Menu
SkillsMP has collected 31 skills from bpmforge/attest-claude. Open a skill to review its source and details.
Showing 31 of 31 collected skills.
Gauntlet loop — multi-agent quality harness: a lead sets a real reference bar (a named product, test suite, or baseline to match or beat), splits the goal into gradeable units, builders produce artifacts in clean context, and blind fresh-per-round critics…
Claude-Design-style visual iteration loop — render the running UI, screenshot at 375/768/1440, critique against docs/design/tokens.json and design principles, apply fixes, re-capture until clean (cap 3 iterations). Also extracts a token baseline from an…
Project intelligence steward — audits CLAUDE.md / AGENTS.md alignment with actual codebase, captures session learnings, updates project docs. Use after major sessions or when docs feel stale.
Accessibility & compliance audit — WCAG 2.2 AA/AAA, EN 301 549 / EAA, Section 508. Automated (axe/pa11y/Lighthouse) + manual checklist, findings with criterion + file:line + fix. Use after UX design (audit the spec) and after implementation (audit the DOM).…
Telemetry/instrumentation design — RED/USE/golden-signals selection, metrics catalog, event taxonomy, SLO-derived alerts, dashboard design. Use at Phase 3 or when nobody can answer "is it working?" in production. NOT for deploying the stack (/devops) or spend…
Runtime-aware container ops (Docker/Podman/Rancher-nerdctl/Finch) — builds, Dockerfiles, compose, networking, rootless debugging, image optimization, multi-arch, and cloud-portable images for GCP/AWS. Use for container build/run failures, image tuning, or…
Cloud + LLM spend audit, right-sizing, unit economics. Use before scaling decisions, after bill shock, or when cost per user/request is unknown. RULE: every recommendation quantified in $/month — never "cheaper". NOT for performance — use /perf.
Data governance — PII classification, GDPR/CCPA/PIPEDA obligations, retention schedules, erasure paths, processor inventory. Use at Phase 3 to classify the schema before it ships, or on any feature touching personal data. NOT for vulnerability scanning…
SDLC phase gate — runs the automated validators for the current phase and reports gaps. Use after completing all deliverables for a phase. Wraps scripts/validators/validate-phase-gate.sh.
Ralph Wiggum deep-onboard: Step D4 — re-run focused HANDOFFs for rows flagged by /onboard-verify. Does NOT re-run the full DISCOVER phase.
Ralph Wiggum deep-onboard: Step D1 — enumerate every unit in the codebase (ROUTE / TABLE / SERVICE / FLOW / ENTRY) into docs/onboard/INVENTORY.md. Triggered by /sdlc onboard --deep or invoked directly for inventory refresh.
Ralph Wiggum deep-onboard: Step D3 — run all onboard validators and report uncovered inventory rows. Thin wrapper over scripts/validators/validate-phase-gate.sh onboard-deep.
Load testing & resilience — what breaks under stress and what happens then. Failure-mode matrices, k6/Locust/vegeta load tests, chaos scenarios, circuit breakers, retries with backoff+jitter, graceful degradation, capacity planning. Use at Phase 3 (resilience…
Multi-pass cross-expert review with per-pass confidence scoring — coordinates code-reviewer + security-auditor + performance-engineer in parallel, only delivers a verdict when all 3 score ≥ 7.
OWASP audit, threat modeling, CVE/dependency scanning. Supports --quick (default, ~10 min) and --deep (Ralph Wiggum: exhaustive OWASP x SAST rules x iterative attack chain, ~45-90 min). SAST runs on Opengrep + in-house bpm-rulepacks (never license-restricted…
Ground the agent in a library's real API before writing code against it — generate a version-pinned reference from the installed package, not from training data. Use before adopting a library, after a major upgrade, or when generated code keeps calling…
Query, ingest into, and lint the agent-brain-vault (compiled project wiki at ~/Code/agent-brain-vault) — teaches any agent the three vault ops so a project question gets answered from compiled, cited pages instead of re-reading raw sources. Also the…
Codebase archaeology — trace a feature end-to-end before modifying it. Maps entry points, call chains, data flow, and every file that needs to change. Use before /sdlc feature or any time you need to understand how something works.
Deterministic post-process tooling for generated pixel-art sprite batches: lattice/pixel-snapper cleanup, transparency de-fringing, sprite-sheet packing with a portable atlas manifest. Pairs with agents/game/game-asset-pipeline.md, which owns generation +…
Code-health audit — complexity, duplication, error handling, type invariants, patterns, naming, comment accuracy, dead/unutilized code. Four modes: --review (full pass), --debt (tech-debt catalog), --consolidate (DRY + error-handling consolidation),…
Live browser verification using playwright-mcp — navigate a running app, screenshot key flows, check accessibility snapshots, verify against use cases. Works with any LLM (no vision required). Use after implementation or for regression checks.
SDLC orchestrator — new projects (/sdlc init), codebase onboarding (/sdlc onboard), feature addition (/sdlc feature), audit & improvement (/sdlc improve). Runs Discovery Interview before producing any documents. Route here whenever the user asks to review,…
Doc-driven implementation engineer. Reads SDLC design docs first, verifies all library APIs via Context7, then writes clean production code. Enforces anti-slop rules — no over-engineering, no defensive bloat, no hallucinated APIs. Use after design docs exist.
Senior git & forge expert — repo bootstrap, feature branches, releases, recovery, forensics, multi-remote sync. Six modes: --init (bootstrap repo + remotes + hooks), --feature (branch + atomic commits + draft PR), --release (semver + changelog + signed tag),…
Design direction, UX workflows, component architecture, WCAG 2.2 accessibility, live-environment design review. Use when designing new interfaces, reviewing PR UI changes, or auditing accessibility.
API design expert — REST/GraphQL endpoints, contracts, versioning, OpenAPI docs. Use when adding/changing routes or request/response shapes. NOT for implementation — design only.
Schema design, migrations, query optimization, indexes, ORM models. Proactive: before adding tables, writing complex joins, or planning migrations. NOT for app-layer business logic.
CI/CD pipelines, runbooks, monitoring, incident response, deployment strategies. Proactive: before production deploys. NOT for building or debugging container images — use /containers for that.
Profile and optimize bottlenecks — benchmarks, O(n²) detection, memory hotspots. Proactive: when slowness is observed or before scaling. RULE: always measure before optimizing — never guess.
Deep research before decisions — tech comparisons, competitive landscape, feasibility studies. Proactive: when choosing between 2+ options or before irreversible architectural choices.
Write or review Playwright e2e, vitest/jest unit, integration tests; test strategy; coverage analysis. Proactive: after implementing features or when coverage is unknown.