
Company News
Jerod Santo Joins Socket as Head of Media
Allow myself to introduce... myself.
kontol-dsh-skills
Advanced tools
Matt Pocock's engineering and productivity skills for the DeepSeek Harness (DSH), as an installable Cordis plugin. Unofficial port of github.com/mattpocock/skills.
Matt Pocock's Skills for Real Engineers as a distributable plugin for the DeepSeek Harness (DSH).
⚠️ Unofficial port. This package converts the promoted (engineering + productivity) skill set from mattpocock/skills (MIT, © 2026 Matt Pocock) into the DSH skill format. It is not affiliated with or endorsed by Matt Pocock.
26 skills (25 upstream + kontol-workflow, a starter router over the set), split like upstream into model-invoked (auto-advertised
in the session catalog) and user-invoked (reachable by typing /name in a
user message) — all under the kontol- prefix so they can't collide with (or be
confused with) the official skill names, see Naming:
Model-invoked (11) — kontol-code-review, kontol-codebase-design,
kontol-diagnosing-bugs, kontol-domain-modeling, kontol-grilling,
kontol-prototype, kontol-research, kontol-resolving-merge-conflicts,
kontol-tdd, kontol-wizard, kontol-writing-for-agents
User-invoked (15) — kontol-ask-matt, kontol-grill-me,
kontol-grill-with-docs, kontol-handoff, kontol-implement,
kontol-improve-codebase-architecture, kontol-setup-matt-pocock-skills,
kontol-teach, kontol-to-questionnaire, kontol-to-spec,
kontol-to-tickets, kontol-triage, kontol-wait-what, kontol-wayfinder, kontol-workflow
Skills register at BUNDLED_SKILL_RANK (600) — the lowest precedence in the
DSH skill registry — so any project or user skill with the same name wins over
the bundled copy. Upstream's philosophy is "make them your own", and the plugin
keeps that.
DSH plugins live in a profile's node_modules. For the web profile:
dsh plugin --profile web add kontol-dsh-skills
(dsh plugin forwards to pnpm in the profile directory. If your profile is
named otherwise, substitute it.)
Add an entry to the profile's cordis.patch.yml (or the home-level
$DSH_HOME/cordis.patch.yml):
# profiles/<name>/cordis.patch.yml (or ~/.dsh/cordis.patch.yml)
- id: mattpocock-skills
name: 'kontol-dsh-skills'
Restart DSH. The 11 model-invoked skills appear in the session skill catalog;
the 14 user-invoked skills are reachable with /kontol-grill-me, /kontol-tdd, etc.
If you'd rather have editable files than a managed bundle, copy the skill
directories anywhere DSH scans skills — a project .dsh/skills or
~/.dsh/skills:
mkdir -p ~/.dsh/skills && cp -r assets/skills/* ~/.dsh/skills/
Both routes coexist; the filesystem copy outranks the bundled plugin.
kontol- prefixTo keep the bundled skills clearly distinct from the official Matt Pocock set
(and from any project/user skills that keep the original names), the build
materializes every skill under the kontol- prefix:
assets/skills/tdd/ → assets/skills/kontol-tdd/,name: frontmatter field is patched to match,/tdd → /kontol-tdd,
"the code-review skill" → "the kontol-code-review skill").The prefix is configurable and the build is idempotent (already-prefixed skills are skipped, so re-running never double-prefixes):
npm run build # default prefix: kontol-
node scripts/build.mjs --prefix=my- # any kebab prefix (ends with "-")
node scripts/build.mjs --prefix= # empty prefix keeps original names
On Windows PowerShell, pass a different prefix via the environment instead:
$env:DSH_SKILL_PREFIX = "my-"; npm run build
npm run sync:upstream refreshes assets from upstream first and then rebuilds,
so the shipped state is always the prefixed set — nothing drifts.
Nothing updates automatically while the repo lives only on disk — sync is manual. Once the repo is on GitHub, change detection runs on a schedule. There are three layers:
| Command / trigger | What it does |
|---|---|
npm run check:upstream | Fast check (one git ls-remote, no clone) against the pinned SHA in .upstream-sha. Exit: 0 = up to date, 1 = update available, 2 = no pin yet (run a sync once). |
npm run sync:upstream | Re-clones mattpocock/skills, refreshes assets/skills, re-applies the prefix, rebuilds the manifest, and re-pins .upstream-sha to the exact commit synced. |
GitHub Actions (.github/workflows/sync-upstream.yml) | Daily cron (and manual Actions → Run workflow): runs the sync; if anything changed, bumps the patch version and opens a PR — you review the skill-content diff and merge. No changes → no PR. |
So after pushing to GitHub you get a PR the day upstream moves, without
touching anything. Locally, npm run check:upstream gives the same verdict in
a second. For a Windows-native schedule without GitHub, Task Scheduler running
node scripts/check-upstream.mjs on a timer works the same way.
npm install # installs peer deps for local dev
npm test # smoke-test the provider contract without booting DSH
npm run build # regenerate lib/manifest.js from assets/skills frontmatter
npm run check:upstream # has upstream moved? fast, no clone (0=current, 1=update, 2=no pin yet)
npm run sync:upstream # re-clone mattpocock/skills, refresh assets/, rebuild manifest, re-pin
assets/skills/<name>/SKILL.md — the shipped skill bodies, materialized under the kontol- prefix (upstream files,
minus agents/openai.yaml Claude metadata). Referenced resources (tests.md,
template.sh, …) ride along, and resourceBase points at each skill's
directory so relative links resolve.lib/manifest.js — generated metadata (name, description, invocation policy)
extracted from each SKILL.md frontmatter.lib/index.js — a Cordis plugin (name, inject: ['skills'], apply) that
registers one bundled provider on ctx.skills, mirroring the shipped
@deepseek-ai/dsh-skill-badge pattern.MIT. Skill content © 2026 Matt Pocock — see LICENSE. This port adds no new restrictions; the original attribution and license notice are preserved in every copied file's home repo.
DSH is pre-1.0 (0.1.0-rc). Peer dependencies pin the -rc range the plugin
was built against; re-run npm test after upgrading DSH and bump this package
accordingly.
FAQs
Matt Pocock's engineering and productivity skills for the DeepSeek Harness (DSH), as an installable Cordis plugin. Unofficial port of github.com/mattpocock/skills.
We found that kontol-dsh-skills demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Allow myself to introduce... myself.

Research
/Security News
A Twitch browser extension on Chrome and Firefox forwards users’ live OAuth session tokens through proxies controlled by a Russian bot service.

Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.