claude-code-blueprint

CRITICAL SAFETY SKILL — Verify ALL technical claims, API signatures, library methods, code behavior, and factual statements before answering. Use Context7, WebSearch, and Read tools to confirm. MUST BE USED PROACTIVELY whenever: writing code that calls any library or API, answering technical questions, stating facts about frameworks or tools, mentioning version numbers, describing function behavior, recommending libraries, comparing technologies, or making any claim that could be wrong. Triggers: "how does X work", "what are the arguments for", "does this function exist", "is this the right syntax", "what version", "API reference", "documentation for", "how to use", "method signature", "return type", "parameters", "correct usage", "does this library support", "what's the default", "is this deprecated". Prevents hallucinated code, wrong function names, fabricated documentation, and incorrect facts. When in doubt about ANY technical claim, this skill MUST activate.

Multi-agent brainstorming and strategic thinking on any complex topic. Explores the subject deeply, then spawns specialized sub-agents in parallel for diverse expert perspectives. MUST BE USED PROACTIVELY when user faces any decision, architectural choice, design question, strategic dilemma, or open-ended problem that benefits from multiple viewpoints. Triggers: "brainstorm", "explore ideas", "what are the options", "how should I approach", "pros and cons", "compare approaches", "what do you think about", "best way to", "should I use X or Y", "what's the best approach", "help me decide", "trade-offs", "alternatives", "strategy for", "how would you", "what's your take", "opinions on", "which one", "recommend", "suggest", "ideas for", "possibilities", "ways to", "what direction", "where to start", "what's better".

Reference patterns for REST APIs, pytest/vitest testing, Docker multi-stage builds, GitHub Actions CI/CD, PostgreSQL, TypeScript generics, Python async, and React Server Components. MUST BE USED when user asks about: "API design", "how to test", "Dockerfile", "CI/CD pipeline", "database schema", "TypeScript types", "async/await", "React hooks", "Next.js", "FastAPI", "testing pattern", "mock", "fixture", "docker compose", "github actions", "workflow yaml", "postgres query", "SQL pattern", "migration", "generic type", "server component", "use client", "use server", "middleware pattern", "error handling pattern", "retry logic". Includes code examples and validation commands. NOT for running tests (use smart-test-runner), security patterns (use security-audit), or git operations (use commit-message).

Ship workflow: review changes, generate conventional commit messages, push, and create PRs. MUST BE USED when user says: "commit", "git commit", "commit this", "save changes", "commit message", "ship", "ship it", "push", "create PR", "pull request", "ready to merge", "deploy this", "stage changes", "what changed", "review my changes", "conventional commit", or after completing a coding task. Reviews changes, generates commit, optionally pushes and creates PR. NOT for git branching/rebasing (use git-workflow), code review (use review command), or deployment configuration (use deployment-assistant).

Debug errors systematically by searching first, then analyzing, then proposing verified solutions. MUST BE USED when user reports: "error", "bug", "doesn't work", "fails", "crash", stack traces, exception messages, or any troubleshooting scenario. Triggers: "TypeError", "ImportError", "undefined is not a function", "segfault", "panic", "broken", "not working", "unexpected behavior", "regression", "failing", "exception", "traceback", "stack trace", "debug this", "why does this fail", "help me fix". Also enforces confidence levels and output templates. Prevents guessing solutions without research.

Conduct rigorous research with proper citations (DOI, arXiv, PMID) and source triangulation. MUST BE USED when user asks: "what is SOTA", "recent developments", "compare X vs Y", "is it true that", "research says", "latest papers on", "scientific evidence", "studies show", "state of the art", "literature review", "find papers", "academic research", "benchmark results", "who published", "when was X released", "current best", "what does the research say", "evidence for", "peer reviewed". Searches multiple sources, evaluates reliability, states confidence level. NOT for verifying API signatures (use anti-hallucination) or general web search (use WebSearch directly).

Proactive security audit: OWASP top 10, dependency vulnerabilities, secrets detection, input validation, auth patterns, and secure defaults. MUST BE USED when user mentions: "security", "vulnerability", "audit", "OWASP", "CVE", "security review", "pentest", "injection", "XSS", "CSRF", "authentication", "authorization", "secrets", "hardcoded password", "secure", "npm audit", "pip-audit", "check security", "is this secure", "security risk", "data leak", "SQL injection", "command injection", "path traversal", "SSRF", "RCE", "privilege escalation", "supply chain", "dependency scan", "snyk", "trivy", "semgrep", "bandit". Scans code for vulnerabilities, checks dependencies, verifies auth patterns. NOT for explaining security concepts (use pedagogical-explain), or general code review (use code-review).

Master uv package manager for Python: project setup, dependency management, virtual environments, lockfiles, CI/CD integration, Docker builds, and migration from pip/poetry. MUST BE USED when user mentions: "uv", "uv add", "uv run", "uv sync", "uv init", "uv lock", "uv venv", "uv pip", "pyproject.toml", "python project setup", "python dependencies", "virtual environment", "venv", "pip install", "poetry to uv", "migrate from pip", "lockfile python", "requirements.txt", "setup.py", "pip freeze", "uv tool", "install package", "add dependency", "python environment", "new python project", "package manager python", "create project", "uv export", "uv cache", "uv python". 10-100x faster than pip. Covers init, add, sync, lock, run, Docker, CI/CD. NOT for npm/pnpm/yarn (JS toolchain), Rust cargo, or deployment (use deployment-assistant).