code review Agent Skills

code-review is a mandatory review workflow for code changes before commits and deploys. It helps teams run a structured /code-review step, choose an engine, and get actionable feedback instead of a generic pass. Ideal for pre-merge checks, release candidates, and high-stakes refactors.

code-review is an AI-powered CodeRabbit skill for reviewing changed code, PRs, staged commits, and diff ranges. It helps catch bugs, security issues, and quality risks, then groups findings by severity so agents can act on them quickly. Use it for structured code review instead of generic critique.

code-review-excellence helps agents produce clearer, more constructive code reviews with better prioritization, reviewer tone, and actionable feedback for pull requests, mentoring, and team review standards.

flutter-dart-code-review is a library-agnostic Flutter and Dart code review checklist for architecture, widget quality, state management, performance, accessibility, security, and clean code. Use it as a structured flutter-dart-code-review guide for Code Review across BLoC, Riverpod, Provider, GetX, MobX, Signals, or custom patterns.

code-review-and-quality is a structured pre-merge review skill that checks correctness, readability, architecture, security, and performance. Install it from the parent repo, read skills/code-review-and-quality/SKILL.md, and use it with diffs, task context, and test results for stronger review decisions.

codex-review is a GitHub skill for OpenAI Codex CLI code review with GPT-5.2-Codex. It helps teams catch bugs, security issues, and code quality problems with structured findings, GitHub-native review flows, and CI/CD-friendly usage.

requesting-code-review is a lightweight workflow for dispatching the superpowers:code-reviewer subagent with a clean git diff, requirements, and change summary so reviews happen at the right time and produce actionable, severity-ranked feedback before merge.

Review skill for pre-landing PR review. Use it to check diffs against the base branch for SQL safety, trust-boundary issues, shell injection, enum completeness, and other structural risks. Best for a review guide that helps agents flag real defects fast with less guesswork than a generic prompt.

gemini-review is a Gemini-powered code review skill for large repositories and PRs. It uses Gemini 2.5 Pro and 1M-token context to review code with less chunking, better cross-file reasoning, and CI/CD-friendly feedback.

code-reviewer is an AI code review skill that follows a strict review order: security, performance, correctness, and maintainability. It uses rule files for SQL injection, XSS, N+1 queries, error handling, naming, and type hints, making PR reviews more consistent than a generic review prompt.

plan-eng-review is an interactive engineering plan review skill for locking down architecture, data flow, edge cases, test coverage, performance, and rollout risk before coding begins. Use the plan-eng-review skill when you have a design doc or implementation plan and want sharper feedback than a generic review prompt.

github-pr-review is a GitHub PR review skill for collecting inline comments, PR-level review bodies, and replies, then organizing feedback by severity so you can fix blockers first. Use it to resolve PR comments, respond to reviewers, and update the branch with targeted commits and thread replies. It fits the github-pr-review guide for authenticated GitHub CLI workflows.

The code-reviewer skill guides structured PR and diff reviews for correctness, security, performance, testing, and maintainability, using repository references and a checklist script to make Code Review more consistent and actionable.

receiving-code-review helps you verify PR feedback before editing code. Use it to restate review comments, check them against the codebase, ask for clarification on unclear items, and push back when suggestions do not fit.

code-reviewer is a lightweight skill for Code Review that turns code or diffs into a structured report covering security, performance, best practices, severity, affected lines or sections, recommended fixes, and an overall quality score.

critique is a report-only review skill that uses multiple specialized judges, debate, and consensus to assess completed work. It helps with critique for Code Review, correctness, quality, and missed issues before merging. Install critique in the NeoLabHQ context-engineering-kit and use it with file paths, commits, or context.

differential-review is a security-focused code review skill for PRs, commits, and diffs. It uses baseline history, blast radius, test coverage, and structured reporting to help catch regressions in auth, crypto, external calls, and other high-risk paths. Use it for differential-review for Code Review when you need evidence-backed findings.

autofix helps safely turn CodeRabbit PR review-thread feedback into validated code changes on the current GitHub branch. Use this autofix skill when you need a branch-aware CodeRabbit for Code Review workflow with explicit approval, not a generic prompt-following fixer. It checks repo state, reads trusted instructions, and applies only verified fixes.

codex is an OpenAI Codex CLI wrapper skill for code review, adversarial challenge, and consult workflows. Use codex review for pass/fail review gates, codex challenge to stress-test ideas, and ask codex for follow-up reasoning with session continuity. It is best when you have a diff or concrete question.

spec-to-code-compliance verifies that code matches written specifications exactly for blockchain audits and Compliance Review. Use the spec-to-code-compliance skill to compare whitepapers, design docs, and implementations, identify missing behavior, and flag undocumented or divergent logic.

python-anti-patterns is a Python code review checklist for spotting fragile patterns like scattered retries, timeout duplication, and hidden complexity before merge, during refactoring, or while debugging.

frontend-design-review is a GitHub skill for reviewing frontend UI work and creating distinctive, production-grade interfaces from scratch. It helps assess design system compliance, accessibility, visual quality, and whether a UI feels generic or intentionally designed. Use it for PR reviews, component reviews, and frontend-design-review for UI Design.

multi-reviewer-patterns helps agents run parallel code reviews across security, performance, architecture, testing, and accessibility, then deduplicate findings, calibrate severity, and deliver one consolidated report. Includes install context, key files, and practical usage guidance.

