claude-starter-kit

Measure output quality, don't vibe it: score a generative task with a two-layer grader — deterministic code metrics + per-dimension LLM-as-judge — over a fixed task set, as signed deltas vs a pinned baseline. Grades cost alongside correctness (pass-slow). Trigger phrases: "eval", "grader", "measure output quality", "LLM-as-judge", "score the output"

Stack-agnostic frontend discipline (web · mobile · desktop): component structure, state, data fetching, loading/empty/error states, i18n, accessibility, performance. frontend-expert-csk applies it on every stack. Trigger phrases: "frontend", "screen", "component", "page", "UI", "state management", "interface"

Refine-to-Done loop: repeat until tests green + review clean + nothing deferred; bounded. Not the harness /loop. Trigger phrases: "iterate", "loop until done", "keep going until"

Stack-agnostic security audit: map the attack surface, trace untrusted input to dangerous calls, surface dependency and configuration flaws. Severity-ranked report with fixes. Trigger phrases: "security scan", "run a security scan", "OWASP check", "scan for vulnerabilities", "find security vulnerabilities", "security audit"

Scope a security audit BEFORE scanning, to cut false positives: map assets, entry points, trust boundaries and 5-8 domain-specific attack classes into a parseable THREAT_MODEL.md. A threat survives a patch; a vulnerability is only evidence for one. Feeds security-scan. Trigger phrases: "threat model", "attack surface", "scope the audit", "trust boundary"

SonarQube quality gate (language-agnostic, local-first): 0 Bugs/Vulns/Hotspots/Code Smells, 0 build warnings. If no analyzer exists, install the language's local server-less Sonar analyzer and run it — never a remote server. Trigger phrases: "sonarqube", "quality gate", "code smell", "sonar scan"

Isolate risky or parallel file-mutating work in a git worktree so the main tree's uncommitted changes are never clobbered. For fan-out agents that edit files, throwaway experiments, or any change you may want to discard cleanly. Trigger phrases: "worktree", "git worktree", "isolate the changes", "sandbox this work", "parallel file edits"

Code review discipline: severity-ranked, reasoned feedback on whether a change improves the system's overall code health. review-agent-csk applies it. Trigger phrases: "code-review", "review the code", "review the PR", "review", "do a review"

Keeps documentation in sync with the code: README, usage and related docs when a public API or behavior changes. Leaves no dead or misleading docs behind. Trigger phrases: "documentation", "docs", "update README", "API docs", "write docs", "document it", "write usage"

Visual and UX design quality for interfaces: hierarchy, spacing rhythm, typographic scale, a restrained color system, layout composition, and polished states. The taste layer above frontend architecture and a11y. Trigger phrases: "visual design", "design system", "make it look good", "UI polish", "layout", "spacing", "typography"

Session handover: when context fills, a phase closes, or the topic changes, write an action-oriented handover to docs/SESSION_STATE.md, then recommend /clear. Trigger phrases: "handoff", "hand off", "session summary", "session state", "clear context", "I'll continue"

Build a Model Context Protocol (MCP) server so an AI client can call your tools/resources: design tool schemas, pick a transport, handle errors, and test it. For exposing an API, database, or service to Claude and other clients. Trigger phrases: "MCP server", "build an MCP", "model context protocol", "expose tools to Claude", "MCP tool"

KVKK/GDPR audit method: data inventory, purpose/basis/retention, minimisation, consent, transparency, data-subject rights, cross-border transfer. privacy-agent-csk applies it. Trigger phrases: "kvkk", "gdpr", "privacy", "consent", "data retention", "minimization"

Root-cause a bug before touching a fix: reproduce, isolate, form and test a hypothesis, confirm the cause, then fix and verify. Stops guess-driven patching. For persistent, intermittent, or "already tried a few things" bugs. Trigger phrases: "debug", "root cause", "why is this failing", "intermittent bug", "can't reproduce", "still broken"

Conventional Commits: reads the staged diff and proposes `type(scope): summary`, with body/footer when needed. One logical change = one commit. commit-agent-csk applies it. Trigger phrases: "commit message", "make a commit", "conventional commit", "write a commit", "git commit"

DevArchitecture backend pattern: MediatR CQRS handler/command/query, IResult/IDataResult, Autofac AOP chain, FluentValidation, i18n. backend-expert-csk applies it. Trigger phrases: "devarch-module", "new handler", "write a command", "add a query", "validator", "aspect"

Production incident response: diagnose → mitigate → resolve, then a blameless postmortem and a repeatable runbook. Stop the impact first, root cause second. Trigger phrases: "incident", "incident response", "runbook", "postmortem", "root cause", "outage", "production incident", "post-incident"

Stack-agnostic performance: measure first, find the bottleneck, then optimise. N+1, needless allocation, wrong async boundary, missing index/cache, heavy payload. No premature optimisation. Trigger phrases: "performance", "slow", "optimization", "profiling", "N+1", "latency", "memory leak", "load test"

Apply schema migrations safely: detect the tool, classify the change by risk, gate destructive ones behind approval, back up in prod, preview-apply-verify, roll back on failure. Trigger phrases: "migration", "schema change", "update database", "add column", "create table", "alter table"

Deploy to a VPS safely: runtime detection, reverse proxy + SSL, atomic swap, keep the previous version, post-deploy health gate, automatic rollback on failure. Trigger phrases: "deploy", "push to the server", "install on the VPS", "ship it to the server", "go to production"

Context/token discipline: subagent isolation, output = summary, move-to-file, delegation threshold, lean skills. Trigger phrases: "token", "context", "context management", "context is full", "clear context"

Divergent discovery BEFORE planning: turn a fuzzy ask into 2–4 scoped options + named unknowns, pick a direction, hand to spec-planning. Bounded; converges to explicit choices, never guesses. Trigger phrases: "brainstorm", "explore options", "not sure what we want", "help me scope", "ideate"

Retrospective self-audit after nontrivial work: unverified assumptions, skipped items, is-this-the-right- approach — findings, not code. The step-back counterpart to iterate's refine-to-done loop. Trigger phrases: "reflect", "retro", "retrospective", "what did we miss", "step back", "introspect"

Frontend accessibility audit (WCAG): semantic HTML, keyboard access, focus management, contrast, ARIA, screen readers. Trigger phrases: "a11y", "accessibility", "WCAG", "screen reader", "keyboard navigation", "contrast", "ARIA"

Architecture Decision Record: context-decision-consequences, for decisions that are expensive to reverse. Written under docs/adr/. Trigger phrases: "adr", "architecture decision", "decision record", "why this approach"

API contract design: resource naming, error model, versioning, pagination, backward compatibility, OpenAPI. A predictable interface that evolves without breaking consumers. Trigger phrases: "api design", "api contract", "api versioning", "openapi", "swagger", "rest contract", "breaking api change"

CI pipeline discipline: lint→build→test→quality→security, fail-fast, deterministic build, secret handling, PR gates. Trigger phrases: "ci", "pipeline", "github actions", "build pipeline", "pr gate", "workflow"

Dependency audit: known CVEs, licence compliance, abandoned/outdated packages, lockfile integrity, and a justification for every new dependency. Trigger phrases: "dependency", "dependency audit", "npm audit", "package security", "CVE", "license"

OPTIONAL, stack-specific: React Native + Expo (prebuild). Mobile RN projects only; the generic principles live in the `frontend` skill. Trigger phrases: "expo", "react native", "native bridge", "expo router", "rn screen", "prebuild"

Translation integrity: every key present in every language, no hardcoded strings, consistent placeholders and plurals. Runs when user-facing text changes. Trigger phrases: "i18n", "translation", "language file", "missing translation", "localization", "translate"

Stack-agnostic observability: structured logs, correlation ids, metrics and traces; no PII or secrets in logs. Makes a production issue traceable to why it happened. Trigger phrases: "observability", "structured logging", "structured log", "add a trace", "add a metric", "correlation id", "add logging"

Attacker's-eye test of LLM/agent defenses: instruction hijacking, data exfiltration and tool abuse through untrusted content; verifies whether the defense actually holds. Trigger phrases: "red team", "red-team", "test prompt injection", "jailbreak", "defense test", "adversarial test", "injection scenario"

Versioning and CHANGELOG: SemVer mapped from Conventional Commits, Keep a Changelog format, tagging, pre-release gates. Trigger phrases: "release", "version", "changelog", "version bump", "tag", "semver"

Spec-first planning: task breakdown, measurable acceptance criteria, dependency order, risk priority. planner-csk applies it; the plan goes to docs/PLAN.md. Trigger phrases: "plan", "spec", "task breakdown", "acceptance criteria", "roadmap", "how do we split this"

The how of testing: pyramid, AAA, isolation, risk coverage, determinism. Guarantees the DoD's "tests are green". test-expert-csk applies it. Trigger phrases: "write a test", "run the tests", "coverage", "are the tests green", "unit test", "integration test"

Trace scan (§4.1/§4.2): before a commit, scans the staged changes and the message for AI traces (co-author trailers, footers, robot emoji, tool names) and vendor template names. The git hooks apply it automatically. Trigger phrases: "scan traces", "trace scan", "AI trace", "check vendor name", "pre-commit audit"