rcs

Walks the Anthropic Skill best-practices checklist plus the RCS Layer-3 documentation contract for authoring a new skill. Covers gerund-form naming, third-person frontmatter description, the 11 required H2 sections in order, the ≤ 500-line body cap with reference/ bundles, one-level-deep reference linking, and the eval-first discipline (3 scenarios written before the body). Use when the user wants to write a new skill — for any host (Claude Code, Copilot CLI, Gemini CLI, Anthropic API plugin) — and needs the authoring rules plus a skeleton to fill in.

Converts existing decision-tree expertise (test-selection trees, triage flowcharts, dispatch rules, troubleshooting trees) into a deterministic walk-the-tree skill where each predicate is a numbered step, each leaf is a named action, and the skill commits to checking predicates in order rather than letting the model shortcut to a leaf based on the user's framing. Use when the user has a written or implicit decision tree (or DAG) whose predicates are objectively checkable and whose leaves are deterministic, and wants the discipline encoded as a skill. Refuses to encode open-judgment domains as trees and refuses to silently drop cycles.

Audits a trained classifier or scoring model for disparate treatment across protected attributes (race, sex, age, disability, religion, national origin, sexual orientation, or any user-supplied subgroup) using equal-opportunity, demographic-parity, calibration-within-group, and intersectional cuts. Use when the model decides outcomes for people (hiring, lending, healthcare triage, content moderation, criminal justice scoring), when a downstream user asks whether the model is "fair", when a regulator requires a disparate-impact analysis, or before deployment of any consequential ML system. Refuses to audit without a documented protected-attribute list and refuses to declare a model "fair" from a single metric.

Audits an MCP (Model Context Protocol) server against six security checks — license, source review, network egress, version pin, secret handling, and tool subset — before the server is registered into the Claude Code tool pool. Use whenever the user proposes adding an MCP server to ~/.claude/mcp.json, a project .mcp.json, or a plugin's mcpServers config. Produces a per-check verdict, a blocking-issues list, and a final integrate / integrate-with-constraints / reject recommendation.

Walks a threat-modeling pass over an autonomous agent or multi-agent system (tool-using agent, planner-executor loop, multi-step workflow, multi-agent collaboration) using a user-supplied catalog (MAESTRO, MITRE ATLAS, OWASP Agentic Security Initiative, or a custom catalog). Extends LLM-app threat modeling with agent-specific boundaries — planner ↔ executor loop, memory ↔ next-turn context, tool-result ↔ next prompt, agent ↔ agent — and adds agentic-specific concerns (excessive agency, goal hijacking, memory poisoning, runaway loops, multi-agent collusion). Methodology only — no bundled catalog; the user provides one. Use when the user is designing, reviewing, or shipping an agent system that plans, calls tools, persists state across turns, or coordinates with other agents.

Walks a STRIDE-style threat-modeling pass over an LLM application (chatbot, RAG system, single-turn completion API, content-generation pipeline) using a user-supplied catalog (OWASP LLM Top 10, MITRE ATLAS, MAESTRO, or a custom catalog). Inventories components and trust boundaries, maps each catalog item to one or more STRIDE categories at each boundary, and produces an auditable threat register with likelihood, impact, and mitigation per finding. Use when the user is designing, reviewing, or shipping an LLM-powered application and needs a structured threat model before deployment. The skill is methodology only — it never ships a bundled threat catalog; the user provides one.

Triages SAST/DAST/SCA vulnerability findings exported as SARIF (Static Analysis Results Interchange Format). Walks the SARIF in -> dedupe-across-tools -> EPSS enrichment -> blast-radius scoring -> suppression-with-rationale pipeline, then emits a PR-ready comment ranked by exploitability and reachability. Use when the user has a SARIF file or a multi-tool finding dump (Semgrep + CodeQL + Snyk + Trivy), when a security scanner produced hundreds of findings and the user needs to prioritize, when finding-fatigue threatens to bury a real critical, or when preparing a security PR comment from raw scanner output.

Runs a multi-subagent adversarial premortem on a spec, plan, design, paper, or codebase by orchestrating six independent perspectives (Red Teamer, Data Scientist, ML Engineer, Security Architect, MLOps/SRE, Governance/Risk) as parallel subagents across up to five rounds. Each perspective reads the artifacts in its own context and returns evidence-anchored findings with calibrated confidence bands; the orchestrator cross-attacks, adjudicates posteriors, applies a drop rule, and emits a prioritized remediation plan. Use for high-stakes AI, ML, data-science, agentic, MLOps, or security-sensitive artifacts where one reviewer's depth is not enough and the cost of being wrong is high. For a single-session multi-round premortem without subagents, use adversarial-premortem-single.

