skills

Generate arbitrary graphic assets using Google's Nano Banana (Gemini image generation). Use for logos, icons, illustrations, UI elements, or any one-off graphics.

Surface unaddressed threads from the conversation — bugs mentioned but not fixed, deferred decisions, dropped nits, cross-workstream dependencies, unverified claims, and promised-but-not-done items — as a tight, skimmable report. Reports; never edits code. Use when the user says "loose ends", "any loose ends", "what did we leave hanging", "what didn't we get to", "what got dropped", "open threads", "unaddressed items", "what did we punt on", or "/loose-ends".

Answer in a simple, concise voice, no filler or hedging. Persisted per project or per user, in prose-only, prose+code, or laconic-code (code-first) mode. A per-turn reminder refocuses the voice mid-session (cadence configurable). Invoke via /laconic (on|off|status|mode|cadence).

One skill for committing work and opening PRs, built around stacked PRs. Bare /pr (or $pr in Codex) checkpoints the current diff as the next branch in a stack; subcommands publish the stack (submit), rebase it onto trunk (sync), walk every PR as annotatable Markdown plus exact patches (walk), and land it bottom-up (merge). Update covers the single-branch case — commit and refresh the current branch's PR. Any PR can be opened as a draft with --draft (-d), or make drafts the default with setup. Also ships an optional diff-size nudge hook when the uncommitted diff grows large; enable it explicitly with setup nudge. Agent-callable — an agent working through a task should invoke this to ship a finished slice — `checkpoint`/`commit` at each logical seam to land a stacked PR and continue on a fresh branch, or `update` to commit and refresh the current branch's single PR. Reach for it when a unit of work is complete or the user asks to commit, push, checkpoint, open a PR, or review/walk a PR stack. Do not autonomousl

Blocks destructive git commands (reset --hard, push --force, clean -f, checkout <path>, branch -D, stash drop/clear, worktree remove --force) in Claude Code while letting safer alternatives (--force-with-lease, --soft/--mixed, restore, branch -d) through. PreToolUse hook on Bash. Frontmatter block fires only when this skill is active in context; run `scripts/install.sh` after `npx skills add` for always-on protection.

Retrieve authoritative, up-to-date documentation, API references, configuration details, and code examples for any developer technology (libraries, frameworks, languages, SDKs, APIs, CLI tools, cloud services) via the Context7 CLI. Use whenever answering technical questions or writing code that interacts with external technologies, or when documentation accuracy matters and model knowledge may be outdated.

Manage the repo's project-tracker kanban board as one skill, over a pluggable backend (GitHub Projects or Linear). Subcommands bootstrap a board (setup), pick the next Todo card (next), create a card (new-task), edit a card (update), audit board accuracy against the codebase (audit), split a big card into subtasks (decompose), remove a card (delete), group work into a milestone (milestone), apply one operation across many cards at once (batch), and walk a scope of cards one by one for per-card decisions informed by codebase context (walk). Use when the user says "/project", "what's next", "new task", "add a card", "update card N", "audit the board", "decompose this card", "delete card N", "create a milestone", "add this to the milestone", "what's next in the milestone", "create these five tickets", "delete cards 12, 14, 19", "/project batch", "walk me through the milestone", "triage these cards", "groom the backlog one by one", or "/project walk".

Write in ASD-STE100 Simplified Technical English. One word for one thing, active voice, simple tenses, short sentences, one instruction per sentence. Persisted per project or per user. A per-turn reminder refocuses the rules mid-session (cadence configurable). Invoke via /ste100 (on|off|status|cadence).

Restate the last message in plain human language, with no jargon.

Interactive file cleanup for Downloads, Desktop, and Documents, plus stale git worktree cleanup. Goes item-by-item proposing delete, move, or keep. Use when user says "clean up my computer", "organize my downloads", "help me declutter", "what's in my Downloads", "file cleanup", or "clean up old worktrees".

Scan recent conversation transcripts for safe commands that could be auto-allowed by your CLI agent (Claude Code, Codex, Cursor, …), preview the proposed allowlist changes, then write them to the right config. Use when the user says "reduce permission prompts", "auto-allow safe commands", "optimize permissions", or "/optimize-permissions".

Find large files and directories safe to delete — inactive node_modules, local AI models, Docker artifacts, package caches, old downloads. Use on "free up space", "disk space".

Explain a concept like the listener is five years old — short words, everyday analogies, zero jargon. Explains the current conversation by default, or a topic passed after the command. Invoke via /eli5.

Assess the current project's repo and work-tracker status, then rate overall project health from 0-10. Invoke via /quality-project-health.

Code-review pipeline as one skill. Subcommands review the current branch diff and report bugs as structured findings (review, the default), reproduce and validate each finding to filter false positives (repro), plan + apply fixes after user approval (fix), and process the review comments a reviewer left on your PR (comments). Use when the user says "review code", "review my changes", "code review", "reproduce the findings", "validate the review", "fix the findings", "plan fixes", "process the PR comments", "address the review comments", or "/review-code".

Assess the current project's repo and work-tracker status, then rate overall project health from 0-10. Invoke via /quality:project-health.

Read the agent's file-based memory (the current project by default, or all projects on request), then give the user a few one-sentence, non-obvious pieces of feedback — constructive or observational — about themselves. Use when the user says "memory insights", "what do you notice about me", "read my memory and tell me something I don't know", or "/memory-insights".

Set up and use Datadog's Supply-Chain Firewall (scfw) to block known-malicious npm/PyPI/Poetry packages at install time. Two modes — setup (pipx-install scfw, run `scfw configure` to route pip/npm/poetry through the firewall via shell aliases, smoke-test the pipeline with a dry run, and optionally install a Claude Code PreToolUse hook so the agent's own installs are vetted too) and review (confirm the firewall is still wired, read the local JSON Lines log for recent blocks/warnings, run `scfw audit` on installed packages, answer "did scfw block/see package X"). Client-side, install-time gate for a single developer machine — complements CI-side scanning, doesn't replace it. User-triggered only — activate when the user invokes `/security-scfw`, `/security-scfw setup`, `/security-scfw review`, or `/security-scfw audit`.

Set up and use Datadog's Supply-Chain Firewall (scfw) to block known-malicious npm/PyPI/Poetry packages at install time. Two modes — setup (pipx-install scfw, run `scfw configure` to route pip/npm/poetry through the firewall via shell aliases, smoke-test the pipeline with a dry run, and optionally install a Claude Code PreToolUse hook so the agent's own installs are vetted too) and review (confirm the firewall is still wired, read the local JSON Lines log for recent blocks/warnings, run `scfw audit` on installed packages, answer "did scfw block/see package X"). Client-side, install-time gate for a single developer machine — complements CI-side scanning, doesn't replace it. User-triggered only — activate when the user invokes `/security:scfw`, `/security:scfw setup`, `/security:scfw review`, or `/security:scfw audit`.

Audit an AI agent's saved memories — inventory them by type and age, flag the ones that look stale, contradictory, redundant, or orphaned (verified against the current repo), then walk the user through keep/update/merge/delete decisions one at a time. Default target is Claude Code's per-project memory store (~/.claude/projects/<cwd>/memory/), but handles any file-based memory dir. Use when the user says "audit my memories", "prune memories", "clean up my Claude memories", "review memories", "my memory is cluttered/stale", or "/audit-memories". Curates — it never bulk-deletes.

Read-only audit of AWS spend and recently provisioned resources. Sweeps CloudTrail for recent write activity across all regions, inventories billable resources, breaks down Cost Explorer spend by service, drills into the top cost drivers, and prints a decision-ready report. Never deletes anything by default. Invoke via /audit-aws-costs.

Test-suite review pipeline as one skill. Subcommands cross-reference the tests against the source they cover and report missing edge cases — untested branches, error paths, and boundary conditions — as structured findings (gaps, the default). Use when the user says "review my tests", "what tests am I missing", "find missing test cases", "test gaps", "are my tests complete", "find untested edge cases", "audit test coverage", or "/test".

Generate frontend designs from random rolls — a Wikipedia article (subject), a document_type, and a lineage. Palette / type / layout are DERIVED from subject × lineage. Invoke via /acid-trip.

Find AI-generated noise on the current branch — tombstone comments, restating-the-code comments, callsite-reference comments, unused imports, dead internal symbols — propose each finding for confirmation, and apply only what's approved. Verify with the project's typecheck and tests after. Use when user says "clean ai slop", "remove ai slop", "strip ai code", or "/clean-ai-slop".

Walk an unfamiliar codebase and write a concise CODE_TOUR.md onboarding guide — the key components, a Mermaid diagram of how they connect, and the areas worth a closer look to understand it. Invoke via /code-tour.

Break a problem into smaller pieces — subsystems that are easier to think about — and show how they relate. Works on the current conversation by default, or on a focus passed after the command. Invoke via /decompose.

Trace code paths to find bugs, logic errors, race conditions. Static analysis first, then runtime browser testing for frontend. Triggers on "quality-chaos-monkey", "chaos monkey", "probe for edge cases".

Analyze a codebase for dead code, duplicates, and circular dependencies using knip, jscpd, and madge, then validate findings to filter false positives. Use when user says "quality-dead-code-analyzer", "analyze code", "find dead code", "code cleanup", "find duplicates", "unused exports", or "static analysis".

Audit project documentation against the current state of the codebase and produce a revision plan. Reads README and all docs, launches parallel Explore agents to verify claims, diffs documentation vs reality, and applies approved fixes. Use when user says "quality-docs-update", "update docs", "docs update", "check documentation", "audit docs", "fix readme", "documentation is outdated", or "sync docs with code".

Analyze a codebase for performance bottlenecks in full-stack web applications. Use when user says "quality-perf-review", "perf review", "performance review", "find bottlenecks", "optimize performance", "slow code", "performance audit", or "why is my app slow". Interactive workflow that discusses each finding before moving on.

Bootstrap and maintain Claude Code worktree auto-setup for a repo. Interviews the codebase for what a fresh `claude --worktree` actually needs — gitignored files, install/build steps, per-worktree ports, shared caches — then generates, wires, and smoke-tests the right `.worktreeinclude` + hook. Re-run to update the config when the repo changes. User-triggered via `/quality-worktree-setup [setup|update|check]`.

Record animated GIFs of web page animations using Playwright screenshots and ffmpeg. Use when capturing demos, UI animations, or feature previews for sharing.

Blocks Read, Bash, Grep, and Glob tool calls that touch .env files in Claude Code so secrets never enter the agent's context. Allows .env.example / .env.sample / .env.template / .env.dist. PreToolUse hook. Frontmatter block fires only when this skill is active in context; run `scripts/install.sh` after `npx skills add` for always-on protection.

Fetch credentials from 1Password via the `op` CLI and feed them to programs through bash process substitution (/dev/fd/N file descriptors) or `op run` env vars, so secrets never touch disk or the agent's tool output. Ships a `with-creds` wrapper plus a PreToolUse hook that blocks bare `op read` and other secret-printing op subcommands. Frontmatter hook fires only when this skill is active in context; run `scripts/install.sh` after `npx skills add` for always-on protection.

Blocks rm, shred, unlink, find -delete, and sudo/xargs/subshell variants in Claude Code; redirects to the trash CLI so deletions stay recoverable. PreToolUse hook on Bash. Frontmatter block fires only when this skill is active in context; run `scripts/install.sh` after `npx skills add` for always-on protection.

Set up gitleaks secret-scanning on a repo. Scans history for existing leaks first — stops if dirty, because installing CI on top of a polluted history makes CI permanently red. If history is clean, scaffolds .gitleaks.toml, a local pre-commit hook, and a pinned CI workflow that scans both git history and working tree. User-triggered only — activate when the user invokes `/security-gitleaks`.

Scaffold OpenSSF Scorecard GitHub Action on a public repo with a safe two-phase rollout — first run with publish_results false so SARIF findings can be triaged before any score reaches the public dashboard, then flip to true and add a badge once the score is acceptable. Refuses to install on private/internal repos. Subcommand `fix` turns a Scorecard report into a remediation plan and applies it. Use when the user says "add OpenSSF", "set up Scorecard", "OpenSSF boilerplate", "fix the scorecard findings", or "/security-openssf".

Generate personalized packing lists from a weather forecast. Use when user says 'plan a trip', 'packing list', 'what should I pack', or 'trip to [destination]'.

Bootstrap and maintain Claude Code worktree auto-setup for a repo. Interviews the codebase for what a fresh `claude --worktree` actually needs — gitignored files, install/build steps, per-worktree ports, shared caches — then generates, wires, and smoke-tests the right `.worktreeinclude` + hook. Re-run to update the config when the repo changes. User-triggered via `/quality:worktree-setup [setup|update|check]`.

Trace code paths to find bugs, logic errors, race conditions. Static analysis first, then runtime browser testing for frontend. Triggers on "quality-chaos-monkey", "chaos monkey", "probe for edge cases".