claude-copilot

Validate and fix YAML frontmatter metadata in markdown documentation files. Covers required fields, field formats, and schema compliance for SKILL.md and knowledge-copilot files. Use proactively when auditing documentation frontmatter, reviewing SKILL.md files, or fixing YAML metadata errors.

Validate markdown links and cross-references to ensure documentation integrity. Detects broken links, missing anchors, and invalid cross-reference paths in markdown files. Use proactively when auditing documentation, reviewing PRs that touch markdown files, or checking knowledge-copilot for broken links.

Analyze markdown files for token budget compliance. Checks word count, section lengths, and overall file size against documentation guidelines. Use proactively when creating or reviewing documentation files, knowledge-copilot pages, or when a doc might be over-budget for agent context loading.

Code smell detection, refactoring triggers, and safe transformation patterns for extract, inline, and rename operations. Includes deterministic code-structure metrics analyzer (refactor_metrics.py) for long functions, deep nesting, long parameter lists, large files, and function count — covers TypeScript, JavaScript, Python, Go, Java, and Ruby. Use proactively when identifying refactoring opportunities, code-reviewing for structural complexity signals, prioritizing technical debt, or establishing a complexity baseline for a module. Run the metrics analyzer for deterministic scoring.

MailChimp Voice & Tone framework for UX copy, microcopy, error messages, and interface text — calibrates tone to user emotional state and context. Covers the four-quadrant tone map, plain-language rules, and anti-patterns for corporate or condescending copy. Use proactively when writing error messages, button labels, help text, onboarding flows, empty states, success confirmations, destructive action warnings, or any user-facing copy in product UI, or when reviewing copy for tone consistency.

Tutorial and how-to guide patterns for progressive learning experiences. Covers Diátaxis tutorial/how-to structure, quickstart design, step-by-step walkthrough writing, anti-patterns, and progressive disclosure. Use proactively when writing tutorials, how-to guides, getting-started docs, or README files.

Generate a weighted sales forecast with best/likely/worst scenarios, commit vs. upside breakdown, and gap analysis. Use when preparing a quarterly forecast call, assessing gap-to-quota from a pipeline CSV, deciding which deals to commit vs. call upside, or checking pipeline coverage against your number.

Analyze pipeline health — prioritize deals, flag risks, get a weekly action plan. Use when running a weekly pipeline review, deciding which deals to focus on this week, spotting stale or stuck opportunities, auditing for hygiene issues like bad close dates, or identifying single-threaded deals.

Architecture patterns (monolith, microservices, CQRS, event-driven, api-gateway, scalability), ADR methodology, trade-off analysis, fitness functions, and deterministic ADR completeness scoring via executable script. Use proactively when making or reviewing significant architectural decisions, writing or auditing Architecture Decision Records (ADRs), selecting an architectural pattern, validating architecture with fitness functions, or analysing trade-offs before committing to a direction. Run the scorer for deterministic completeness checking.

JavaScript and TypeScript patterns, anti-patterns, and quality rules — with deterministic regex-based anti-pattern detection for var usage, loose equality (==), leftover console.log, async without await, and common JS pitfalls. Covers Node.js, npm, ESLint, promise patterns, and async code. Use proactively when reviewing JS or TS source files for anti-patterns, running a pre-review scan before ESLint, catching known JS pitfalls, or auditing Node.js or browser codebases. Run the checker for deterministic scanning.

Pythonic code patterns, anti-patterns, and quality rules — with deterministic AST-based anti-idiom detection for Python, Django, Flask, pytest, and pyproject.toml projects. Catches non-Pythonic patterns, PEP8 violations, type-hint gaps, and pre-commit quality issues. Use proactively when reviewing Python source files for anti-patterns, enforcing Pythonic idioms in code review, running pre-commit quality checks on .py files, or auditing Django or Flask codebases. Run the AST checker for deterministic detection.

React component patterns, hooks, anti-patterns, and quality rules — with deterministic regex-based React anti-pattern detection for JSX, TSX, useState, useEffect, conditional hooks, key-prop anti-patterns, and context usage. Use proactively when reviewing React component files (.jsx, .tsx), enforcing hooks rules (no conditional hooks), catching key-prop anti-patterns in list rendering, or running a pre-review scan of React codebases. Run the checker for deterministic scanning.

CI/CD pipeline patterns, GitHub Actions workflow best practices, build automation, continuous integration, Scorecard and CodeQL security findings, and supply-chain security review — with deterministic pipeline linting script. Covers GitHub Actions, Jenkinsfile, GitLab CI, and Azure Pipelines. Use proactively when reviewing or writing GitHub Actions workflows, debugging slow or flaky pipelines, addressing CI pipeline security findings, or running a supply-chain security review. Run the linter for deterministic issue detection.

Dockerfile optimization, multi-stage builds, image security, container best practices, and docker-compose patterns — with deterministic linting script. Covers image size reduction, layer caching, registry hygiene, and production deployment readiness. Use proactively when reviewing or writing Dockerfiles, debugging image size or build speed issues, running a container security review, or preparing images for production deployment. Run the linter for deterministic issue detection.

