kiro-rails

Étoiles8

Forks1

Mis à jour17 juillet 2026 à 11:28

Index of the kiro-rails engineering toolbox in this repo: every review command, spec workflow, subagent, and steering rule, with when to use each. Load this to decide which review or workflow to run, or to discover what kiro-rails offers. Routing only - each entry points at its own command, skill, or agent.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Source

sourjya

sourjya/kiro-rails

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en assurance qualité des logiciels et testeursProfessions informatiques et mathématiques·SOC 15-1253

SKILL.md

readonly

name	kiro-rails
description	Index of the kiro-rails engineering toolbox in this repo: every review command, spec workflow, subagent, and steering rule, with when to use each. Load this to decide which review or workflow to run, or to discover what kiro-rails offers. Routing only - each entry points at its own command, skill, or agent.

kiro-rails toolbox

GENERATED by scripts/export-to-claude.sh from .kiro/ - do not edit by hand. This is a routing index: it points you at the right command, skill, agent, or steering section; it does not do the work itself. The full source→target map with fidelity grades is in docs/references/kiro-claude-sync-ledger.md.

Review commands

Invoke as /<name>. Each audits one dimension; see the "Periodic Review Policy" section of CLAUDE.md for when each triggers and the recommended sequencing.

/review-ai-agent-surface - Audit the AI and agent attack surface: prompt injection, tool-permission scope, unbounded agent loops, and unsafe handling of model output. Produces an AISR report.
/review-api-contracts - Audit API boundary code for contract drift: response envelope consistency, error response shapes, HTTP status-code semantics, and frontend/backend type agreement.
/review-cicd-pipeline - Audit CI/CD pipelines for missing quality gates, unpinned actions, secret exposure in logs, and deploy steps that can run without passing tests.
/review-code-maintainability - Structural maintainability audit: god objects, hidden coupling, dead code, comment-standard compliance, and drift from documented architecture. Produces an MRR report.
/review-code-security - Tiered application security audit (T1 pre-commit, T2 feature complete, T3 sprint end) covering OWASP, secrets, authorization, crypto quality, and supply chain. Produces an SRR report.
/review-commit-pr-discipline - Review the current branch's commits and working tree for commit and pull-request discipline, then produce well-structured commit messages and a PR description.
/review-css-architecture - Audit CSS and design-token usage against the console-idiom rubric: ad hoc overrides, magic values, duplicated spacing scales, and design-system drift.
/review-dependency-risk - Audit dependency manifests for supply-chain risk: unmaintained or typosquatted packages, license conflicts, unpinned versions, and known vulnerabilities.
/review-frontend-performance - Audit frontend performance: bundle size and code splitting, render waterfalls, N+1 data fetching, unmemoized work, and lazy-loading gaps.
/review-hardcoded-values - Scan for embedded literals that belong in config or a constants module: URLs, magic numbers, thresholds, error message strings, and environment-dependent values.
/review-iac-consistency - Audit infrastructure-as-code for per-environment drift, over-permissive IAM policies, unencrypted resources, and infrastructure changed outside version control.
/review-observability - Audit logging, metrics, tracing, and correlation IDs across pipelines and background jobs. Flags blackbox code paths that emit no telemetry and cannot be debugged in production.
/review-spec-readiness - Grade a Kiro spec (requirements, design, tasks) against the spec quality standards before implementation begins. Flags thin specs that will cause rework.
/review-test-quality - Audit test suite quality: coverage gaps, weak assertions, missing negative cases, over-mocking, and tests that cannot fail regardless of implementation.
/review-ux-audit - Full UX audit of a frontend codebase. Produces persona cards, journey maps, heuristic sweep, anti-pattern findings, and a prioritized fix register formatted for Kiro spec output.
/review-ux-live - Live browser-walk UX review using the console-idiom rubric. Requires a browser MCP (Playwright, Chrome DevTools, or equivalent). Walks each page/route with a 9-step protocol, collects quantitative evidence, and produces a scored report with rubric IDs.
/review-ux-preflight - Pre-implementation UX gate. Run before coding any UI feature to validate layout decisions, interaction placement, and hierarchy. Produces a PROCEED/REVISE/BLOCK decision.

