claude-config

Clean up merged and stale branches from local and remote repositories. Use when branch list is cluttered or after merging PRs.

Generate document index files (manifest, bundles, graph, router) for project documentation. Creates docs/.index/ with searchable registry, feature-grouped bundles, cross-reference dependency graph, and query routing. Supports flat mode (generic projects, script-driven) and grouped mode (projects with doc_id frontmatter, Claude-curated).

Comprehensive markdown document review - anchors, accuracy, SSOT, cross-references, and redundancy analysis.

Enforce complete implementation of all tiers/difficulty levels for tiered features. Prevents partial implementations.

Create well-structured GitHub issues using the 5W1H framework with proper labels and acceptance criteria.

Automate GitHub issue workflow - select issue, create branch, implement, build, test, and create PR.

Interactive review of stale, flagged, and duplicate memories from the latest audit report. Walks entries one at a time with verify / quarantine / edit / skip choices.

Analyze and fix failed CI/CD workflows for a pull request. Use when CI checks fail, GitHub Actions show red, build/test/lint errors block a PR, or the user says 'fix CI', 'fix the build', 'PR is failing', or 'check failed'. Supports solo, team, and batch modes with automated retry and escalation.

Create a release with automated changelog generation from commits since last release using semantic versioning.

Conduct structured research on any topic: web search, codebase analysis, and document synthesis into organized reports. Use when investigating technologies, analyzing alternatives, gathering reference materials, fact-checking claims, or producing technical documentation from research. Use this skill whenever the user asks to research, investigate, compare, or survey a topic.

Parse sonarcloud[bot] PR comments, classify findings, codify whitelisted auto-fixes, escalate the rest.

Provides API design guidelines for REST endpoints, GraphQL schemas, versioning strategies, error handling conventions, logging, observability, and microservice architecture patterns. Use when designing APIs, reviewing API architecture, implementing new endpoints, setting up monitoring, or planning service boundaries.

Provides comprehensive coding standards for quality, naming conventions, error handling, concurrency, and memory management. Use when writing new code, reviewing code, fixing bugs, or refactoring existing code.

Provides workflow guidelines for problem-solving, git commits, GitHub issues, PRs, build management, and testing. Use when planning tasks, creating issues, submitting PRs, managing builds, or writing tests.

Comprehensive security audit covering OWASP Top 10, input validation, authentication, authorization, secret management, dependency vulnerabilities, and injection attack prevention. Use when reviewing security posture, implementing auth flows, handling user input, auditing dependencies, conducting penetration test prep, or before production deployment.

Provides workflow guidelines for problem-solving, git commits, GitHub issues, PRs, build management, and testing. Use when planning tasks, creating issues, submitting PRs, managing builds, or writing tests.

Diagnose and fix failing CI checks by classifying the failure into a known pattern and applying a codified remediation. Use when CI reports MSVC C4996 warnings-as-errors, CMake FetchContent shallow-clone failures, __cpp_lib_format probe mismatches, or when pr-work escalates a failing workflow. Cuts the push-wait-fail-retry loop to a single iteration for the three dominant patterns documented from prior sessions.

Assemble per-release evidence packages from artifacts already produced elsewhere in the project (traceability matrix, CI logs, PR review records, signed-commit lists, external research citations, risk file). Output is a self-contained directory under evidence/<version>/ containing a manifest.yaml, per-artifact subdirectories, and an INTEGRITY checksum. Read-mostly with respect to source code: writes only under evidence/. Opt-in gate: no-op when the consumer project has no evidence/ parent directory, so non-regulated repos are unaffected. Idempotent: refuses to overwrite an existing pack unless --force is passed.

Fan out a single high-level directive (audit, deprecation cleanup, fix, migration, version bump) across an arbitrary list of repositories as parallel Agent workers, with a supervisor that polls a shared manifest, renders a live status table, and aggregates final results. Use when the user says 'apply X across repos', 'audit N repositories', 'sweep every repo', 'run the same fix in all projects', 'parallel multi-repo', 'fleet-wide change', or provides a list of repositories with a single directive. Preferred over running issue-work in each repo sequentially.

Design and build domain-specific agent team harnesses. Analyzes project domains, selects architecture patterns (Pipeline, Fan-out/Fan-in, Expert Pool, Producer-Reviewer, Supervisor, Hierarchical, Generator-Evaluator, Long-Running Session), defines specialized agents (.claude/agents/), and generates skills (.claude/skills/) with orchestration. Use when building new agent teams, designing multi-agent workflows, creating domain harnesses, restructuring agent architectures, setting up long-running multi-session projects, or configuring agent frontmatter (tools, memory, permissions).

Reproduce CI checks locally before pushing so failures surface on the developer machine, not on GitHub. Aligns with the ci-fix skill's pattern catalogue and catches MSVC C4996, CMake FetchContent shallow-clone, and deprecated-API issues pre-push. Invoke manually with /preflight or automatically via CLAUDE_PREFLIGHT=1 in the pre-push hook.

Manage Hazard and Risk records for projects on the regulated-industry track. Maintains a single normalized risk file (docs/.index/risk-file.yaml) holding hazard identification, initial and residual risk estimates, control measures with verification links, and bidirectional Risk<->Requirement linking via the requirements[] field. Subcommands: add | edit | evaluate | validate | list. Output is consumed by the traceability skill (matrix risk_ids[] field) and the evidence-pack skill (risk_file kind). Opt-in: no-op when docs/.index/manifest.yaml is absent so non-regulated repos are unaffected. Atomic writes via *.tmp + rename; idempotent for diffability. Implements ISO 14971 sections 5-9 operationally.

Maintain a SOUP (Software Of Unknown Provenance) register for every third-party software item the project depends on. Discovers candidates from lockfiles (package-lock.json, go.sum, Cargo.lock, requirements.txt, pyproject.toml, pom.xml, packages.lock.json), enriches with human-supplied risk class and verification refs, validates against a license allow-list and the requirements catalogue, and emits a per-supplier report. Outputs docs/.index/soup.yaml plus docs/.index/soup.md. Subcommands: discover | enrich | validate | list | report. Bidirectional linking with traceability via the soup_ids[] field on requirement rows. Opt-in: no-op when no lockfile is detected and docs/.index/soup.yaml is absent. Atomic writes (*.tmp + rename); idempotent (records sorted by id). Implements IEC 62304 sections 5.3.3 (SOUP requirements) and 8.1.1 (configuration items).

Generate and validate the bidirectional traceability matrix linking requirements, design, code, tests, risk records, and standard clauses. Consumes docs/.index/{manifest,bundles,graph,router}.yaml plus an optional compliance/ directory and produces docs/.index/traceability.yaml (machine-readable) and docs/.index/traceability.md (human-readable). Read-mostly: writes only the two trace artifacts and never mutates source documents. Opt-in — no-op when docs/.index/graph.yaml is absent so non-regulated repos are unaffected.

Core behavioral corrections for LLM coding. Reduces over-engineering, surfaces assumptions, enforces surgical changes, and defines verifiable success criteria. Use when writing code, reviewing code, fixing bugs, or implementing features.

Diagnose and fix CI/CD pipeline failures: GitHub Actions errors, build failures, test timeouts, TLS/auth issues, platform-specific failures, dependency resolution problems, and deployment errors. Use when CI checks fail, builds break, tests timeout, or pipeline errors need systematic root-cause analysis and resolution.

Provides documentation standards for README files, API references, code comments, changelogs, architecture docs, and project cleanup guidelines. Use when writing documentation, creating README files, documenting APIs, adding code comments, maintaining changelogs, or cleaning up project files.

Performance optimization analysis: CPU/memory profiling, caching strategies, database query optimization, connection pooling, concurrency patterns, memory leak detection, and throughput improvement. Use when code is slow, memory usage is high, latency needs reduction, or conducting performance reviews before release.

Provides API design guidelines for REST endpoints, GraphQL schemas, versioning strategies, error handling conventions, logging, observability, and microservice architecture patterns. Use when designing APIs, reviewing API architecture, implementing new endpoints, setting up monitoring, or planning service boundaries.

Diagnose and fix CI/CD pipeline failures: GitHub Actions errors, build failures, test timeouts, TLS/auth issues, platform-specific failures, dependency resolution problems, and deployment errors. Use when CI checks fail, builds break, tests timeout, or pipeline errors need systematic root-cause analysis and resolution.

Run comprehensive code quality analysis: cyclomatic complexity, code smells, SOLID principle violations, dead code detection, duplication analysis, and maintainability scoring. Use when reviewing code quality, conducting code audits, checking technical debt, analyzing complexity metrics, or evaluating any file or directory for quality issues.

Provides comprehensive coding standards for quality, naming conventions, error handling, concurrency, and memory management. Use when writing new code, reviewing code, fixing bugs, or refactoring existing code.

Update documentation files with an execution-first approach: read source, plan briefly, edit immediately, summarize changes, and commit. Use when updating docs, syncing documentation with code changes, or batch-editing markdown files.

Provides documentation standards for README files, API references, code comments, changelogs, architecture docs, and project cleanup guidelines. Use when writing documentation, creating README files, documenting APIs, adding code comments, maintaining changelogs, or cleaning up project files.

Comprehensive git repository status with actionable insights. Shows working directory, branch info, recent activity, and potential issues.

Performance optimization analysis: CPU/memory profiling, caching strategies, database query optimization, connection pooling, concurrency patterns, memory leak detection, and throughput improvement. Use when code is slow, memory usage is high, latency needs reduction, or conducting performance reviews before release.

Review pull requests with comprehensive analysis covering code quality, security vulnerabilities, performance implications, test coverage, documentation completeness, and architectural impact. Use when reviewing PRs, conducting code reviews, evaluating merge readiness, or assessing change impact across the codebase.

Comprehensive security audit covering OWASP Top 10, input validation, authentication, authorization, secret management, dependency vulnerabilities, and injection attack prevention. Use when reviewing security posture, implementing auth flows, handling user input, auditing dependencies, conducting penetration test prep, or before production deployment.