Use the security-review skill to review auth, user input, secrets, APIs, payments, uploads, and other sensitive flows. It provides a practical security-review guide with clear pass/fail checks, risky-pattern examples, and a focused process for catching common issues before release.

The coding-standards skill gives a baseline for naming, readability, immutability, consistency, and code review across projects, before applying framework-specific rules.

The gemini skill helps agents use Gemini CLI for code review, plan review, and large-context analysis. Learn when to install the skill, choose a model, avoid non-interactive approval hangs, and run safer Gemini workflows for multi-file reviews.

apple-appstore-reviewer helps audit iOS apps for App Store rejection risks, privacy gaps, permissions, subscriptions, and reviewer-blocking flows before submission.

ai-first-engineering is a concise operating model for teams where AI agents generate much of the implementation work. It helps set Agent Standards for planning, architecture, review, and testing, with guidance on install, usage, and when to apply the skill.

cpp-coding-standards is a C++ coding standards guide based on the C++ Core Guidelines. Use it for writing, reviewing, and refactoring modern C++ with a focus on safety, clarity, maintainability, RAII, type safety, and good design. Ideal for cpp-coding-standards for Code Review and practical team decisions.

icpg adds a WHY layer to code understanding with ReasonNodes, formal contracts, and drift detection. Use it for code review, refactoring, and pre-task analysis when you need intent, ownership, and risk context before changing code.

repo-scan is a cross-stack source audit skill that classifies files, detects embedded third-party libraries, and helps you judge what is core, duplicated, or dead weight. It is useful for repo-scan for Code Review, legacy migrations, and refactor planning. See repo-scan install and repo-scan usage guidance in the skill.

naming-analyzer reviews variables, functions, classes, files, database fields, and API names, flagging vague or misleading identifiers and suggesting clearer, convention-aware alternatives for code review and refactoring.

subagent-driven-development is a skill for executing implementation plans with a fresh subagent per task, then reviewing each result in two passes: spec compliance first, code quality second. It includes prompt templates for the implementer, spec reviewer, and code quality reviewer.

The java-coding-standards skill provides practical guidance for readable, maintainable Java 17+ in Spring Boot services, covering naming, immutability, Optional, streams, exceptions, generics, and package layout. Use it for coding, refactoring, and java-coding-standards for Code Review.

gh-address-comments helps address review and issue comments on the open GitHub PR for your current branch using gh CLI. It verifies GitHub auth first, fetches comments and review threads, numbers them, and helps you choose which items to fix. Useful for gh-address-comments guide and gh-address-comments for PR Review workflows.

python-expert is a GitHub skill for Python code generation, review, debugging, and refactoring. It guides agents with a clear priority order—correctness, type safety, performance, then style—and points users to SKILL.md, AGENTS.md, and rule files for practical adoption.

subagent-driven-development helps you break implementation plans into independent tasks, dispatch a fresh subagent for each one, and review results between steps. It is built for agent orchestration when you need faster delivery with quality gates, especially for 3+ independent issues, bug fixes, feature slices, or repo cleanup.

Use the finding-duplicate-functions skill to identify semantic duplicates: functions that do the same job with different names or implementations. It is built for LLM-generated and fast-growing JavaScript or TypeScript codebases, and it supports finding-duplicate-functions for Code Review, consolidation planning, and cleanup before refactors.

app-store-preflight-skills is a pre-submission App Store review check skill for iOS and macOS projects. It helps frontend development teams catch rejection risks by reviewing metadata, privacy requirements, entitlements, subscriptions, and common design issues before upload. Use it for release audits, rejection triage, and guideline-based checks.

golang-patterns is a practical guide for idiomatic Go patterns, code review, and refactoring. It helps Backend Development teams choose clear APIs, safe error handling, useful zero values, and maintainable package boundaries. Install golang-patterns when you need less guesswork and more consistent Go design decisions.

python-code-style helps with Python formatting, linting, naming, type hints, and docstrings. Use it to review pull requests, standardize team conventions, and set up ruff, mypy, or pyright guidance in pyproject.toml.

web-design-guidelines reviews UI code against Vercel Web Interface Guidelines, fetching the latest rules and returning terse file:line findings for focused UX and accessibility audits.

codex-collab is a Claude Code skill for handing work to Codex through the codex app-server JSON-RPC protocol. Use the codex-collab skill to run tasks end-to-end, review code, research in parallel, and support workflow automation with resumable threads and reusable output.

code-maturity-assessor provides an evidence-based maturity review using Trail of Bits’ 9-category framework. It assesses arithmetic safety, auditing, access control, complexity, decentralization, documentation, MEV risk, low-level code, and testing, with actionable recommendations for security audit readiness.

The investigate skill guides systematic debugging and root-cause analysis for broken, flaky, or unexpected behavior. Use it for code review, incident triage, bug fixes, and "it worked yesterday" cases when you need evidence before changing code. It follows a four-phase workflow: investigate, analyze, hypothesize, implement.

security-auditor is a lightweight OWASP-focused skill for code audits, vulnerability triage, secret checks, and structured security reporting with helper scripts and references.

tweet-draft-reviewer reviews tweet drafts in Claude Code with 8 voice rules, scores them 1-10, explains the result, and rewrites weak drafts below 7. Use it for fast tweet-draft-reviewer for Social Media checks, tighter feedback, and clearer tweet-draft-reviewer guide workflows.

shellcheck-configuration helps you install ShellCheck, tune .shellcheckrc, and apply lint policy for CI and Code Review across bash, sh, dash, and ksh projects.

smart-explore is a structural code exploration skill that uses smart_search, smart_outline, and smart_unfold to map a codebase before reading full files. It helps with code navigation, targeted debugging, and smart-explore for Code Review when MCP tool support is available.

