claude-kit

Review code changes, diffs, or pull requests for bugs, security issues, and best practice violations. Use after code changes or before merging PRs.

Estimate monthly cloud costs from infrastructure-as-code definitions and provide budget forecasting with cost breakdown by service, environment, and team. Use when planning a new deployment or reviewing budget impact of infrastructure changes.

Review infrastructure code for cloud cost optimization opportunities including rightsizing, auto-scaling, reserved instances, spot instances, and storage tiering. Use when reviewing IaC PRs or auditing existing infrastructure spend.

Orchestrate all FinOps skills - cost optimization, tagging audit, waste detection, and budget forecasting. Use for a full cloud cost assessment.

Audit cloud resources for cost allocation tag compliance. Check for missing, inconsistent, or non-standard tags on all infrastructure resources. Use before billing reviews or when onboarding a new service.

Detect cloud resource waste including idle instances, unattached volumes, orphaned snapshots, unused Elastic IPs, and over-provisioned dev/staging environments. Use when chasing cost regressions or as part of a quarterly cleanup.

Audit application code for performance issues including N+1 queries, bundle size, caching, lazy loading, and connection pooling. Use before load testing or when investigating latency complaints.

Update project README based on current project structure and code. Use when project structure changes.

Orchestrate all security skills - code audit, infra audit, auth review, secret rotation, and pentest. Use for a full security assessment before a release or after major changes.

Review Terraform code for module structure, state management, provider versioning, security, and operational best practices. Use before merging IaC PRs or auditing existing modules.

Validate completed work against acceptance criteria, architecture design, and customer requirements. Use as a quality gate before marking stories as passed.

Decompose client requests into real needs, challenge assumptions, protect scope and IP.

Definition of Done gate — verify a story is truly DONE by checking tests, acceptance criteria, business value proof, and user journey steps. Role-aware depth controlled by CK_USER_ROLE env var.

Analyze competitive landscape, differentiation, trends, and build-vs-buy to inform product decisions.

Track project milestones against timeline, flag delays, and forecast completion. Use for status reporting, schedule reviews, or deadline management.

Definition of Ready (DoR) gate — checks dependency completion, AC testability, and traceability before a story can start implementation. Use before picking up a story.

Guide structured discovery of business requirements through stakeholder interviews, workshops, and document analysis. Use when starting a new project, feature, or initiative that needs clear requirements.

Identify, classify, and score project risks with mitigation strategies. Use at project kickoff, before major milestones, or when new risks emerge.

Structure sprint planning with capacity calculation, velocity tracking, story selection, and team commitment. Use at the start of each sprint or iteration.

Structure critical dialogue between PO, Tech Lead, and Architect to challenge assumptions, priorities, and feasibility.

Build a traceability matrix from BMAD artifacts (problem.md, backlog.md, user-journey.md). Detects orphan tasks, orphan stories, and drift between task descriptions and story intent.

Data-driven backlog prioritization using WSJF, RICE, value/effort matrix, and dependency analysis.

Decompose a story into ultra-granular implementation tasks (2-5 minutes each) with exact file paths, complete code, and verification commands. Use for stories estimated at more than 50 lines of code. Includes a plan-reviewer subagent for validation.

Review completed story implementation against acceptance criteria using a fresh subagent. Dispatches an independent reviewer that reads code directly — does not trust the implementer's report. Use after a teammate reports completion to verify spec conformity before acceptance validation.

Enforce strict Test-Driven Development (RED-GREEN-REFACTOR) during implementation. Injected into teammate prompts to ensure no production code is written without a failing test first. Includes anti-rationalization table and red flags.

Design stakeholder communication plans for change initiatives, releases, and incidents. Use when coordinating announcements, managing expectations, or planning rollout communications.

Compare current state vs desired state, identify gaps, and prioritize remediation actions. Use when assessing readiness, planning migrations, or evaluating compliance.

Assess change impact across people, process, and technology dimensions. Use before major changes, migrations, or new feature rollouts to understand the blast radius.

Draft organizational policies following compliance frameworks and best practices. Use when creating security policies, development standards, governance documents, or operational procedures.

Map as-is and to-be business processes using structured flow notation. Use when analyzing workflows, identifying bottlenecks, or designing process improvements.

Facilitate structured retrospectives to capture what went well, what to improve, and concrete action items. Use at the end of sprints, milestones, or incidents.

Audit project dependencies for vulnerabilities, outdated versions, license compatibility, and supply-chain risk. Use before releases or periodically.

Generate conventional commit messages from staged git changes. Use after staging files before committing.

Generate unit and integration tests for project code. Use when new code is written or test coverage needs improvement.

Multi-domain review across performance, security, operations, reliability, and data axes for changes that span concerns.

Design observability blueprints — structured logging, metrics, distributed tracing, alerting, and dashboards for every service.

Guide developers to think about performance as they code — algorithmic complexity, memory, I/O, caching, lazy evaluation, and profiling discipline.

Identify, quantify, and communicate technical debt so it becomes negotiable with PO/TL — code smells, dependency health, architecture erosion, test and doc debt.

For each modified function, find or create its test, run it, and update it only if the function contract changed intentionally. Never silently adjust tests to make failures disappear.

Audit frontend code for WCAG 2.1 AA compliance including ARIA, keyboard navigation, contrast, and screen reader compatibility.