claude-skills

Walk the B1-B15 AI-to-AI blind-spot catalog systematically. Use during the audit pipeline AFTER hard-stops and Tambon hunt and BEFORE the 13 domain audits. Output: PRESENT / NOT PRESENT for each B-class with evidence. Findings flow into the appropriate domains.

Standardize remediation decisions, baseline-policy entries, and legal-review banners for accepted, deferred, or policy-blocked audit findings.

Audit the security domain - auth, authz, secrets, transport, sensitive data exposure, dependency CVEs. Run as part of /audit Phase E.

Audit the architecture and code quality domain - module boundaries, abstraction layers, code organization, naming, documentation. Run as part of /audit Phase E.

Audit the database and data layer - schema design, query patterns, migrations, indexing, RLS, soft-delete, transactions. Run as part of /audit Phase E.

Audit the infra and DevOps domain - CI/CD, deployment, IaC, secrets management, environments, logging, observability. Run as part of /audit Phase E.

Audit the performance domain - query efficiency, caching, async / blocking calls, payload sizes, scaling assumptions. Run as part of /audit Phase E.

Audit the UI/UX and accessibility domain - error states, loading states, form validation, keyboard nav, ARIA, color contrast, mobile responsiveness. Run as part of /audit Phase E.

Audit the reliability domain - error handling, retries, idempotency, race conditions, partial failures, timeouts, graceful degradation. Run as part of /audit Phase E.

Audit the legal/privacy/compliance signals - privacy policy alignment, data retention, GDPR/CCPA basics, cookie consent, export/delete capabilities. Run as part of /audit Phase E.

Audit the dev experience and maintainability - local setup, documentation, test quality, CI feedback time, debuggability. Run as part of /audit Phase E.

Audit the cost and billing risk domain - runaway loops, unbounded LLM/API calls, missing rate limits on paid services, infrastructure cost amplifiers. Run as part of /audit Phase E.

Audit the gap between demo-quality and production-quality - hardcoded test data, dev-only configurations shipped, missing prod hardening. Run as part of /audit Phase E.

Audit what a normal production app at this scale would have but is absent - health checks, error tracking, feature flags, audit logs, on-call. Run as part of /audit Phase E.

Audit code integrity and coherence - duplication, hallucinated references, Tambon signatures, spec drift, Frankenstein patterns, mystery code. THIS DOMAIN incorporates findings from the Tambon hunt and most of the blind-spots walk. Run as part of /audit Phase E.

Generate a detailed AI fix prompt for a specific audit finding. Use when the user asks "/audit-fix F-X.Y" or "give me the fix prompt for finding N." Produces a complete prompt the user can hand to a fresh AI session (Claude Code, Cursor, ChatGPT) to remediate the finding with verification and rollback steps.

Walk the H1-H9 hard-stops catalog systematically against an audit scope. Use as the FIRST audit phase after audit-method completes. Runs detection commands for each hard stop class and reports FOUND / NOT FOUND with evidence. If any hard stop is found, the audit verdict locks to HARD STOP: DO NOT LAUNCH.

Orchestrate the full audit improvement cycle: audit, roadmap, remediation, rerun, delta comparison, and skill patching for missed findings until convergence or a terminal blocked state.

Run the methodology setup phase of a technical audit - fingerprint the stack, inventory the repository, and produce a system map. Use this BEFORE running any audit domains. Output: detected stack, repo summary, and high-level architecture in 3-5 paragraphs. No findings yet.

Conduct a full technical due diligence audit of a vibe-coded codebase. Use when the user types `/audit`, asks for a "full audit," asks for a "due diligence review," asks "is this codebase ready to ship-", or asks for a comprehensive code review of an entire repository (not a single PR). Coordinates the 13 domain skills, the hard-stop hunt, the Tambon LLM-signature hunt, and the blind-spot walk. Produces a single dual-layer report (founder view + technical evidence).

Hunt the three Tambon LLM-failure-mode signatures (Hallucinated Object, Wrong Attribute, Silly Mistake) across an audit scope. Use during the audit pipeline AFTER hard-stops and BEFORE blind-spots. Output: counts per signature, top occurrences, density per 1000 LoC. Findings flow into Domain 13 (Code Integrity).

Multi-LLM debate orchestration (Claude vs Codex vs Gemini) with rounds + synthesis.

Use when debugging a bug or incident and you need a strict end-to-end investigation loop from reproduction to verified fix.

Use after deployments to verify health endpoints, run API smoke tests, and confirm release integrity with CLI checks.

Use when implementation is complete and needs validation - tests REAL app features with Playwright, checks console errors, validates CRUD operations, generates persistent HTML reports to /test/ directory

Write a structured session handoff file for clean context transfer. Use when ending a session, before /clear, when context is heavy, when handing off work to another pane, or when asked to "handoff", "checkpoint", "session-transfer", "save state", "prepare for clear".

Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).

Integrate MercadoPago OAuth payments into web applications. Use when adding MercadoPago payment processing, OAuth account connection, or checkout functionality. Covers Supabase Edge Functions, React/frontend setup, and database schema for multi-tenant SaaS platforms.

Hand-tune a project's `.claude/` directory by cherry-picking ECC (everything-claude-code) rules/skills/agents and generating project-specific rules based on the project's real intelligence layers (GitNexus, MemoryMaster, graphify, Obsidian wiki, existing CLAUDE.md). Run preflight intelligence builds for layers that don't exist yet. Run in any project to curate or re-curate its `.claude/` directory. Use when asked to "curate this project", "cherry-pick rules for this repo", "/project-curate", or when a project's `.claude/` is bloated with mass-installed noise or missing stack-specific rules.

Audit the current project for stale or broken orchestration setup. Verifies monitoring.md, AGENTS.md/CLAUDE.md, graphify freshness, dead script references, placeholder values still in YAML frontmatter. Read-only - never mutates. Use after /monitoring-setup, after pulling someone else's setup, or when something feels off.

Analyze codebase and generate proper CLAUDE.md + AGENTS.md with MemoryMaster integration, real commands, and architecture boundaries. Run in any project to set up or refresh agent instructions. Use when entering a new project, when asked to "set up instructions", "generate CLAUDE.md", "configure this project for agents", or when project instructions are missing/outdated.

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.

Codify the workflow the user just successfully completed into a reusable skill. Use after a multi-step task finished green (tests pass / build succeeds / user confirmed "done") and the same pattern is likely to recur. Walks the recent conversation, drafts a SKILL.md, asks the user to approve, then writes it to disk. Inspired by gstack/skillify (Garry Tan) - one-shot deterministic codification, not autonomous trace mining.

Use when diagnosing Supabase issues like RLS, auth, empty queries, webhooks, and performance problems in production apps.

Use this skill when writing new features, fixing bugs, or refactoring code. Enforces test-driven development with 80%+ coverage including unit, integration, and E2E tests.

Use when an implemented web app, UI feature, workflow, or frontend change needs evidence-based validation in a real browser. Runs interactive discovery, browser execution, screenshot analysis, console/error checks, critical-flow testing, stateful resume, and HTML reporting. Supports CLI-agnostic adapters including agent-browser, playwright-cli, Playwright MCP, Claude/Codex Chrome MCP tools, and browser-harness.