Use the security-best-practices skill for focused security audits, secure-by-default coding help, and vulnerability-oriented reviews in supported Python, JavaScript/TypeScript, and Go stacks. It loads framework-specific references, helps identify risky patterns, and produces evidence-based findings with practical fixes.

cross-agent-delegation helps Claude Code route work across Kimi and Codex for agent orchestration. It supports automatic tool detection, Codex auto-review after tests, and bounded Kimi delegation based on complexity signals. Use this cross-agent-delegation skill when you want a practical guide to install, activate, and use hidden routing in multi-CLI workflows.

perl-security helps you review Perl code for safer input handling, taint mode, shell execution, DBI placeholders, and web security issues like XSS, SQLi, and CSRF. Use this perl-security skill for Security Audit work, remediation planning, and secure development when user-controlled data reaches sensitive sinks.

The python-patterns skill helps you write, review, and refactor Python code with idiomatic patterns, readable structure, type hints, and practical exception handling. Use it for new code, package/module design, or cleaner refactors that preserve behavior and follow Python conventions.

The commit-hygiene skill helps you keep Git work atomic, reviewable, and easy to revert. Use it for commit boundaries, PR size limits, and stacked PR decisions. It is a practical commit-hygiene guide for Git workflows when a change set is growing too large.

guidelines-advisor is a smart contract development advisor based on Trail of Bits best practices. It analyzes a codebase to generate documentation, review architecture, check upgradeability patterns, assess implementation quality, identify pitfalls, review dependencies, and evaluate testing. Use the guidelines-advisor guide for clear, evidence-based recommendations.

dotnet-patterns is a practical .NET pattern guide for backend development. It helps you write and review idiomatic C# with stronger defaults for immutability, explicit dependencies, async/await, and maintainable ASP.NET Core services. Use it for code generation, refactoring, and review when you want repeatable patterns, not generic advice.

pytorch-patterns helps you write, review, and debug PyTorch code with device-agnostic patterns, reproducible experiments, and explicit tensor handling. Use the pytorch-patterns skill for cleaner training loops, model refactors, and practical PyTorch guidance.

The insecure-defaults skill helps spot fail-open configuration patterns that let software run with unsafe settings instead of stopping. Use it for a Security Audit of production code, deployment configs, and secret-handling logic to catch weak auth, hardcoded secrets, and permissive defaults.

santa-method is a multi-agent verification workflow for outputs that need to be right before they ship. It uses independent review to catch blind spots in content, code-adjacent deliverables, compliance-sensitive copy, and workflow automation tasks. Install the santa-method skill when you need a repeatable generate, verify, converge loop.

substrate-vulnerability-scanner helps audit Substrate and FRAME pallets for critical issues like arithmetic overflow, panic DoS, bad origin checks, incorrect weights, and unsafe unsigned extrinsics. Use this substrate-vulnerability-scanner skill for Security Audit reviews of runtimes, pallet extrinsics, and weight logic.

github is a GitHub skill for PRs, stacked PRs, code review, branching, and repo maintenance with gh CLI. Use it when you need a clear github guide for repeatable GitHub for Git Workflows tasks, including merge and rebase steps.

swift-patterns is a SwiftUI skill for reviewing, refactoring, or building features with correct state ownership, modern navigation, clean view composition, lifecycle-scoped async work, and performance checks. Use this swift-patterns guide when you need practical, repository-backed help for frontend development instead of generic advice.

audit-context-building builds deep, line-by-line code context before vulnerability hunting. The audit-context-building skill helps security auditors, architecture reviewers, and agents reduce false assumptions, track invariants, and prepare reliable review context before findings, fixes, or threat modeling.

algorand-vulnerability-scanner is a security-audit skill for Algorand TEAL and PyTeal. It helps find 11 common issues, including rekeying attacks, fee validation gaps, field checks, and access control flaws. Use the algorand-vulnerability-scanner skill for a practical first-pass review before a manual audit.

The click-path-audit skill helps trace UI handlers through every state change to catch sequence bugs, shared-state collisions, and final-state mismatches after refactors or during code review.

design-review is a UX-minded design QA skill for auditing live interfaces, spotting spacing, hierarchy, visual consistency, and interaction issues, then fixing them iteratively with verification. It supports plan-mode review before implementation and is useful when you want a design-review guide for concrete source changes instead of vague advice.

The codeql skill helps you run CodeQL with fewer blind spots during a security audit. It focuses on database quality, suite selection, data extensions, and SARIF review so you can use codeql usage more reliably across supported languages. Use it for repeatable codeql guide steps when analyzing real repositories.

lesson-learned analyzes Git diffs and recent commits to extract software engineering lessons grounded in real code changes. It loads `se-principles.md` first, maps changes to principles like SRP, DRY, and KISS, and works well for retrospectives, PR learning notes, and Code Review follow-up.

