
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
metacoding
Advanced tools
Cross-agent workflow skill for modern coding agents with gated planning, testing, verification, and handoff defaults
metacoding: Workflow Skill for Coding Agentsmetacoding packages a cross-agent workflow skill that enforces disciplined delivery for modern coding agents. Instead of generating editor-specific instruction files, it installs vendor-specific skills for Codex, Claude Code, or Antigravity from one shared workflow bundle.
Running metacoding init now asks which coding agent you use:
CodexClaude CodeAntigravityYou can also pass --vendor codex, --vendor claude-code, or --vendor antigravity.
For mixed-agent teams, you can use --vendor all to install all workspace-scoped variants.
The installed entrypoint depends on that choice:
Codex: .codex/skills/metacoding-workflow/SKILL.md
Claude Code: .claude/agents/metacoding-workflow.md
Antigravity: .agents/skills/metacoding-workflow/SKILL.md
The support bundle is installed alongside the entrypoint. The shared content includes:
references/
project-context.md
workflow-rules.md
platform-adaptation.md
typescript.md
javascript.md
node.md
react.md
python.md
assets/templates/
task-entry.md
test-plan.md
repeated-task-checklist.md
changelog-entry.md
project-context.md
For Codex, the project install looks like:
.codex/skills/metacoding-workflow/
├── SKILL.md
├── agents/openai.yaml
├── references/
│ ├── project-context.md
│ ├── workflow-rules.md
│ ├── platform-adaptation.md
│ ├── typescript.md
│ ├── javascript.md
│ ├── node.md
│ ├── react.md
│ └── python.md
└── assets/templates/
├── task-entry.md
├── test-plan.md
├── repeated-task-checklist.md
├── changelog-entry.md
└── project-context.md
The installed skill preserves the original metacoding workflow intent:
npm install -g metacoding
cd your-project
metacoding init
init remains interactive for project metadata such as project name, description, and tech stack. Use --vendor and --template to preselect those parts of the setup flow.
Common options:
metacoding init --vendor codexmetacoding init --vendor claude-codemetacoding init --vendor antigravitymetacoding init --vendor allmetacoding init --template reactmetacoding init --template typescriptmetacoding init --template nodemetacoding init --template javascriptmetacoding init --template pythonmetacoding init --forcemetacoding update
metacoding update --dry-run
metacoding update --dry-run --strict
metacoding update --force
update syncs the installed skill with the packaged version.update --vendor <vendor> syncs or validates only one installed vendor variant.update --vendor all syncs or validates all installed vendor variants explicitly.update --dry-run validates the installed skill without changing files.update --force overwrites local edits inside the installed skill directory.After installation, point your coding agent at the installed vendor entrypoint or ask it to use the metacoding-workflow skill/subagent for the next task.
The skill will:
This package no longer treats GitHub Copilot or Cursor instruction files as the primary product. The canonical content lives under skills/metacoding-workflow/, and the CLI now renders vendor-specific installs for Codex, Claude Code, or Antigravity from that shared bundle.
npm test
npm run build
MIT
For Antigravity, the CLI currently installs the documented workspace-scoped variant under .agents/skills/. It does not yet install the global variant under ~/.gemini/antigravity/skills/.
FAQs
Cross-agent workflow skill for modern coding agents with gated planning, testing, verification, and handoff defaults
The npm package metacoding receives a total of 128 weekly downloads. As such, metacoding popularity was classified as not popular.
We found that metacoding demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.