Skills

Invoke by name (the model also auto-surfaces them by their triggers).

auth-implementation - Authentication, SSO, OAuth, OIDC, login, redirect, token implementation patterns. Use when implementing auth flows, login pages, token refresh, SSO integration, or redirect handling.
incident-response - Security incident response, breach containment, evidence preservation, and recovery verification. Use when a breach, compromise, or security incident is detected or suspected.
review-guide - Interactive guide to kiro-rails review prompts, agents, and tools. Explains which review to run, when, and why. Invoke with /review-guide or ask "what reviews should I run?", "which prompt?", or "how do I audit?".
spec-archive - Archive a completed and verified spec. Moves it from active specs to the docs archive, updates the spec registry. Use after spec-verify passes.
spec-implement - Implement a proposed spec. Reads the spec folder, follows the task checklist, writes code using TDD. Use after spec-propose is complete and approved.
spec-propose - Propose a new feature or change. Creates a structured spec folder with proposal, requirements, design, and tasks before any code is written. Use when starting new work.
spec-verify - Verify a completed implementation against its spec. Checks all acceptance criteria, runs tests, validates coverage. Use after spec-implement is done.

Subagents

Spawn via the Agent/Task tool for restricted, focused work (most are read-only).

code-security-reviewer - Performs structured code security and quality audits with restricted tool access. Supports tiered review (T1 pre-commit, T2 feature, T3 sprint).
security-verifier - Adversarial verification agent. Assumes each security finding is a false positive and searches for compensating controls that disprove it. Use after the code-security-reviewer produces findings.
ux-red-team - Hostile UX reviewer. Assumes the implementation is flawed. Finds friction, hierarchy issues, accessibility gaps, pointer travel problems, and pattern violations. Read-only - cannot modify code.
ux-reviewer - Performs live browser-walk UX audits using the console-idiom rubric. Restricted to read-only browser interaction - no writes, deletes, or submissions. Requires a browser MCP.

Spec-driven workflow

For feature-sized work (a new capability, multi-file/multi-layer, new endpoints/models/UI), follow the Kiro spec cycle rather than coding ad hoc: spec-propose → spec-implement → spec-verify → spec-archive (the skills above). Specs live under .kiro/specs/.

Engineering rules (always loaded)

Every steering rule is concatenated into CLAUDE.md. Start with Agent Boundaries (the hard stops), then Git & Focus Discipline, Change Discipline, Testing Standards, and Database Conventions. The review commands above exist to enforce these rules.

Plus depuis ce dépôt

même dépôt

incident-response

sourjya/kiro-rails

Security incident response, breach containment, evidence preservation, and recovery verification. Use when a breach, compromise, or security incident is detected or suspected.

2026-07-088

review-guide

sourjya/kiro-rails

Interactive guide to kiro-rails review prompts, agents, and tools. Explains which review to run, when, and why. Invoke with /review-guide or ask "what reviews should I run?", "which prompt?", or "how do I audit?".

2026-07-088

auth-implementation

sourjya/kiro-rails

Authentication, SSO, OAuth, OIDC, login, redirect, token implementation patterns. Use when implementing auth flows, login pages, token refresh, SSO integration, or redirect handling.

2026-06-058

spec-archive

sourjya/kiro-rails

Archive a completed and verified spec. Moves it from active specs to the docs archive, updates the spec registry. Use after spec-verify passes.

2026-06-058

spec-implement

sourjya/kiro-rails

Implement a proposed spec. Reads the spec folder, follows the task checklist, writes code using TDD. Use after spec-propose is complete and approved.

2026-06-058

spec-propose

sourjya/kiro-rails

Propose a new feature or change. Creates a structured spec folder with proposal, requirements, design, and tasks before any code is written. Use when starting new work.

2026-06-058

name	kiro-rails
description	Index of the kiro-rails engineering toolbox in this repo: every review command, spec workflow, subagent, and steering rule, with when to use each. Load this to decide which review or workflow to run, or to discover what kiro-rails offers. Routing only - each entry points at its own command, skill, or agent.

kiro-rails toolbox

Review commands

Invoke as /<name>. Each audits one dimension; see the "Periodic Review Policy" section of CLAUDE.md for when each triggers and the recommended sequencing.