Git workflows, branching strategies (gitflow, trunk-based), Conventional Commits, commit message quality, version control best practices, and pull-request conventions — with deterministic convention checker script. Use proactively when reviewing commit message quality before merge, enforcing branch naming conventions, onboarding a team to Conventional Commits, or running a CI hook that validates commits in a PR. Run the checker for deterministic commit and branch convention validation.

Kubernetes deployment patterns, resource management, cluster best practices, pod scheduling, OOM kill diagnosis, Helm chart conventions, and container orchestration security review — with deterministic manifest linting script. Covers k8s, kubectl, deployment, service, ingress, and Helm. Use proactively when reviewing or writing Kubernetes manifests, debugging pod scheduling failures or OOM kills, running a cluster security review, or preparing workloads for production deployment. Run the linter for deterministic manifest validation.

API documentation patterns covering REST endpoint specs, auth flows, error handling, OpenAPI/Swagger completeness, api-first design, and versioning best practices — plus deterministic OpenAPI/Swagger coverage linting script. Use proactively when documenting REST API endpoints, reviewing OpenAPI or Swagger specs for completeness, ensuring auth flows, error codes, and examples are documented, or running an api-first design review. Run the linter for deterministic coverage scoring.

Cryptographic patterns for encryption, hashing, key derivation functions (KDFs), TLS configuration, JWT signing, password storage, and authentication tokens — with deterministic weak-algorithm detection script. Identifies use of deprecated algorithms (MD5, SHA1, DES, ECB mode) and insecure configurations. Use proactively when reviewing code that uses encryption, hashing, or key management, auditing password storage or authentication tokens, checking TLS configuration, reviewing JWT signing algorithms, or any context where cryptographic primitives are chosen or configured. Run the validator for deterministic weak-algorithm detection.

STRIDE threat enumeration (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) via prose judgment, plus deterministic DREAD severity scoring via executable script. Covers auth, authorization, session management, PII handling, API design, cryptography, secrets management, and key storage. Use proactively when reviewing authentication, authorization, or session management, designing APIs that handle user data or PII, reviewing cryptography or secrets management, performing threat modeling on new architecture, or running security-critical code review. Run the DREAD scorer for deterministic severity bands. Fallback: @include .claude/skills/security/stride-dread/SKILL.md

STRIDE threat identification with coverage checking (prose judgment) plus deterministic STRIDE coverage and DREAD severity scoring via executable script. Covers system architecture security review, trust boundaries across services, auth, payments, and PII feature pre-implementation review, and threat model refresh sessions. Use proactively when designing or reviewing a new system architecture or API, running pre-implementation security review for features touching auth, payments, or PII, conducting threat modeling sessions (initial or refresh), or reviewing another team's threat model for completeness. Run the coverage checker for deterministic STRIDE gap and DREAD scoring.

Web application security covering OWASP Top 10 (2021) — injection, broken auth, XSS, insecure design, security misconfiguration, vulnerable components, IDOR, SSRF, and more — with prose guidance and deterministic OWASP coverage scoring via executable script. Use proactively when reviewing web application or API security, running a pre-launch security checklist, performing post-incident gap analysis against OWASP Top 10, or any review touching authentication, authorization, injection, or session management. Run the OWASP scorer for deterministic coverage assessment.

Jest testing patterns, anti-patterns, and quality rules for JavaScript and TypeScript test files (*.test.ts, *.spec.js, __tests__). Includes deterministic test-smell detector (jest_smell.py) for .only/.skip left in, missing expects, async-without-await, setTimeout(0), console.log, and done callbacks. Use proactively when reviewing or writing Jest test files, diagnosing flaky or unreliable JavaScript test suites, code-reviewing test files, or running a CI quality gate on test file hygiene. Run the smell detector for deterministic issue detection.

Pytest testing patterns, anti-patterns, and quality rules for Python test files (test_*.py, *_test.py, conftest.py). Includes deterministic test-smell detector (pytest_smell.py) for no-assertion tests, empty tests, bare excepts, magic numbers, sleep calls, and print calls. Covers fixtures, parametrize, mock, patch, and assert patterns. Use proactively when reviewing or writing pytest test files, diagnosing flaky or unreliable Python test suites, code-reviewing test files, or running a CI quality gate on test file hygiene. Run the smell detector for deterministic issue detection.

Visual design patterns for design tokens, component specifications, color systems, typography, spacing, and WCAG accessibility compliance. Use proactively when working on design systems, UI components, CSS/SCSS styles, or reviewing visual design decisions for accessibility and consistency.

UX patterns for task flows, service blueprints, wireframes, and user interactions with comprehensive state coverage. Covers interaction design, user journeys, error states, empty states, and WCAG accessibility. Use proactively when designing task flows, creating wireframes, mapping user journeys, or reviewing interaction patterns.

