dev-os

Audits the security posture of an AI agent (codebase or architecture description): finds toxic combinations, reviews MCP governance and guardrails, and produces a prioritized report with an optional red-team plan. Use when reviewing agent security, auditing MCP configs, or assessing prompt-injection and exfiltration risk.

Manage Plane.so project management via the planecli CLI — list, create, update, and search work items, projects, cycles/sprints, modules, labels, states, documents, and comments. ALWAYS use this skill when the user mentions Plane, Plane.so, planecli, or references work item identifiers like ABC-123, FE-234, MOB-45. Also invoke when the user asks to manage tasks, issues, sprints, backlogs, or project boards AND either explicitly mentions Plane or the project context indicates Plane is the tool in use. Do NOT use for other project management tools (Jira, Linear, Asana, Trello, Azure DevOps Boards).

Analyzes coupling between modules using the three-dimensional model (strength, distance, volatility) from "Balancing Coupling in Software Design". Use when asking "are these modules too coupled?", "show me dependencies", "analyze integration quality", "which modules should I decouple?", "coupling report", or evaluating architectural health. Do NOT use for domain boundary analysis (use domain-analysis) or component sizing (use component-identification-sizing).

Reviews frontend files (`.tsx`, `.ts`, `.js`) for code quality, performance, and business logic issues. Use when the user requests a code review of frontend files, when reviewing staged changes before commit, or when checking specific components for best-practice violations.

Generates Vitest + React Testing Library tests for frontend components, hooks, and utilities. Use when writing tests, reviewing spec files, improving coverage, or when the user mentions Vitest, RTL, unit tests, or integration tests.

Produce HTML output instead of markdown for any agent task. Four levels — Static Doc, Visual Artifact, Two-Way Interactive, Throwaway Tool. Based on Thariq Shihipar's "Unreasonable Effectiveness of HTML" framework. Triggers on "/html-it", "html-it", "html this", "render as html", "build me an html", "make an html artifact".

Structured code review for bugs, regressions, tests, and standards. Use before PRs or when asked for review; interactive mode can fix locally, while mode:agent reports only for pipeline callers.

Launch both thermo-nuclear review subagents in parallel, then synthesize their findings. Use for thermos, double thermo review, or combined bug/security and code-quality branch audits.

Generate or update standardized project documentation (docs/ folder) for any codebase. Use this skill whenever the user wants to create project docs, update existing documentation, scaffold a docs/ folder, generate a README, create ADRs, write getting-started guides, produce architecture docs, or audit documentation completeness for a repository. Also triggers when the user mentions "documentar o projeto", "docs do projeto", "criar docs", "atualizar documentação", "docs/ folder", "onboarding docs", "AGENTS.md", "CLAUDE.md", or asks to prepare a codebase for new developers or AI coding agents. Also use after shipping commits or before opening a PR — the skill can scope the update to a branch's commits ("sync docs to this branch", "atualiza docs com o que mudou", "what docs need updating before this PR", "after-ship docs") instead of scanning the whole codebase. Works with any tech stack — Python, TypeScript, Rust, Go, Java, etc. Even if the user just says "document this repo" or "what docs are missing", use th

Map any system or workflow as a beautiful interactive HTML diagram

Create visual infographics using real-world analogies

Apply clear technical writing patterns in Brazilian Portuguese — cut anglicisms, forced metaphors, parenthesis-as-dumping-ground, performative bold, defensive justifications, and tables used as prose. Use when writing or reviewing technical documents (plans, ADRs, PRDs, READMEs, PR descriptions, commit messages, doc comments) especially in PT-BR, or when the user says "melhorar a escrita", "revisar o doc", "deixar mais claro", "ficou denso", "não entendi essa frase", "reescrever isso", or points out that a text is dense or hard to follow.

Gera documento de escopo de projeto (SOW — Statement of Work) em Markdown para a Cognicode, usando a hierarquia Fase → Capability → Critério de aceite. Use esta skill SEMPRE que o usuário mencionar "criar escopo", "SOW", "documento de escopo", "proposta técnica", "template de projeto", "definir escopo de projeto", "escopo para cliente", "statement of work", ou descrever um novo projeto (software, AI/LLM, RAG, agente, automação) que precisa ser escopado para cliente — mesmo que não peça explicitamente um "SOW". Também acione quando o usuário fornecer briefing de projeto e pedir para "transformar em documento", "gerar template", "estruturar como escopo" ou similar. Cobre projetos de AI/LLM (RAG, agentes), desenvolvimento web/mobile e mix dos dois, com blindagem contratual (deemed acceptance, change request, SLA de decisão) e conformidade com Lei 14.133/2021 para setor público brasileiro.