Runs a structured multi-round adversarial premortem on a spec, plan, design, paper, proof, or codebase. Assumes the artifact has already failed six months out, works backward to identify causes, scores each surviving failure mode with a calibrated confidence band, and emits a prioritized remediation plan. Use when the cost of being wrong is high — AI security designs, ML system architecture, mathematical proofs, agentic-system designs, or any high-stakes plan where surfacing failure modes you would otherwise miss is the goal. For the multi-subagent team version with six independent perspectives running in parallel, use adversarial-premortem-complete.

Audits a Claude Code (or Anthropic API) session for context-window pressure — total context usage as a percentage of the 200k window, prompt-cache hit rate, CLAUDE.md hierarchy size, tool-result bloat, system-reminder accumulation, and conversation-history compression triggers. Produces a prioritized triage plan (move large tool results to files, dispatch subagents with summary-only return contracts, /compact, /clear). Use when the session feels slow, prompt-cache hit rate is dropping, token cost seems high, or before starting a long-running multi-turn workflow.

Audits a written or claimed mathematical result (theorem, lemma, bound, identity, asymptotic argument, definition) by walking each formal claim through a four-field per-claim table — Location · Concern · Strongest counter · Stops-mattering-if — and producing a prioritized remediation list. Adapts the ATACE math-flags template into a generalized, repo-agnostic format. Use when the user has finished a proof, paper section, theoretical argument, or formal bound and wants an adversarial audit of the mathematics specifically, distinct from empirical-claim red-teaming.

Locks the hypothesis, falsification criteria, stopping rules, and power justification of an empirical evaluation BEFORE any data is collected or observed. Use when designing an LLM eval, an A/B experiment, a clinical or observational study, an ML model comparison, or any decision that will rest on a test statistic. Produces a one-page pre-registration document committed to a versioned location prior to the first run, so that HARKing (hypothesizing after results are known), p-hacking, optional-stopping, and outcome-switching cannot quietly inflate the false-positive rate. Refuses to pre-register vague hypotheses ("model A is better"), open-ended stopping rules ("until results stabilize"), or post-hoc rationalizations of data already observed.

Scaffolds a greenfield security-research repository with the security-specific artifacts that distinguish it from a generic project: SECURITY.md, a starter threat-model template, a vulnerability disclosure policy (VDP), gitleaks + semgrep wired into pre-commit, an MIT or Apache-2.0 license appropriate for security tooling, a security-specific .gitignore that ignores common artifact classes (PCAPs, exploit binaries, credential dumps, raw payloads), and a CONTRIBUTING.md that documents the coordinated-disclosure expectation. Use whenever the user is starting a NEW security-research, AI-security, red-team, defensive-tooling, or vulnerability-research project from an empty directory. Refuses to scaffold on top of an existing mature project (different concern) and refuses for non-security greenfield work (hands off to scaffolding-ml-research-notebook).

Writes release notes that double as miniature postmortems for every fixed regression. Each fix entry names the file/function where the bug lived, the root-cause class (off-by-one, race, schema drift, dependency CVE, etc.), the user-visible symptom, the test that was added to prevent recurrence, and the commit SHA. Use when shipping a bug-fix release, a security patch, a regression-fix sprint, or a stability-focused minor version where the audience needs to know not just what changed but why the bug existed and what stops it from coming back. Refuses to apply postmortem structure to a first release or to a pure-feature-announcement release where no regressions are being fixed; those need feature-announcement notes instead.

Writes a "successor primer" — the document a cold-pickup reader needs to carry a non-trivial project forward without the original author present. Covers purpose, founding principles, where-to-start entry points, defense-in-depth false-confidence warnings, project-specific glossary, and an explicit "what's NOT here" list. Use when a project has reached the point where a colleague, a future self, an open-source maintainer, or a next-team member will need to take over without sitting next to the original author. Refuses to write a primer for a throwaway prototype or a project the original author still owns day-to-day; in those cases a README is the right artifact, not a primer.

Audits the agent-instruction file hierarchy (managed > user > project > plugin scope) for size budget, cache hygiene, and drift. Checks total line count against the 400-line hard cap (250-line target), flags timestamps and per-run state that break the 5-minute prompt-cache TTL, and recommends moving dynamic content into hook-injected system-reminder blocks. Use when the instruction hierarchy feels bloated, prompt-cache hit rate is dropping, token usage seems high at session start, or the user is about to add a new instruction file to the hierarchy.

