skills/skillful-node-prompt/SKILL.md
How WinDAGs constructs prompts for agent nodes. Encodes the hypertree structure, DSPy signature model, 4-section subagent pattern, discourse metadata, and memory-scored context selection. The meta-skill that teaches agents how to be skillful.
npx skillsauth add curiositech/windags-skills skillful-node-promptInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
A node prompt is not a string. It is a hypertree of independent branches that merge at execution time. Each branch is a module with its own concern, assembled into a coherent prompt that gives an agent everything it needs to execute one node in a DAG.
Activate when:
SkillNodeExecutor.buildPrompt()NOT for: writing the task decomposer prompt, designing the swarm bridge prompt, or creating skills themselves.
A node prompt has 4 top-level branches that are independently constructed and independently reasoned about. This is NOT a sequential 8-section document — it is 4 parallel concerns that merge at the root.
[Node Prompt]
/ | \ \
[Identity] [Context] [Task] [Protocol]
/ \ | | / | \
[Skill [References] [Upstream] [Description] [Tools] [Output] [Escalation]
Body] [Whiteboard] [MCPs] [Contract]
Signature: (skillId, skillIds[]) → expertise section
This branch answers: what expertise does this agent have?
Contents:
Construction rule: Resolve skills via resolveSkill() / resolveSkills(). If multiple skills, merge bodies with ## Skill: {id} headers. List reference files with sizes and descriptions. Never load reference bodies eagerly — list them for on-demand loading.
Signature: (upstreamOutputs, whiteboard, waveMetrics, priorDiscourse?) → context section
This branch answers: what has already happened in this execution?
Contents:
Construction rule: If accumulator is available, inject wave summaries, whiteboard, and metrics. For swarms, score prior messages using Park-style retrieval (recency: exponential decay 30s half-life, importance: synthesize > counter > propose > inform, relevance: keyword overlap with agent's skill). Include top-scoring messages within context budget.
Signature: (taskDescription, domainKeywords?, files?, mcps?, userPreferences?) → task section
This branch answers: what specific work does this node perform?
Contents:
Construction rule: Task description comes from the node's description field or metadata.taskDescription. All other fields are optional and only included when present. Keep this section clean — no skill content, no context, just the job.
Signature: (toolPermissions, outputContract?, isSwarm?) → protocol section
This branch answers: what rules govern this agent's behavior?
Contents:
allowed-tools frontmatter){status: 'escalate', reason, suggestion, partial_work})Construction rule: Always include the task-handling loop and escalation protocol. Include confidence block unless explicitly disabled. Include discourse instructions only for swarm agents. Tool constraints come from toClaudeCliFlags() for ProcessExecutor or built-in tool definitions for ProviderExecutor.
Each branch is a module in the DSPy sense — it has a signature (typed inputs → typed outputs), learnable parameters (which demonstrations work best), and a compilation target (metrics that evaluate quality).
// Branch 1
type IdentitySignature = (skillId: string, skillIds: string[]) => string;
// Branch 2
type ContextSignature = (
upstreamOutputs: Map<string, unknown>,
whiteboard: Record<string, unknown>,
metrics: WaveMetrics,
priorMessages?: ScoredMessage[],
) => string;
// Branch 3
type TaskSignature = (description: string, metadata: NodeMetadata) => string;
// Branch 4
type ProtocolSignature = (
toolPermissions: ToolPermission[],
isSwarm: boolean,
outputContract?: JSONSchema,
) => string;
// Assembly
type NodePromptSignature = (
identity: string,
context: string,
task: string,
protocol: string,
) => string;
In the current implementation, parameters are fixed (hand-written section templates). In a DSPy-compiled version:
The quality gates ARE the metrics:
A compiled node prompt optimizes these metrics by bootstrapping from successful execution traces.
The node configurator runs AFTER the decomposer and skill matcher, BEFORE execution. It produces the full execution config for each node:
interface NodeExecutionConfig {
// From decomposer
nodeId: string;
taskDescription: string;
dependencies: string[];
// From skill matcher
primarySkillId: string;
secondarySkillIds: string[];
// From node configurator (NEW)
tools: string[]; // which tools this node needs
mcps: string[]; // which MCP servers to connect
permissions: PermissionLevel; // read-only, standard, full
promptTechnique: 'direct' | 'chain-of-thought' | 'react';
referenceStrategy: 'list-only' | 'pre-summarize-top-3' | 'eager-load-all';
contextBudget: number; // max tokens for upstream context
model: string; // which model tier
timeoutMs: number; // execution timeout
outputContract?: JSONSchema; // expected output structure
}
The configurator reads the skill's frontmatter (allowed-tools, pairs-with, reference files) and the task description to determine these values. It's a separate planning step, not part of the decomposer.
Wrong: Building the prompt as one long string, section by section, top to bottom. Why: Creates a chain where error in section 3 corrupts section 7. Changes to one section require re-reading the whole prompt. Right: Build each branch independently, assemble at the end. If one branch fails, the others are unaffected.
Wrong: Reading all reference file contents and injecting them into the prompt.
Why: Blows the context window. A skill with 11 references × 2KB each = 22KB of content the agent may not need.
Right: List references with descriptions. Give the agent read_skill_reference tool to load on demand. The agent decides what's relevant.
Wrong: Including the last N messages from prior waves/agents regardless of relevance. Why: Fills context with noise. An irrelevant upstream output displaces a critical one. Right: Score context by recency × importance × relevance. Include top-scoring items within budget.
Wrong: Always using the same task-handling loop regardless of task complexity.
Why: A simple "write a file" task doesn't need a 6-step loop. A complex "analyze and recommend" task needs more structure.
Right: The node configurator chooses direct (simple tasks), chain-of-thought (reasoning tasks), or react (tool-heavy tasks) based on skill and task.
Wrong: Omitting escalation instructions to save tokens. Why: The agent attempts out-of-scope tasks and produces garbage instead of refusing. Right: Always include escalation. Predictable scope > unpredictable quality.
Wrong: The decomposer outputs skill IDs, tools, MCPs, permissions, model, timeout all in one step. Why: Too many concerns for one planning call. The decomposer is good at structure, not at per-node tool selection. Right: Stratify: decomposer → skill matcher → node configurator → prompt builder → execution. Each step reasons locally about its concern.
read_skill_reference tool available when references existDo NOT use this skill for:
swarm-executor-bridge logic./next-move prediction pipeline has its own prompt structure. Use windags-sensemaker / windags-decomposer.skill-architect.team.ts buildManagerPrompt.tools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.