Use web-design-guidelines to review UI code against the latest Web Interface Guidelines. Ideal for a focused web-design-guidelines for UX Audit workflow with terse file:line findings, accessibility checks, and interface compliance review before release.

team-composition-patterns is a decision skill for designing multi-agent teams in Claude Code Agent Teams, with sizing heuristics, subagent_type selection, and display mode guidance. Use this team-composition-patterns guide to apply preset review/debug teams, choose roles, and standardize team setup across tasks.

constant-time-analysis is a security-audit skill for finding timing side-channel risks in cryptographic code before they become exploitable bugs. Use it to review secret-dependent math, branches, comparisons, and compiled output when checking C, C++, Go, Rust, Swift, Java, Kotlin, PHP, JavaScript, TypeScript, Python, or Ruby.

agent-teams is a Claude Code workflow skill for multi-agent feature delivery with a strict TDD pipeline. It coordinates spec writing, review, failing tests, implementation, security checks, and PR orchestration for teams using claude-bootstrap. Install it when you need repeatable handoffs, quality gates, and less agent drift on feature branches.

solana-vulnerability-scanner is a focused Solana security audit skill for native Rust and Anchor programs. It helps review CPI logic, PDA validation, signer and ownership checks, and sysvar spoofing to catch six critical Solana-specific vulnerabilities before deployment.

moyu-strict is a strict anti-over-engineering skill for Code Editing. It helps agents keep changes narrow, confirm scope before edits, avoid new abstractions, and skip unrequested tests, docs, dependencies, or rewrites. Use it when you want the smallest safe diff and predictable review.

skill-comply is a compliance-testing skill that checks whether an agent follows a skill, rule, or agent definition in real runs. It generates specs from markdown, runs three prompt strictness levels, classifies tool-call timelines, and reports compliance rates with evidence. Useful for skill-comply for Compliance Review.

python-design-patterns is a Python refactoring and design-review skill focused on KISS, SRP, separation of concerns, composition over inheritance, and the Rule of Three for cleaner, more testable code.

verification-loop is a Claude Code verification workflow for checking builds, types, lint, tests, security, and diffs after code changes. This verification-loop skill is useful before PRs and after refactors when you want a structured post-change guide instead of a generic prompt.

baseline-ui helps review or generate Tailwind-based UI against an opinionated baseline for spacing, typography, accessibility, and motion. Use the baseline-ui skill when you need safer component output, clearer UI Design decisions, and less drift from existing primitives. It is best for React/Tailwind workflows and practical baseline-ui guide checks.

p7 is a senior-engineer execution skill for code generation under P8 supervision. It handles scoped subtasks with a plan-first workflow: solution design, impact analysis, code changes, and a 3-question self-review. Best for bounded implementation work, not broad architecture or ideation.

Use security-ownership-map to analyze git history for security ownership risk, bus factor, and sensitive-code ownership. It maps people to files, surfaces orphaned or under-owned areas, and exports CSV/JSON for graph analysis. Best for security audit questions, CODEOWNERS reality checks, and ownership clusters grounded in commit history.

defi-amm-security is a focused security checklist for Solidity AMMs, liquidity pools, LP vaults, and swap flows. It helps auditors and engineers review reentrancy, CEI ordering, donation or inflation attacks, oracle assumptions, slippage, admin controls, and integer math with less guesswork than a generic prompt.

The laravel-security skill is a practical Laravel security checklist for authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment. Use it for audits, feature reviews, and hardening work in Laravel apps.

fixing-accessibility helps audit and repair HTML accessibility issues before release. Use it for buttons, forms, dialogs, tabs, icon-only controls, keyboard flow, focus handling, form errors, contrast, and screen reader labeling. The fixing-accessibility skill is best for targeted UI code fixes, not broad compliance reports.

solidity-security is a focused Solidity audit and secure-coding skill for reviewing reentrancy, access control, unsafe external calls, and remediation patterns. Use it to prepare contracts for Security Audit, improve prompts, and get more structured review output than a generic audit request.

react-useeffect is a practical React guide for deciding when useEffect is needed, spotting anti-patterns, and choosing better alternatives like render logic, event handlers, useMemo, key resets, or cleaned-up fetch Effects.

Repository-grounded security-threat-model skill for AppSec threat modeling. It maps trust boundaries, assets, attacker goals, abuse paths, and mitigations into a concise Markdown threat model. Use it when you need security-threat-model for Threat Modeling on a specific repo or path, not a generic architecture review or code check.

fixing-motion-performance helps audit and fix UI animation performance issues without changing your stack by default. Use it for frontend work when motion stutters, scroll-linked effects are expensive, or transitions trigger layout, paint, or compositing work. It turns animation bugs into clear, code-level fixes.

ton-vulnerability-scanner is a focused audit skill for TON smart contracts written in FunC. It helps identify integer-as-boolean misuse, fake Jetton contract handling, and missing gas checks when forwarding TON. Use it for a fast first-pass Security Audit before deeper manual review.

api-design is a REST API design skill for planning and reviewing endpoints, resource naming, status codes, pagination, filtering, versioning, and error responses.

azure-verified-modules is a guide for creating or reviewing Azure Terraform modules against Azure Verified Modules (AVM) requirements. Use it to align module structure, variables, outputs, testing, and documentation for certification-ready code generation.