Walks a directed acyclic graph (DAG) for an observational causal-inference problem and picks the adjustment set that identifies the target causal effect. Forces explicit commitment to nodes (treatment, outcome, confounders, mediators, colliders, instrumental variables) and edges before any estimation runs, then applies the backdoor criterion to nominate an adjustment set, screens out colliders and mediators that would bias the estimate when conditioned on, and reports the assumptions the resulting estimate depends on. Triggers whenever the user proposes an observational treatment-effect claim, asks whether a specific covariate should be adjusted for, reports a Simpson-paradox-flavored sign flip, or hands over a study where confounding is plausible. Refuses to engage on randomized controlled trials where the randomization already breaks the confounding paths, and refuses to certify an effect estimate when the unverifiable assumptions are not stated.

Runs the standard diagnostic battery on a fitted linear or generalized linear regression model — linearity (residuals vs fitted), Normality of residuals (QQ-plot + Shapiro / Anderson-Darling), homoscedasticity (Breusch-Pagan or White, residuals-vs-fitted spread), autocorrelation (Durbin-Watson), leverage and Cook's distance for influential observations, and multicollinearity (VIF). Reports a per-diagnostic verdict with the consequence if the diagnostic fails and a routed remediation. Use whenever a linear / OLS / GLS / GLM regression has been fit and inference, confidence intervals, or coefficient interpretation are about to be reported, or the user asks 'are my regression diagnostics OK?'.

Audits a RAG pipeline's document-chunking strategy: chunk size, overlap, and splitter type (fixed-token, sentence, paragraph, semantic, structure-aware). Walks a chunk-size × overlap sweep against a held-out QA set, surfaces boundary-failure examples where the answer spans two chunks, and recommends a splitter that matches the document structure (legal contracts and long-form prose need different splitters than code or FAQ pairs). Use when retrieval recall is dropping on long documents, when chunks visibly cut answers in half, when chunk_size and overlap were copied from a tutorial without a sweep, or when migrating from a default fixed-token splitter to something structure-aware. Refuses to engage when the pipeline retrieves full documents (no chunking) or when the corpus is one-paragraph-per-doc (chunking is pre-empted by document structure).

Audits a deep-learning training run for overfit using train/validation loss gap, learning curves vs sample size, weight-norm growth across epochs, and effective-rank diagnostics, then distinguishes overfit from train/val distribution shift, label noise, and underfit. Use when training a deep network (CNN, RNN, Transformer, dense MLP) and validation loss diverges from training loss, when a model that "looked good" generalizes poorly to a held-out set, when deciding whether to add regularization or collect more data, or when triaging a failed training run. Refuses to apply the same diagnostics to classical ML (sklearn/XGBoost) where k-fold CV is the right tool, and refuses to call every train/val gap "overfit" without ruling out shift and label noise.

Audits a deployed RAG or retrieval system for embedding drift over time or across cohorts. Computes per-dimension Jensen-Shannon divergence, centroid cosine distance, and intra-cohort distance shift between a baseline cohort and a comparison cohort, with bootstrap 95% confidence intervals so small-sample wobble is not reported as drift, then attributes the drift to new content categories, upstream-data shift, or provider-side model re-versioning. Use when retrieval recall is eroding without a code change, when an embedding model has been re-versioned, when comparing two embedding cohorts (training vs production, old vs new ingest, region A vs B), or for a periodic drift check on a long-running RAG. Refuses on a single-time-point dataset (no second cohort) or when the user has already decided to swap embedding models wholesale (the right action is re-embed, not drift analysis).

Audits the inference-latency budget for a deployed ML model against a stated SLO — measures P50, P95, and P99 latency end-to-end and per-stage (tokenization or feature lookup, preprocessing, model forward, postprocessing, serialization), attributes the tail to the dominant per-stage contributor, and recommends ranked optimizations by latency-saved-per-engineering-hour. Triggers whenever a real-time inference service is breaching or about to breach its P95 / P99 SLO, whenever latency tail behavior is unexplained, whenever an input-shape distribution change is suspected of inflating the tail, or whenever pre-launch SLO sizing must be derived from a measured profile. Refuses to recommend optimizations without measured per-stage attribution and refuses to engage on batch / offline workloads where latency SLO does not apply (throughput optimization is the right skill).

Audits an Anthropic API prompt (system + user + tool definitions + tool results) for token budget pressure and prompt-cache hygiene. Tokenizes the full request, flags prompts above a configurable budget, detects duplicated boilerplate that should be moved to a cache_control segment, and recommends the right TTL (5m default vs 1h extended). Use whenever per-call cost is rising, latency is climbing on otherwise-identical prompts, the request payload is approaching the model context window, or when shipping any new agentic loop, RAG application, or multi-turn workflow. Refuses to engage on prompts under ~500 tokens (no meaningful budget pressure) and redirects raw-text re-tokenizing requests to the model's tokenizer directly.

