skills

Retrieves up-to-date documentation, API references, and code examples for any developer technology. Use this skill whenever the user asks about a specific library, framework, SDK, CLI tool, or cloud service -- even for well-known ones like React, Next.js, Prisma, Express, Tailwind, Django, or Spring Boot. Your training data may not reflect recent API changes or version updates. Always use for: API syntax questions, configuration options, version migration issues, "how do I" questions mentioning a library name, debugging that involves library-specific behavior, setup instructions, and CLI tool usage. Use even when you think you know the answer -- do not rely on training data for API details, signatures, or configuration options as they are frequently outdated. Always verify against current docs. Prefer this over web search for library documentation and API details.

Implement one complete PRD epic (`EP-NNN`) through dependency-ordered story slices, one consolidated validation pass, risk-triggered review, and status roll-up. Use when asked to implement an epic, execute an EP-NNN from a PRD, or progress a PRD epic end to end without story-by-story session overhead.

Quota-aware four-phase workflow that analyzes development questions using only the necessary local code, official documentation, current web evidence, or direct synthesis. Use when the user says 'meta-code', '/meta-code', 'research and answer', 'deep research', 'full analysis', or 'comprehensive answer'. Do not use for simple code edits, reproduced bug fixes, or implementing an already-decided specification.

Reproduce-first debugging workflow that diagnoses and fixes errors with targeted local evidence, bounded hypotheses, conditional helpers, two fix attempts maximum, and focused verification. Use when the user provides an error, stack trace, failing command, compiler output, failing test, unexpected behavior, or asks to debug, diagnose, or fix a concrete failure. Do not use for feature implementation, general code review, speculative refactoring, or questions without an observed failure.

Orchestrate a fleet of CLI coding agents running side by side in Paneflow panes - discover them, read their live state, dispatch prompts, and wait on events - all over the public `paneflow` CLI. Use when the user asks you to coordinate, supervise, or hand work between multiple agents (Claude Code, Codex, OpenCode, Gemini, ...) that are open in Paneflow.

End-to-end review and correction workflow for an ALREADY-IMPLEMENTED user story (or full PRD whose stories have been coded). Reviews the CODE against its PRD — not the PRD document. Orchestrates 7 phases: intake, research (/meta-code pipeline), static analysis, parallel AI code review + security audit (3-layer: SAST/Secrets/SCA), risk-tiered remediation, and executive summary report. Signal-over-noise design: pre-filters generated files, scopes to diff+1 hop, targets 2-4 high-value findings per file. Do NOT use for greenfield scaffolding, code generation, or for reviewing an unimplemented PRD document (use /meta-review-prd for that). Does not commit or push. Invoke with /review-story [prd-path] [story-id?].

Fully autonomous research-informed PRD generator. Researches the domain, makes all design decisions based on research + codebase context, then produces a complete PRD with epics, stories, acceptance criteria, quality gates, and a JSON status tracking file. Invoke with /write-prd [feature description].

Interactive guide for creating new skills (or updating existing skills) that extend Claude's capabilities with specialized knowledge, workflows, or tool integrations. Walks the user through use case definition, frontmatter generation, instruction writing, and validation. Use when user asks to create a new skill, build a skill, update an existing skill, says "skill-creator", "create a skill for", "build a skill that", or wants help designing skill structure and content. Do NOT use for general prompting questions or non-skill configuration tasks.

Generate or discover a CLI + AgentSkill for any REST API. Use when: user says 'create a CLI for X', 'wrap this API', 'search if a CLI exists', 'install an existing CLI', 'make a skill for X', 'publish my CLI', 'publish to npm', 'push to github'. Handles registry search, install, discovery, scaffolding, resource implementation, building, linking, skill generation, npm publishing, and GitHub publishing. Do NOT use for non-REST-API CLI tools or general coding tasks.

Build MCP (Model Context Protocol) servers in TypeScript with @modelcontextprotocol/sdk. Use when writing, reviewing, or refactoring MCP server code: (1) Creating MCP servers with McpServer, (2) Registering tools with registerTool, inputSchema, outputSchema, Zod validation, (3) Defining resources and resource templates, (4) Defining prompts with arguments, (5) Transports: StdioServerTransport, NodeStreamableHTTPServerTransport, SSE, (6) Tool annotations (readOnlyHint, destructiveHint, idempotentHint), (7) Error handling and isError responses, (8) Dynamic tool loading and tool list change notifications, (9) Middleware patterns for MCP tools, (10) Testing MCP servers with vitest, (11) Publishing and configuring for Claude Code, Cursor, Windsurf, (12) Any @modelcontextprotocol/sdk imports.

React codebase health scanner that checks for security, performance, correctness, and architecture issues. Runs react-doctor CLI, interprets results, and provides actionable fix guidance. Use when the user says 'react-doctor', 'check my React code', 'React health check', 'scan React for issues', 'React audit', or after making React changes to catch issues early. Also triggers on: 'fix React performance', 'React best practices check', 'React code quality'. Do NOT trigger for non-React code, general JavaScript questions, or backend-only changes.

Deep analysis of Rust projects — scan with rust-doctor CLI, triage by priority, read source context for each finding, apply senior Rust reviewer expertise, produce before/after fixes, verify score improvement. Triggers on "scan", "health check", "rust-doctor", "code quality", "audit this Rust project".

Comprehensive security audit of code changes. Analyzes changed files for OWASP Top 10 vulnerabilities, injection flaws, authentication issues, secrets exposure, and insecure patterns. Produces a structured report with severity ratings, confidence scores, and actionable remediations. Use when the user says 'security review', 'security audit', 'check for vulnerabilities', 'OWASP check', 'is this safe', 'check my code', 'vulnerability check', '/security-review', or asks to review code for security issues. Do NOT trigger for general code quality reviews, refactoring, or non-security concerns.

Audit a Claude Code skill or workflow for structural quality, idempotency, and best-practice compliance. Runs 30+ binary checks grounded in Anthropic's official skill authoring docs, Agent Patterns research, and production patterns. Produces a severity-weighted report (FAIL/WARN/NOTE). Use when the user says 'audit this skill', 'check my skill', 'skill-doctor', 'review my workflow', or provides a path to a skill directory. Do NOT use for codebase audits (use meta-audit) or PRD reviews (use meta-review-prd).