusted Publishing for .github/workflows/publish.yml before the first release. The workflow uses GitHub OIDC instead of a long-lived npm token.
lucid is focused on the ORM/database layer and should be paired with adonisjs for controllers, routes, validators, services, and framework-level architecture.inertia-vue and inertia-react are frontend-layer skills and should be paired with adonisjs for backend work.japa is focused on testing patterns for AdonisJS apps.maestro should be used when a task needs orchestration, phase gates, or publishing workflow discipline.FAQs
Install AdonisJS Maestro agent skills by stack
The npm package adonisjs-maestro receives a total of 2 weekly downloads. As such, adonisjs-maestro popularity was classified as not popular.
We found that adonisjs-maestro demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.