AI-COMPANY-CTO-AgentFactory

When to Use

• Create new AI Agents (any layer: tool/execution/management/decision)
• Generate standardized Agent position briefs (five elements)
• Design Agent architectures following Harness Engineering principles
• Batch-generate four-layer architecture Agent teams

Core Rules

1. Must specify agent layer — choose from tool/execution/management/decision
2. Must include five elements — role, objective, behavior rules, tool permissions, error handling
3. File names in kebab-case — e.g., content-writer-agent
4. Configuration in YAML — structured, readable, verifiable
5. Quality gates required after generation — 4 gates (schema/lint/security/integration)

Quick Reference

Usage

# Generate an agent
python scripts/generate_agent.py --config ./agent-config.yaml --output ./agents/

# Validate quality gates
python scripts/validate_agent.py --agent-dir ./agents/my-agent/

# Dry-run (validate only, no file generation)
python scripts/generate_agent.py --config ./agent-config.yaml --dry-run

# Output JSON report
python scripts/validate_agent.py --agent-dir ./agents/my-agent/ --json --output report.json

Example: agent-config.yaml

agent:
  layer: execution
  name: content-writer-agent
  role: Content creation executor
  description: Generates copy/articles/social posts.

objective_kpi:
  metric: quality_score
  target: ">=4.5/5"
  measurement: Human sampling evaluation

behavior_rules:
  must_do:
    - Cite authoritative sources
    - Check factual accuracy
  must_not_do:
    - Generate misinformation
    - Disclose user privacy

tool_permissions:
  - skill: online-search
    access: read
  - skill: docx
    access: write

error_handling:
  retry_policy: 3x
  fallback_skill: general-knowledge

Four-Layer Architecture

Quality Gates

CQO G2 Quality Gate — Lint Check Specification

The G2 Lint Check gate enforces:

• Markdown structure: All required sections present (Overview, Capabilities, Usage, API)
• File naming: kebab-case enforced for all generated files
• YAML validity: Valid YAML syntax with proper indentation
• Link integrity: No broken internal references
• Line count: SKILL.md must be under 500 lines

Blocking: Any lint error blocks agent deployment.

Security Scanner — Forbidden Patterns

The scanner flags these patterns (blocking on detection):

Note: The scanner legitimately uses eval() and exec() only inside tests (tests/test_factory.py) to verify it correctly detects these patterns. The actual production scripts use only safe APIs (yaml.safe_load, jinja2.sandbox.SandboxedEnvironment).

CISO STRIDE Mitigations

This skill implements security controls against STRIDE threats:

All generated agents inherit these security boundaries.

Harness Engineering — L1-L4 Layers

The AgentFactory generates agents for any layer using standardized templates and validates layer-specific requirements through G5 gate.

Module Guide

Module 1: Agent Configuration & Schema

Define agent specifications in YAML. Required fields:

• agent.layer, agent.name (kebab-case), agent.role
• objective_kpi (metric/target/measurement)
• behavior_rules (must_do / must_not_do lists)
• tool_permissions (skill + access level)
• error_handling (retry_policy / fallback_skill)

Module 2: Template Rendering

Uses Jinja2 SandboxedEnvironment for safe template rendering. Four layer templates are loaded from templates/:

• tool-layer.md — stateless, idempotent atomic units
• execution-layer.md — single-responsibility worker agents
• management-layer.md — orchestration with state machine
• decision-layer.md — strategic C-Suite agents

Module 3: Quality Gates

Five sequential gates (all blocking by default):

1. SchemaValidator — frontmatter + config.yaml structural integrity
2. LintChecker — line count, required sections, broken links
3. SecurityScanner — regex scan for forbidden patterns
4. IntegrationTester — test file existence + real test methods (no bare pass)
5. LayerSpecificValidator — layer-keyword presence check

Module 4: Test Generation

Per-layer test templates with actual assertions:

• Tool: schema compliance, stateless/idempotent verification
• Execution: role definition, tool permissions declared
• Management: state machine defined, error recovery paths
• Decision: authority/compliance section, audit logging present

File Structure

ai-company-cto-agentfactory/
├── SKILL.md                    # This file
├── scripts/
│   ├── generate_agent.py       # Main generation script
│   └── validate_agent.py      # Quality gate validator
├── templates/
│   ├── tool-layer.md          # Tool layer template
│   ├── execution-layer.md    # Execution layer template
│   ├── management-layer.md   # Management layer template
│   └── decision-layer.md     # Decision layer template
├── references/
│   ├── harness-engineering.md
│   ├── quality-gates.md
│   └── security-compliance.md
├── tests/
│   └── test_factory.py       # Unit + integration tests
├── requirements.txt          # Python dependencies
├── CHANGELOG.md
├── DESIGN-SPEC.md
└── TECHNICAL-REVIEW-REPORT.md

Version History