Transform vague user stories into system-first specifications optimized for AI coding agents. Use when creating new feature specs, improving existing user stories, reviewing specs for ambiguity, or when the user says "write a spec", "improve this story", "spec this out", or "make this AI-ready". Applies the WHAT/WHO/WHY/HOW framework to eliminate ambiguity that causes AI agents to make silent, unreviewed decisions.

Adds caching to Python functions using the cashews library with disk cache (diskcache) as default backend. Use when the user asks to add cache, optimize with caching, or configure cashews. Triggers on 'add cache', 'cache this function', 'setup cashews', 'add disk cache', or 'optimize with cache'.

Sets up asynchronous PostgreSQL with SQLAlchemy for FastAPI applications. Use when creating new projects that need async database access, adding PostgreSQL to existing applications, setting up database test fixtures, configuring database migrations, or when the user asks about async database patterns, asyncpg, SQLAlchemy async sessions, Alembic, or database testing with aiosqlite.

Adds header-based API key authentication to FastAPI applications using pydantic-settings. Use when the user wants to secure endpoints with API keys, implement X-API-Key header validation, or protect routes with simple token-based authentication. Triggers on requests like "add API key auth", "secure my endpoints", or "protect my FastAPI routes".

Creates production-ready FastAPI projects with async SQLAlchemy, dependency injection, and layered architecture. Use when building new FastAPI applications, setting up backend API projects, implementing async REST APIs, or creating microservices with Python.

This skill generates pytest test suites with fixtures, parametrization, async support, and mocking. This skill should be used when writing tests, adding test coverage, or creating unit/integration tests for Python code. Triggers on "write tests", "add pytest tests", "create unit tests", "test this module", or "add test coverage".

Maintain a per-repo napkin as a continuously curated runbook (not a session log). Activates EVERY session. Read and curate it before work, keep only recurring high-value guidance, organize by priority-sorted categories, and cap each category at top 10 items. The napkin lives at `.claude/napkin.md`.

Generate interactive HTML diagrams with Mermaid.js for visualizing flows, sequences, architectures, and processes. Use when the user asks to "create a diagram", "visualize the flow", "draw a sequence diagram", "show me how X works", or needs visual documentation of system interactions, workflows, database schemas, or technical processes.

Manages Azure DevOps resources via CLI including projects, repos, pipelines, builds, pull requests, work items, artifacts, and service endpoints. Use when working with Azure DevOps, az devops commands, CI/CD automation, or when the user mentions Azure DevOps CLI, pipelines, boards, or repos.

Analyze and fix SOLID principle violations in software projects. Use when the user asks to check code quality, review architecture, find design smells, refactor for maintainability, or explicitly mentions SOLID, single responsibility, open-closed, Liskov, interface segregation, or dependency inversion. Triggers on "check SOLID", "review code design", "find code smells", "improve architecture", "refactor for maintainability", or any request about clean code principles.

Use when writing E2E tests with Playwright, setting up test infrastructure, or debugging flaky browser tests. Invoke for browser automation, E2E tests, Page Object Model, test flakiness, visual testing.

Analyzes the current conversation to propose improvements to skills based on what worked, what failed, and edge cases discovered. Use when the user says "reflect", "improve skill", "learn from this", or at end of skill-heavy sessions.

Analyze competitor repositories with evidence-based approach. Use when tracking competitors, creating competitor profiles, or generating competitive analysis. CRITICAL - all analysis must be based on actual cloned code, never assumptions. Triggers include "analyze competitor", "add competitor", "competitive analysis", or "竞品分析".

Analyze and reclaim macOS disk space through intelligent cleanup recommendations. This skill should be used when users report disk space issues, need to clean up their Mac, or want to understand what's consuming storage. Focus on safe, interactive analysis with user confirmation before any deletions.

Reviews and improves Claude Code skills against official best practices. Supports three modes - self-review (validate your own skills), external review (evaluate others' skills), and auto-PR (fork, improve, submit). Use when checking skill quality, reviewing skill repositories, or contributing improvements to open-source skills.