/review-ai-agent-surface - Audit the AI and agent attack surface: prompt injection, tool-permission scope, unbounded agent loops, and unsafe handling of model output. Produces an AISR report.
/review-api-contracts - Audit API boundary code for contract drift: response envelope consistency, error response shapes, HTTP status-code semantics, and frontend/backend type agreement.
/review-cicd-pipeline - Audit CI/CD pipelines for missing quality gates, unpinned actions, secret exposure in logs, and deploy steps that can run without passing tests.
/review-code-maintainability - Structural maintainability audit: god objects, hidden coupling, dead code, comment-standard compliance, and drift from documented architecture. Produces an MRR report.
/review-code-security - Tiered application security audit (T1 pre-commit, T2 feature complete, T3 sprint end) covering OWASP, secrets, authorization, crypto quality, and supply chain. Produces an SRR report.
/review-commit-pr-discipline - Review the current branch's commits and working tree for commit and pull-request discipline, then produce well-structured commit messages and a PR description.
/review-css-architecture - Audit CSS and design-token usage against the console-idiom rubric: ad hoc overrides, magic values, duplicated spacing scales, and design-system drift.
/review-dependency-risk - Audit dependency manifests for supply-chain risk: unmaintained or typosquatted packages, license conflicts, unpinned versions, and known vulnerabilities.
/review-frontend-performance - Audit frontend performance: bundle size and code splitting, render waterfalls, N+1 data fetching, unmemoized work, and lazy-loading gaps.
/review-hardcoded-values - Scan for embedded literals that belong in config or a constants module: URLs, magic numbers, thresholds, error message strings, and environment-dependent values.
/review-iac-consistency - Audit infrastructure-as-code for per-environment drift, over-permissive IAM policies, unencrypted resources, and infrastructure changed outside version control.
/review-observability - Audit logging, metrics, tracing, and correlation IDs across pipelines and background jobs. Flags blackbox code paths that emit no telemetry and cannot be debugged in production.
/review-spec-readiness - Grade a Kiro spec (requirements, design, tasks) against the spec quality standards before implementation begins. Flags thin specs that will cause rework.
/review-test-quality - Audit test suite quality: coverage gaps, weak assertions, missing negative cases, over-mocking, and tests that cannot fail regardless of implementation.
/review-ux-audit - Full UX audit of a frontend codebase. Produces persona cards, journey maps, heuristic sweep, anti-pattern findings, and a prioritized fix register formatted for Kiro spec output.
/review-ux-live - Live browser-walk UX review using the console-idiom rubric. Requires a browser MCP (Playwright, Chrome DevTools, or equivalent). Walks each page/route with a 9-step protocol, collects quantitative evidence, and produces a scored report with rubric IDs.
/review-ux-preflight - Pre-implementation UX gate. Run before coding any UI feature to validate layout decisions, interaction placement, and hierarchy. Produces a PROCEED/REVISE/BLOCK decision.

Skills

Invoke by name (the model also auto-surfaces them by their triggers).

auth-implementation - Authentication, SSO, OAuth, OIDC, login, redirect, token implementation patterns. Use when implementing auth flows, login pages, token refresh, SSO integration, or redirect handling.
incident-response - Security incident response, breach containment, evidence preservation, and recovery verification. Use when a breach, compromise, or security incident is detected or suspected.
review-guide - Interactive guide to kiro-rails review prompts, agents, and tools. Explains which review to run, when, and why. Invoke with /review-guide or ask "what reviews should I run?", "which prompt?", or "how do I audit?".
spec-archive - Archive a completed and verified spec. Moves it from active specs to the docs archive, updates the spec registry. Use after spec-verify passes.
spec-implement - Implement a proposed spec. Reads the spec folder, follows the task checklist, writes code using TDD. Use after spec-propose is complete and approved.
spec-propose - Propose a new feature or change. Creates a structured spec folder with proposal, requirements, design, and tasks before any code is written. Use when starting new work.
spec-verify - Verify a completed implementation against its spec. Checks all acceptance criteria, runs tests, validates coverage. Use after spec-implement is done.

Subagents

Spawn via the Agent/Task tool for restricted, focused work (most are read-only).

code-security-reviewer - Performs structured code security and quality audits with restricted tool access. Supports tiered review (T1 pre-commit, T2 feature, T3 sprint).
security-verifier - Adversarial verification agent. Assumes each security finding is a false positive and searches for compensating controls that disprove it. Use after the code-security-reviewer produces findings.
ux-red-team - Hostile UX reviewer. Assumes the implementation is flawed. Finds friction, hierarchy issues, accessibility gaps, pointer travel problems, and pattern violations. Read-only - cannot modify code.
ux-reviewer - Performs live browser-walk UX audits using the console-idiom rubric. Restricted to read-only browser interaction - no writes, deletes, or submissions. Requires a browser MCP.