Use azure-ai-contentsafety-java to build Azure AI Content Safety integrations in Java for text and image moderation, blocklist management, and harm detection. This azure-ai-contentsafety-java skill fits Security Audit workflows and helps reduce guesswork around client setup, authentication, and review decisions.

python-testing helps you design, write, and review Python tests with a pytest-first workflow. Use it for TDD, fixtures, mocking, parametrization, coverage checks, and maintaining a reliable test suite for Skill Testing and real projects.

vue-jsx-best-practices helps frontend developers write idiomatic Vue JSX and TSX by replacing React-style attributes like className and htmlFor with Vue-friendly HTML attributes.

variant-analysis helps you find similar vulnerabilities and bugs across a codebase after one issue is confirmed. Use it to build CodeQL or Semgrep queries, follow a root-cause-first workflow, and run a focused variant-analysis guide for Security Audit work. It is best for post-discovery searches, not broad initial review.

audit-prep-assistant prepares codebases for Security Audit using Trail of Bits' checklist. It helps set review goals, run static analysis, increase test coverage, remove dead code, document risks, and generate supporting artifacts for a cleaner audit handoff.

healthcare-phi-compliance helps review healthcare apps for PHI/PII risk across data models, APIs, logs, and access paths. Use it to check data classification, access control, encryption, audit trails, and common leak vectors for HIPAA, DISHA, GDPR, and related security audit needs.

api-design-principles helps you design and review REST and GraphQL APIs with checklists, reference files, and a FastAPI template. Use it to improve resource naming, HTTP semantics, pagination, errors, versioning, and schema structure before implementation.

spec-driven-development is a workflow skill for writing specs before code, then moving through planning, tasks, and implementation with human review at each phase.

vue-options-api-best-practices helps frontend teams apply Vue 3 Options API best practices, fix this-binding and lifecycle mistakes, and improve TypeScript typing for props, computed values, events, and inject usage without switching to Composition API.

property-based-testing skill guide for writing, reviewing, and improving PBT across languages and smart contracts. Use this property-based-testing guide to spot roundtrip, idempotence, invariant, parser, validator, and normalization cases, choose generators, and decide when property-based-testing is stronger than example-based tests.

security skill for OWASP patterns, secrets management, and security testing. Use it to review auth, user input, API keys, env vars, and repo hygiene, especially for Security Audit work.

github-ops is a GitHub operations skill for triaging issues, managing PRs, checking CI failures, preparing releases, and monitoring repository health with the gh CLI. Use the github-ops skill when you need repeatable github-ops usage for a real repository, with auth via gh auth login and clear repo context.

swiftui-expert-skill is a practical SwiftUI skill for Frontend Development that helps write, review, and improve app UI code with better state management, view composition, accessibility, macOS-specific APIs, performance, and iOS 26+ Liquid Glass guidance. It also supports swiftui-expert-skill guide workflows for .trace analysis and recording when you need trace-based debugging, hangs, hitches, CPU hotspots, or SwiftUI update issues.

The security-and-hardening skill helps harden application code before release. Use it for user input, auth, sessions, sensitive data, file uploads, webhooks, and external services, with concrete checks like input validation, parameterized queries, output encoding, secure cookies, HTTPS, and secrets handling.

cairo-vulnerability-scanner scans Cairo/StarkNet smart contracts for six critical issues, including felt252 arithmetic errors, L1-L2 messaging flaws, address conversion bugs, and signature replay. Use this cairo-vulnerability-scanner skill for Security Audit reviews of StarkNet contracts.

executing-plans helps agents follow a written implementation plan: review it first, execute tasks in order, run specified checks, stop on blockers, and hand off to a finishing workflow. Best for Project Management and other plan-led delivery.

cso is a Chief Security Officer–style security audit skill for agents. It helps review codebases and workflows for secrets exposure, dependency and supply-chain risk, CI/CD security, and LLM/AI security using OWASP Top 10 and STRIDE. Use cso for structured Security Audit reviews with confidence gates, active verification, and trend tracking.

secure-workflow-guide guides a 5-step Solidity security workflow: Slither triage, feature-specific checks, visual inspection, security-property notes, and manual review. It is built for smart contract teams, auditors, and builders who want a repeatable secure-workflow-guide guide before deployment or release.

code-simplification helps refactor working code for clarity without changing behavior. Use it when code is correct but harder to read, maintain, or extend, especially for nested logic, long functions, repeated rules, and cleanup after shipped features.

constant-time-testing is a practical skill for auditing cryptographic code for timing side channels. Use the constant-time-testing skill to inspect secret-dependent branches, memory access patterns, and microarchitectural behavior, then apply a focused constant-time-testing guide for Security Audit workflows.

The security-scan skill audits your Claude Code .claude/ configuration for secrets, risky MCP setup, injection-prone instructions, dangerous bypass flags, and weak agent or hook definitions using AgentShield. Use it for repeatable security checks before committing or onboarding.

security-bounty-hunter helps you find bounty-worthy vulnerabilities in repositories, with a focus on remotely reachable, user-controlled issues that are likely to survive triage. Use it for Security Audit work when you want practical reportable findings instead of noisy local-only concerns.

next-best-practices is a practical Next.js skill for App Router work, covering file conventions, RSC boundaries, async APIs, data patterns, route handlers, bundling, and error handling.

code-tour creates reusable CodeTour .tour files with real file and line anchors. Use the code-tour skill for onboarding tours, architecture walkthroughs, PR tours, RCA paths, and code-tour for Technical Writing when you need a guided sequence instead of a flat summary.

cosmos-vulnerability-scanner finds consensus-critical bugs in Cosmos SDK modules, CosmWasm contracts, IBC integrations, and Cosmos EVM stacks. Use this cosmos-vulnerability-scanner guide for security audit workflows, chain-halt risks, fund-loss paths, and pre-launch reviews.

cpg-analysis is a deep code analysis skill for control flow, data flow, taint paths, and security auditing using Joern CPG and CodeQL. Use the cpg-analysis skill when a normal repo skim is not enough and you need evidence-backed tracing across functions, files, and sinks.

rails-conventions is a practical Rails 8.x skill for building and reviewing production backend code. Use it to match local conventions for models, controllers, routes, Hotwire, jobs, APIs, testing, security, and performance. It is especially useful for backend development where the rails-conventions guide should follow the app’s existing patterns instead of generic defaults.

ecc-tools-cost-audit is an evidence-first audit skill for ECC Tools cost spikes, runaway PR creation, quota bypass, premium-model leakage, and duplicate jobs. Use it for Backend Development investigations that trace a request from webhook to worker to billing decision and prove where spend is being created.

semgrep-rule-creator creates production-quality Semgrep rules for security vulnerabilities, bug patterns, taint-flow detections, and coding standards. Use the semgrep-rule-creator skill for Security Audit work when you need precise rules, test cases, and validation instead of a generic draft.

Semgrep skill for static analysis on codebases with automatic language detection, parallel workers, merged SARIF output, and plan-first approval. Built for semgrep for Security Audit workflows, it supports run all and important only modes, uses --metrics=off, and can leverage Semgrep Pro when available.

The audit skill runs structured technical UI reviews across accessibility, performance, theming, responsive behavior, and anti-patterns. It returns scored findings, P0-P3 severity rankings, and an action plan for a specific page, feature, or component. Best used after design context is gathered.

vue-pinia-best-practices helps Vue 3 teams use Pinia safely with clear guidance on install timing, storeToRefs usage, setup-store returns, and URL vs store state decisions.

The audit skill runs structured technical UX reviews for pages, features, or components. It checks accessibility, performance, theming, responsive behavior, and front-end anti-patterns, then returns scored findings with P0-P3 severity and an action plan. Best used after the required /frontend-design context step.

vue-best-practices is a Vue 3 skill for code generation, review, and refactoring. It guides agents toward Composition API, <script setup lang="ts">, explicit data flow, SSR-aware choices, and core references for reactivity, SFCs, composables, Router, Pinia, and Vite-based apps.

prd-implementation-precheck adds a mandatory precheck before coding from a PRD or spec. It reviews scope, alignment, dependencies, risks, and test expectations, asks clarifying questions, then implements only after confirmation.

laravel-tdd is a Laravel test-driven-development guide for PHPUnit and Pest. It helps with unit, feature, and integration test choices, database strategy, fakes, coverage targets, and a practical workflow for test automation.

browser-qa is a browser QA skill for post-deploy visual testing, interaction checks, responsive screenshots, and accessibility review using browser automation. It helps frontend developers and QA teams verify staging or preview pages with a repeatable browser-qa guide instead of a generic prompt.

The accessibility-compliance skill helps teams audit and improve web or mobile UI with practical WCAG 2.2, ARIA, keyboard access, screen reader, and mobile accessibility guidance. Best for UX audits, component fixes, and implementation-ready recommendations.

ios-design-guidelines helps review, shape, and rewrite SwiftUI/UIKit interfaces against Apple Human Interface Guidelines for iPhone. It is useful for layout, navigation, accessibility, Dynamic Type, Dark Mode, and system component choices when you need practical ios-design-guidelines guide feedback for UI Design.

defi-protocol-templates is a GitHub skill that helps scaffold DeFi contract patterns for staking, AMMs, governance, lending, and flash loans. Best used as a starting point for Solidity design and prompting, not as an audited production framework.

improve-codebase-architecture helps you find architectural friction, shallow modules, and deepening opportunities in a codebase. Use it for refactoring reviews, testability improvements, and AI-navigable design decisions, especially when you want the skill to respect CONTEXT.md and docs/adr/ guidance.

git-workflow-and-versioning helps developers and agents manage code changes with safer commits, short-lived branches, and reversible history. Use it for git-workflow-and-versioning usage when you need a practical guide for trunk-based workflows, reviewable changes, and conflict-prone work.

gepetto is a structured planning skill that turns a markdown spec into researched, sectionized implementation plans through interviews, synthesis, external review, and file-based outputs. Best for Requirements Planning on complex features rather than quick code tasks.

macos-design-guidelines is a practical guide for reviewing and implementing Mac apps against Apple Human Interface Guidelines. It covers menu bars, keyboard shortcuts, window behavior, toolbars, accessibility, and system integration for SwiftUI, AppKit, and Mac Catalyst teams.

springboot-security is a practical Spring Boot security guide for authentication, authorization, validation, CSRF/CORS, secrets, headers, rate limiting, and dependency checks. Use the springboot-security skill for Security Audit work or to harden a Java service with fewer security misconfiguration risks.

speed launches a browser-based RSVP speed reader that shows text one word at a time with Spritz-style ORP highlighting. Use it to review assistant output, articles, or notes quickly, with a predictable workflow that strips markdown and opens a local reader file.

dwarf-expert helps you inspect DWARF v3-v5 debug info, read DIE trees and attributes, verify data integrity, and review code that parses or emits DWARF. Use the dwarf-expert skill when you need accurate, evidence-based answers for compiled binaries, debug sections, or backend development tooling.

perl-testing is a practical guide for writing, running, and improving Perl tests with Test2::V0, Test::More, prove, mocking, coverage, and TDD. Use the perl-testing skill for install guidance, usage patterns, migration help, and faster debugging of failing suites.