Creative direction Litmus Test for evaluating ideas, concepts, and messaging against a rigorous differentiation standard — cuts through generic thinking to identify whether a concept is safe/forgettable or genuinely distinct. Applies the CCO creative brief, concept scoring rubric, and challenge-the-brief protocol. Use proactively when evaluating campaign concepts, reviewing brand messaging for differentiation, testing creative directions, preparing concept presentations, or challenging a brief before accepting it.

Named aesthetic directions (brutalist, warm-minimal, neo-brutalist, organic, high-gloss, etc.) with visual moves, industry mapping, anti-slop detection, and rationale templates. Identifies intentional aesthetic choices vs. AI-generated visual clichés. Use proactively when choosing a visual direction before starting design work, evaluating whether an aesthetic is generic or intentional, mapping aesthetic choices to industry and audience, detecting and rejecting AI visual clichés, or presenting multiple direction options with rationale.

Curated color palettes by mood and industry with anti-generic rules, WCAG contrast reference tables, dark mode derivation formulas, and named palette tokens. Covers brand color, accessibility compliance, and the anti-patterns that make palettes look AI-generated. Use proactively when selecting or creating a color system for a brand or product, verifying WCAG contrast compliance for text and UI elements, avoiding overused or generic color combinations, deriving dark mode variants from a light palette, or matching palette mood to industry and emotional context.

Rams' 10 principles, Nielsen's usability heuristics, Three Lenses evaluation, and senior-vs-junior design thinking frameworks — structured rubrics for design critique, not vibes. Identifies design anti-patterns with fixes before they reach users. Use proactively when evaluating a design before shipping, running a structured design critique or review, applying Rams or Nielsen heuristics, distinguishing senior from junior design thinking, or identifying design anti-patterns.

Visual design patterns covering design tokens (color, spacing, typography), component state specifications, WCAG 2.1 AA compliance rules, and anti-patterns for hard-coded values or missing states. Use proactively when defining a design token system, specifying component states across all interactive conditions, verifying WCAG 2.1 AA compliance for contrast and touch targets, building a consistent accessible design system, or reviewing components for missing states or hard-coded values.

Motion as design language — easing grammar, easing-curve personality profiles, multi-element choreography patterns, restraint philosophy, anticipation and follow-through principles, and prefers-reduced-motion compliance. Use proactively when designing multi-element animation sequences or entrance/exit choreography, selecting easing curves with personality for each interaction type, applying restraint principles to avoid over-animation, implementing anticipation and follow-through in UI interactions, or auditing animation systems for motion budget and prefers-reduced-motion compliance.

Elite interaction patterns covering scroll choreography with GSAP ScrollTrigger, spring physics for drag/toggle/swipe, the elite micro-timing scale, text reveal effects, magnetic and tilt elements, and page transitions with shared element morphing. Use proactively when implementing scroll-driven choreography, applying spring physics to user-initiated interactions, selecting precise timing durations, building text reveal or magnetic effects, or engineering page transitions with shared element morphing.

Spatial depth systems, luminosity techniques, glassmorphism tiers, material surface reference (glass, metal, paper, fabric), atmospheric color, and animated mesh gradients — the vocabulary for premium three-dimensional UI. Use proactively when assigning z-axis layers and shadow depth tokens to interface elements, implementing glassmorphism at the correct tier, applying luminosity effects (ambient glow, neon, rim lighting), choosing material surfaces as design tokens, or building atmospheric color and animated mesh gradients.

Curated font pairings by character with type scale ratios (minor third, major third, perfect fourth), fluid typography formulas using clamp(), weight and line-height rules per context, and anti-patterns for overused or generic font combinations. Use proactively when selecting a font pairing for a brand or product, choosing a type scale ratio, implementing fluid typography for responsive scaling, avoiding generic font combinations, or setting weight, line-height, and letter-spacing rules per context.

UX patterns for task flows, wireframes, accessibility, and user interactions — covering all user paths, error states and recovery actions, service blueprints (frontstage and backstage), all UI states (default, loading, empty, error, success, partial), keyboard navigation, screen reader accessibility, and wireframe specifications with component behaviors. Use proactively when designing task flows, mapping service blueprints, specifying UI states, ensuring keyboard and screen reader accessibility, or writing wireframe specifications.

Research a company or person and get actionable sales intel. Works standalone with web search, supercharged when you connect enrichment tools or your CRM. Trigger with "research [company]", "look up [person]", "intel on [prospect]", "who is [name] at [company]", or "tell me about [company]".

Process call notes or a transcript — extract action items, draft follow-up email, generate internal summary. Use when pasting rough notes or a transcript after a discovery, demo, or negotiation call, drafting a customer follow-up, logging the activity for your CRM, or capturing objections and next steps for your team.

Python idiomatic patterns and best practices

STRIDE threat modeling and DREAD severity scoring for security review

Pytest testing patterns, anti-patterns, and quality rules