azizaeffendi

Production toolkit for Hermes Agent — orchestration patterns, memory management, tool selection, prompt engineering, and performance optimization

Developer workflow automation — git, Docker, CI/CD, code review, monitoring, dependencies, backups, and project management

Security guardian for vibe-coded apps — scores risk 0-100, catches the 50 most common AI security mistakes, and provides Quick Win fixes in under 5 minutes

Audits codebases for security vulnerabilities across 11 domains — secrets, database, auth, payments, mobile, AI/LLM, deployment, data access, API, and CI/CD

Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation, client-side trust issues, insecure payment flows, and more. Use this skill whenever the user asks about security, wants a code review, mentions "vibe coding", or when you're writing or reviewing code that handles authentication, payments, database access, API keys, secrets, or user data — even if they don't explicitly mention security. Also trigger when the user says things like "is this safe?", "check my code", "audit this", "review for vulnerabilities", or "can someone hack this?".

Use when reviewing, debugging, or building AI agents with the Claude Agent SDK (TypeScript or Python). Covers the Agent class, query(), agent.stream(), tool_use, tool schemas, maxIterations, subagents, hooks (PreToolCall, PostToolCall, StopHook), MCP integration, multi-agent coordination, structured output, context window management, stop_reason handling, agentic loop architecture, testing, and observability. Do NOT activate for general Claude API usage without agents, simple messages.create() calls, or non-agent Anthropic SDK usage — use the claude-api skill for those.