ratatoskr

Ratatoskr

A translator between you and your codebase. You can prompt an AI coding agent without knowing what a function is. You ask for something in plain words, the agent turns it into code, and you can't read the diff to check it built what you meant. Ratatoskr sits in the middle. It reads your request back in your own words, so you see what the agent understood before it builds. And it explains what the system does back to you the same way. You check the meaning, not the code.

/plugin marketplace add krzysztofdudek/RatatoskrSkill
/plugin install ratatoskr@ratatoskr-marketplace

Run both, then /reload-plugins to activate it in this session. No config, no API key. The skill engages on its own when a request arrives in product terms, or when an operation could be destructive or reach users other than you.

MIT licensed · single markdown file · works with any agent that reads skills · part of the Yggdrasil family · full skill body

See it

You: "add 'remember me' to the login page"

That phrase has two reasonable readings, so the agent — after silently researching the codebase — does not guess. It asks one question first, then proposes.

One thing first: "remember me" can mean two different things. Which do you want?

1. Keep people signed in between browser sessions, so they don't re-enter their password every time (a checkbox on the login form).
2. Just pre-fill the email field next time, but still ask for the password.

I'd default to (1) — flag if not.

You: "yeah, option 1"

Now it returns the proposal, and only this shape:

What I think you're asking for: A way for people to stay signed in between browser sessions so they don't have to enter their password every time.

What I would change: Add a "Keep me signed in" checkbox under the login form. If checked, the sign-in lasts 30 days. If unchecked, the person is signed out when they close the browser.

What I would NOT change: How passwords are stored, the "forgot password" flow, or two-factor sign-in.

Who's affected: Anyone who signs in.

Reversibility: Easy to undo.

Compliance / data notes: Stores a longer-lived sign-in cookie on the device. People on shared computers should leave the box unchecked — I'd add a short hint near the checkbox.

How to check it afterward: Sign in with the box checked, close the browser, reopen, visit the site — you should still be signed in. Repeat with the box unchecked — you should be signed out.

Before I do anything: confirm above?

Note the last line. It stops and waits. Nothing runs yet. You see the scope, the blast radius, and the 30-day default it picked before a line of code is written. Veto, adjust a bullet, or say go.

Notice what's not there: no "this'll take a couple hours," no jargon, no "rolled out a JWT refresh flow." Just what changes, who it touches, and how you check it. Those bold labels are the literal section headers from the skill's proposal template — see SKILL.md (Phase B).

The features are the bans

Most of what makes Ratatoskr useful is what it refuses to do: