Agent helpers: skills and AI review
Lesson 23 of 26 in the course “Vibe coding”. Free, with animations and a quiz.
A skill: a new habit for your agent
A plugin, or skill, is a pack of instructions you install into your agent as an add-on. Such packs exist for Claude Code, Codex, Copilot CLI, Cursor and other agents. A skill changes how the agent works on every task, not just one. Like a game mod: same game, different rules. On the left of the figure is an agent with a socket holding the Ponytail skill. It is a free, open-source skill under the MIT license, which lets anyone use it freely.
Ponytail: the “lazy senior”
Ponytail’s idea is the “lazy senior”: an experienced programmer who writes nothing extra. Before coding, the agent climbs the ladder in the figure and stops at the first step that solves the task. Does this need to exist? Is it already in the project? Is it in the standard library, the ready-made functions of the language? Is it built into the browser? Is it in a package you already installed, someone else’s ready code? Will one line do? Only then the minimum new code.
Example: a birthday field
You ask the agent to add a birthday field to the profile in your workout tracker. Without the skill, the agent may install a whole calendar library and write a wrapper for it, its own in-between code. With the skill, it reaches the “built into the browser” step and uses the ready date field the browser can show by itself. And the skill does not throw away input checks, error handling, security or accessibility, meaning making it usable for everyone.
Modes, commands and an honest catch
Ponytail has three modes: lite (gentle), full (normal, the default) and ultra (the strictest). It has commands too: a review of the current diff that lists what can be deleted, and an audit of the whole repository for over-engineering. You install it as a plugin from its GitHub repository. The upside: less code means less to check, fewer bugs and fewer tokens, the bits of text you pay AI for. But it is a rule pack, not a guarantee. You still read the diff.
AI review on every PR
Another kind of helper: AI reviewers. These are services that read every PR you open and leave comments like a reviewer would: bugs, security, style. For example CodeRabbit, Greptile, GitHub Copilot code review, Qodo. But they make mistakes and miss things too. The comment on the right of the figure means “look here”, not a verdict. Tests and CI are still needed, and the merge decision is yours, just like the label by the person says.
How to choose without regrets
A review bot connects to GitHub as an app with access to your code. When installing it, pick only the repositories you need, not “all”. For any add-on the rules are the same as for the MCP plugs on the right of the figure. Choose popular, living ones, meaning they still get updates: open source or from a well-known company. Read what access they ask for. Install one at a time so you know what changed. Not helping? Turn it off.
Check yourself
- You ask an agent with the Ponytail skill to add a birthday field. What will it most likely do?
Correct answer: Use the date field built into the browser. The skill walks the agent up the ladder, and the “built into the browser” step solves the task. Input checks and security stay in place. - An AI reviewer left a PR comment: “possible bug on line 12”. What should you do?
Correct answer: Check the line yourself and decide if it needs a fix. A bot comment is a hint, not a verdict. Reviewers err and miss bugs, so tests and CI still matter and the merge decision is yours. - When connecting to GitHub, a review bot asks for repository access. What is best?
Correct answer: Give access only to the repositories you pick. The bot sees everything you give it access to, so open only what is needed. And add tools one at a time so you know what changed.