Judge is a two-phase evaluation skill that launches a meta-judge first, then a judge sub-agent to score work with isolated context, evidence, and clear criteria. Use it for report-only reviews of code, writing, analysis, or Skill Authoring when you need a defensible judge guide instead of a casual opinion.

terraform-style-guide helps generate and review Terraform HCL using HashiCorp style conventions, file layout, and security-minded defaults. Use it for Terraform-native code generation, module structure, variables, outputs, and safer configuration in real repositories.

api-designer helps you design and review REST and GraphQL APIs using practical references plus generate_api.py and validate_api.py for draft specs and basic validation.

vercel-react-best-practices is a Vercel Engineering skill that guides AI agents to optimize React and Next.js performance with prioritized rules for waterfalls, bundle size, and rendering.

django-security is a practical guide for hardening Django apps with authentication, authorization, CSRF, XSS, SQL injection prevention, secure cookies, and production settings. It helps developers and reviewers run a focused Security Audit, quickly spot risky config, and apply concrete fixes before deployment.

using-agent-skills is the meta-skill for routing work to the right Agent Skills workflow. Use it at session start or when task phase changes to choose the right downstream skill for Skill Discovery, planning, implementation, testing, debugging, review, or release.

moyu-ko is a code-editing skill that keeps changes minimal, scoped, and review-friendly. It helps avoid overengineering by editing only requested files, using the simplest fix, and asking when scope is unclear. Use the moyu-ko skill when you want precise diffs, focused bug fixes, and a practical moyu-ko guide for disciplined code edits.

project-flow-ops helps manage GitHub and Linear execution flow by triaging issues, PRs, reviews, and CI signals, then deciding what should merge, close, rebuild, or move into Linear. Use the project-flow-ops skill for Issue Tracking, backlog triage, PR cleanup, and GitHub-to-Linear coordination.

code-graph is an AST-based code graph skill for fast symbol lookup, dependency analysis, and blast-radius checks via codebase-memory-mcp. Use it for code editing when you want the graph first and file reads second.

upgrade-stripe guide for upgrading Stripe API versions, server-side SDKs, Stripe.js, and mobile SDKs in real codebases, with practical steps for Backend Development.

terraform-skill is a diagnose-first skill for Terraform and OpenTofu work. Use it to review, debug, or plan changes across modules, tests, CI, scans, and state operations with version-aware guidance. It helps reduce identity churn, secrets exposure, blast radius, CI drift, and state corruption.

springboot-verification is a verification loop for Spring Boot projects that helps you confirm a change is safe before a PR or deploy. Use this springboot-verification guide for build validation, static analysis, tests with coverage, security scans, and Skill Validation.

bgpt-paper-search is a research-focused skill for finding scientific papers and extracting structured full-text evidence, not just abstracts. Use it for literature reviews, evidence synthesis, and study comparison when you need methods, sample sizes, quantitative results, quality scores, and conclusions.

The code-deduplication skill helps Claude prevent semantic duplication by checking CODE_INDEX.md, reusing existing code, and updating the index after changes. Use it for code-deduplication for Refactoring, shared utilities, and cleaner maintenance workflows.

The cloud-solution-architect skill helps an agent act like an Azure Cloud Solution Architect for Cloud Architecture decisions. Use it to review designs, choose architecture styles, compare Azure services, and apply design principles, patterns, and best practices with less guesswork than a generic prompt.

entry-point-analyzer helps map state-changing entry points in smart contract codebases for security audit work. It identifies externally callable functions that modify state, groups them by access level, and excludes view, pure, and other read-only paths. Use this entry-point-analyzer guide when you need a focused call-surface inventory for Solidity, Vyper, Solana, Move, TON, or CosmWasm projects.

wp-phpstan helps configure, run, and fix PHPStan in WordPress plugins, themes, and sites. Use it for phpstan.neon setup, baseline workflow, WordPress-aware typing, and handling optional plugin classes with fewer false positives.

azure-ai-contentsafety-ts helps analyze text and images for harmful content with Azure AI Content Safety in TypeScript. Use this skill for moderation workflows, blocklists, and security audit checks for hate, violence, sexual content, and self-harm. It also covers Azure endpoint and auth setup.

create-colleague turns coworker docs, chats, emails, screenshots, Feishu, and DingTalk data into an editable AI skill with separate work and persona outputs, plus update flows for ongoing refinement.

wcag-audit-patterns is a structured WCAG 2.2 audit skill for accessibility reviews. Use it to combine automated findings with manual checks, prioritize issues by severity and conformance level, and generate actionable remediation guidance for pages, flows, and components.

The ui-testing skill provides a checklist-driven UI verification workflow to catch invisible buttons, weak contrast, missing focus states, and touch-target issues before release. It is best for UI Design reviews, component checks, and quick accessibility sanity passes with less guesswork than a generic testing prompt.

springboot-tdd is a Spring Boot test-first workflow skill using JUnit 5, Mockito, MockMvc, Testcontainers, and JaCoCo. Use it to add features, fix bugs, or refactor with clear test intent and high coverage. Best for springboot-tdd for Test Automation and backend changes.

perl-patterns is a modern Perl 5.36+ skill for writing, reviewing, and refactoring idiomatic code. Use this perl-patterns guide to guide code generation, simplify legacy boilerplate, and keep modules, signatures, and error handling maintainable.

rust-patterns is a practical guide for idiomatic Rust development, covering ownership, error handling, traits, concurrency, module boundaries, and backend-focused design choices for safer, cleaner code.

ruzzy is a coverage-guided Ruby fuzzing skill for testing pure Ruby code and Ruby C extensions. Use the ruzzy guide to set up a supported Linux environment, verify sanitizer wiring, and build practical fuzzing workflows for Security Audit work.

tdd is a Test-Driven Development skill for building features, fixing bugs, and writing durable tests with the red-green-refactor loop. It favors behavior-focused tests through public interfaces, boundary-only mocking, and practical guidance for test automation, refactoring, and interface design.

swiftui-wcag-accessibility-auditor audits SwiftUI iOS feature code for WCAG 2.2 Level A/AA and WCAG2Mobile, then returns patch-ready fixes with evidence, priorities, and user-verification checks for code-indeterminate behavior. Use it for auth, forms, settings, custom controls, and pre-merge UX audit work.

swift-concurrency-6-2 helps you adopt Swift 6.2 Approachable Concurrency, fix data-race errors, and decide when to keep work on MainActor or offload with @concurrent. Use this swift-concurrency-6-2 guide for app and backend development migrations.

commit-work helps turn messy Git changes into clean, reviewable commits. It guides diff inspection, patch staging, commit splitting, staged diff review, and clear Conventional Commit messages for safer Git workflows.

Use the harden skill to make frontend UI more resilient with better error states, empty states, i18n support, RTL handling, overflow fixes, and real-world edge case coverage for production-ready interfaces.

sarif-parsing is a post-scan skill for reading, filtering, deduplicating, summarizing, and converting SARIF 2.1.0 results from tools like CodeQL and Semgrep. Use it when you already have scan output and need clear parsing, aggregation, or CI/CD-ready transformation. It is not for running scans.

vault-cleanup-auditor audits your Obsidian vault in Claude Code, finding stale drafts, incomplete notes, duplicate filenames, and empty folders. It saves a dated cleanup report for repeatable Workflow Automation and monthly maintenance.

screen-reader-testing is a practical skill for UX audits and accessibility QA. Learn how to use it to test web apps with VoiceOver, NVDA, and JAWS, prioritize browser and platform coverage, and review forms, ARIA behavior, focus management, and dynamic announcements.

root-cause-tracing helps you debug failures by tracing backward from the symptom to the original trigger. It is ideal for deep stack errors, misleading outputs, and cases where invalid data, paths, or working directories were introduced earlier. Use it as a root-cause-tracing guide for disciplined debugging and safer fixes.

request-refactor-plan helps turn a vague refactor request into a detailed plan with tiny commits, repo verification, scope boundaries, test coverage review, and a GitHub issue. Use it for refactoring RFCs, incremental change plans, and safer implementation prep.

makepad-2.0-troubleshooting is a focused Makepad 2.0 troubleshooting skill for symptom-to-fix debugging. It helps with invisible UI, click failures, compile errors, hot reload issues, and migration regressions. Use this makepad-2.0-troubleshooting guide when you need fast, code-level diagnosis for Backend Development or UI-heavy apps.

diagnose is a structured debugging workflow for hard bugs, flaky tests, and performance regressions. It helps you reproduce the issue, minimise the failing case, form one hypothesis at a time, add instrumentation, fix the root cause, and lock it in with a regression test. Use the diagnose guide when “debug this” is not enough.

stride-analysis-patterns helps agents run a structured STRIDE threat-modeling pass for architectures, APIs, and data flows. Install from the wshobson/agents repo, read the SKILL.md file, and use it to turn system descriptions into categorized threats and control-focused review output.

The sharp-edges skill helps you find APIs, configs, and interfaces where the easy path leads to insecure use. Use it to review authentication flows, cryptographic wrappers, dangerous defaults, null or zero semantics, and misuse-prone design choices. It is a strong fit for sharp-edges for Security Audit work when you need concrete footguns, not generic security guesses.

The debugging-and-error-recovery skill guides systematic root-cause debugging for failing tests, broken builds, runtime errors, and regressions. It emphasizes preserving evidence, reproducing issues, diagnosing in order, fixing minimally, and verifying before moving on.

architecting-solutions is a Claude Code skill for technical design, migration planning, and Requirements Planning. It clarifies requirements, analyzes codebase constraints, compares trade-offs, and writes a PRD-style design to your project's docs/ folder.

polish is a final-pass UI review skill for catching alignment, spacing, consistency, token usage, and micro-detail issues before shipping. It is best for screens, flows, or components that already work but feel close, not quite polished. Use it to improve launch readiness, design-system alignment, and overall quality without unnecessary redesign.