Audits a post-RLHF (or post-DPO / post-RLAIF) policy model for reward hacking — the failure mode where the policy maximizes the learned reward model's score without actually satisfying the underlying human preference the reward model was supposed to encode. Probes for known reward-hacking patterns (length bias, sycophancy, formatting tricks, refusal-substitution, persuasion-over-correctness, reward-model exploitation at the distribution boundary), computes a pre-vs-post-RLHF preference-divergence metric, and produces a per-probe verdict table plus a remediation list. Use when an RLHF / DPO / RLAIF run has just completed, when downstream eval shows the post-RLHF model behaves worse on holdout preference data despite higher reward-model scores, when alignment-tax measurement is needed, or before promoting an RLHF checkpoint to production.

Audits a supervised fine-tuning (SFT) dataset before training across seven dimensions: schema and format validity, chat-template conformance, length-distribution sanity, duplicate detection (exact and near-duplicate), leakage against the held-out eval set, PII / sensitive-content detection with a user-supplied policy, and label-quality spot-check. Use when an SFT corpus has been assembled (scraped chats, synthetic demonstrations, human-annotated instructions, RLHF preference pairs converted to SFT) and the user is about to launch a fine-tune run. Refuses to certify the dataset without an explicit eval-set boundary and refuses to silently drop rows without a per-rule audit log.

Audits a synthetic dataset (SDG output) for membership-inference and record-linkage leakage from the real training set — runs a shadow-model MIA attack against the SDG, computes distance-to-closest-record (DCR) and nearest-neighbor distance ratio (NNDR) between synth and real-train, flags any exact / near-exact duplicates, and produces a release recommendation (publish / publish-with-DP / restrict / withhold). Triggers whenever the user intends to share, publish, or release synthetic tabular data derived from sensitive real data (PHI, PII, financial, customer records). Refuses to certify privacy on utility metrics alone, refuses to substitute k-anonymity-on-real for MIA-on-SDG, and hands off to auditing-synthetic-data-utility when the question is downstream-task fidelity rather than re-identification risk.

Audits a synthetic dataset (SDG output) for downstream-task utility against the real source data via the TSTR / TRTS / TRTR triangle — Train on Synthetic, Test on Real vs Train on Real, Test on Real vs Train on Real, Test on Synthetic. Reports per-metric utility ratio (synth / real), per-marginal KS / Wasserstein distance, pairwise-correlation Frobenius gap, and a downstream-task fidelity verdict (use-as-real / use-with-caveats / reject). Triggers whenever the user has generated tabular synthetic data via SDV / CTGAN / TVAE / Synthpop / Gretel / Mostly AI / private-DP-synth and is about to train or evaluate a model on it. Refuses to certify utility without a held-out REAL test set, refuses to lead with marginal-only fidelity (which masks correlation collapse), and hands off to auditing-synthetic-data-leakage when the question is privacy rather than utility.

Audits a train / test / validation split for leakage, stratification, group-aware violations, and temporal-order violations. Use when the user creates a train/test split, when classifier accuracy looks suspiciously high, when the same ID could appear in both train and test, when time-series data is split randomly instead of by date, or when group-aware data (multiple rows per patient / user / customer) is split row-wise.

Runs the appropriate assumption checks for a chosen statistical test (Shapiro-Wilk or Anderson-Darling for Normality, Levene or Brown-Forsythe for equal variance, QQ-plot for residuals, Cook's D for influence, expected-cell- count rule for chi-squared) and reports pass/fail per assumption with the evidence (test statistic + p-value) and the consequence if the assumption fails. Use whenever the user is about to run a parametric test, has just run one and wants to validate, or asks 'are the assumptions met?'.

Picks the right paired statistical test to compare two or more models head-to- head on the same test data, instead of eyeballing two unpaired metrics. For two classifiers on the SAME held-out test set: McNemar on the disagreement table (or DeLong for threshold-free ROC-AUC). For k-fold CV comparisons: paired t-test if per-fold diffs are roughly Normal, otherwise Wilcoxon signed- rank (Demsar 2006). For 3+ models: multiple-comparison correction (Bonferroni, Holm-Bonferroni, or Friedman + Nemenyi). Triggers when comparing candidate models, picking a deployment winner, when two metrics differ but their CIs overlap, or when the user reports a winner without a paired test. Refuses unpaired t-tests on per-fold metrics and refuses to skip correction with 3+ models.

Produces a complete binary-classifier evaluation report from y_true and y_pred_proba: ROC curve + PR curve + calibration plot + confusion matrix + threshold sweep + class-imbalance check + bootstrap 95% CI on each metric. