skills

Harden a self-hosted Linux server. Detects current state, runs a full interview to understand what the user wants, warns about edge cases (no SSH keys, password-only auth, provider firewalls), then implements only the selected steps in a safe order.

Systematic edge case discovery, test coverage, and hardening for any feature or codebase area. Spawns parallel subagents to enumerate edge cases across eight categories, writes tests for each, runs them, and fixes unhandled cases. Use after implementation to ensure robustness before shipping.

Add a time-boxed free trial to any app with a payment integration. Handles trial start, expiry tracking, gating, expiry emails, and the upgrade prompt flow. Use when adding a trial period to an existing subscription or paywall.

Convert any YouTube video into a reusable Claude Code skill. Paste a YouTube URL and this skill fetches the transcript, extracts the actionable content, and writes a ready-to-use .claude/skills/<name>.md file. Best for tutorial videos, how-to guides, workflow demos, or instructional content.

Make a site agent-ready using Cloudflare AI Search and the isitagentready.com checklist. Audits the current site, then implements: Cloudflare AI Search (hybrid vector + keyword), markdown content negotiation (acceptmarkdown.com), robots.txt AI rules, sitemap, MCP Server Card, and Agent Skills discovery. Use when asked to add search, make a site agent-ready, or optimize for AI agents.

Scaffolds a Better T Stack project via a structured interview. Uses AskUserQuestion to let the user pick frontend, backend, runtime, database, ORM, API layer, auth, payments, addons, example templates, and where to create the project. Assembles and runs the exact create-better-t-stack CLI command with no manual prompts.

Scans conversation history (current session and/or past transcripts) to identify repeated multi-step workflows, then extracts them into new reusable Claude Code skills written to .claude/skills/<name>.md. Turns what you keep doing manually into a one-word command.

End-to-end test authoring and execution for web, mobile, React Native, or Flutter apps. Discovers user flows, sets up the E2E framework if needed, writes tests covering the golden path and critical edge cases, runs them, and fixes failures. Primary tool is agent-browser (web). Falls back to Playwright (desktop/complex web), Maestro (iOS/Android/React Native/Flutter), or Claude for Chrome (web, last resort).

Generate app icons, favicons, and splash screens for Tauri, PWA, Capacitor (iOS/Android), Expo, Electron, and web projects from a single source image. Detects project type automatically, validates the source image, runs the right CLI command, and wires up the output.

Run Lighthouse audits on a website, analyze the results across all four categories (Performance, Accessibility, Best Practices, SEO), prioritize fixes by impact, implement them, and verify the scores improved. Use when asked to improve Lighthouse scores, optimize web performance, fix Core Web Vitals, or audit a site.

Audit and fix accessibility issues in any web app to WCAG 2.2 AA standard. Covers keyboard navigation, screen reader support, color contrast, focus management, and ARIA. Use when preparing an app for launch or fixing reported accessibility issues.

Add product analytics to any web or mobile app. Sets up PostHog or Plausible with a proper event taxonomy, page views, funnel events, and a dashboard. Use when you need to understand how users actually use the app.

Add authentication to any web or mobile app using Better Auth. Sets up OAuth (Google/GitHub/Discord), magic links, passkeys, session management, and route protection. Handles the full boilerplate: signup, login, logout, protected routes, and user model. Use when starting a new app or adding auth to an existing one.

Analyze JavaScript bundle size, identify bloat, and implement fixes: code splitting, lazy loading, tree shaking, and dependency swaps. Use when page load is slow, Lighthouse performance score is low, or before launching a web app.

Set up the best context tools for AI coding agents: Context7 (live library docs via MCP), opensrc (real package source code), and a project CLAUDE.md. Use when starting a new project or when the agent keeps hallucinating outdated API usage.

Run a database migration safely in production. Covers dry-run, rollback plan, zero-downtime patterns, and verification. Use before applying any schema change to a live database with real user data.

Wire up transactional email for any app using Resend, Postmark, useSend, or Plunk. Sets up templates for welcome, password reset, notifications, and digests. Handles domain verification, deliverability, and unsubscribe. Use when the app needs to send emails to users.

Add internationalization to any web or mobile app. Extracts strings, sets up locale routing, wires up a translation library, and connects to a translation workflow. Use when the app needs to support more than one language.

Set up error tracking, structured logging, and uptime monitoring for any app. Wires up Sentry (errors), structured logs with context, and an uptime monitor (BetterStack or UptimeRobot). Use when an app goes to production without visibility into what breaks.

Add dynamic Open Graph images to any web app using an edge function. No third-party service dependency. Generates per-page social preview images for Twitter/X, LinkedIn, Slack, and iMessage link previews. Use when sharing the app's links looks blank or generic.

Integrate payments into any web or mobile app. Sets up Stripe, LemonSqueezy, or Polar.sh for web; Superwall or RevenueCat for mobile. Covers products, webhooks, subscription portal, billing page, and a test-to-live checklist. Use when adding a paywall, subscription plan, or one-time purchase to an app.

Add push notifications to any web or mobile app. Covers web push (service worker), Expo push for React Native, and a notification preferences UI. Use when the app needs to re-engage users outside of their active session.

Audit a web application against OWASP Top 10:2025. Runs parallel subagents for each category, produces a prioritized findings report with severity ratings, and optionally implements fixes. Use before launch or after major changes.

Audit and optimize a web project for SEO. Detects the stack, runs a structured interview, then implements only the selected improvements: meta tags, structured data, sitemaps, robots.txt, page speed, Core Web Vitals, and more.

Threat model an agentic AI system against OWASP Agentic AI Threats and Mitigations. Identifies architectural threats across planning, memory, tool use, and multi-agent coordination. Produces a STRIDE-style threat model with mitigations, residual risk ratings, and an implementation roadmap. Use when designing or hardening an agentic AI system.

Review AI agent skills (plugins, tools, MCP servers) against the OWASP Agentic Skills Top 10 (AST10). Covers malicious skills, supply chain compromise, over-privileged skills, insecure metadata, unsafe deserialization, weak isolation, update drift, poor scanning, missing governance, and cross-platform reuse. Use when building, publishing, or auditing agent skill/plugin ecosystems.

Implement or audit AI agent security controls based on the OWASP AI Agent Security Cheat Sheet. Covers 9 security pillars: tool least-privilege, input validation, memory/context security, human-in-the-loop controls, output guardrails, monitoring, multi-agent trust, data protection, and adversarial testing. Use when building or hardening any AI agent system.

Audit an LLM-powered application against the OWASP LLM Top 10:2025. Covers prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption. Produces a prioritized findings report with optional fixes.

Audit and fix LLM prompt injection vulnerabilities based on the OWASP LLM Prompt Injection Prevention Cheat Sheet. Covers direct injection, indirect/remote injection, encoding attacks, typoglycemia, Best-of-N jailbreaking, RAG poisoning, agent-specific attacks, and implements layered defenses including input validation, structured prompts, output monitoring, and HITL controls.

Set up quality tools designed specifically for AI-generated code: react-doctor (health scoring), react-scan (re-render detection), react-grab (element context capture), expect (browser testing from git diffs), and agentation (UI annotation for agents). Interviews the user to install only what's relevant.

Pre-launch audit for any web app. Checks SSL, DNS, env vars, secrets, rate limits, backups, error tracking, analytics, performance, and staging/prod parity. Produces a prioritized fix list. Use the day before going live.

Audits an app against the latest Apple App Store and Google Play Store review guidelines. Fetches current guidelines from official sources, interviews the user about app features, content, monetization, and target audience, then produces a detailed compliance report with pass/fail status for each rule category and a prioritized fix list. Use before submitting a new app, adding a major feature, or after a rejection to understand what needs to change.

Generates production-ready legal documents for app deployment: Privacy Policy, Terms of Service, Cookie Policy, Data Processing Agreement (DPA), and jurisdiction-specific compliance checklists. Covers 20+ regulations: GDPR, UK GDPR, CCPA/CPRA, PIPEDA, LGPD, Singapore PDPA, Thailand PDPA, APPI (Japan), PIPL (China), POPIA (South Africa), DPDP (India), Australia Privacy Act, PIPA (South Korea), Malaysia PDPA, Philippines DPA, Indonesia PDP, Vietnam PDPD, UAE PDPL, Saudi Arabia PDPL, Switzerland nDSG, Turkey KVKK, Mexico LFPDPPP, COPPA, and more. Conducts a detailed interview covering business details, data flows, hosting infrastructure, and target markets before generating any documents. Use when launching an app, entering a new market, or auditing existing legal coverage.

Scans all past conversation transcripts for the current project and agent type, identifies recurring patterns and improvement opportunities across sessions, then updates the project's agent config file (CLAUDE.md or AGENTS.md). Gives the agent a view of its own history.

Set up a GitHub Actions CI/CD pipeline for any project. Configures lint, typecheck, test, build, preview deploys on PRs, and production deploy on main. Use when setting up a new project or when CI is missing or broken.

Add a GDPR/CCPA-compliant cookie consent banner to any web app. Implements consent categories, blocks non-essential scripts until consent is given, and provides an opt-out mechanism. Use when the app uses analytics, advertising, or any non-essential cookies.

Run load tests against any API or web app using k6. Identifies throughput limits, latency degradation, and failure modes under realistic traffic. Use before launch, before a traffic spike, or after a major backend change.

Build a waitlist landing page with email capture, referral mechanics, position tracking, and a drip email welcome sequence. Use before launching a product to build an audience and create launch momentum.

Reflects on the current conversation to extract corrections, repeated issues, and validated approaches, then updates CLAUDE.md (Claude agents) or AGENTS.md (Codex agents) with new rules. Run at any point to capture what the agent should learn from this session.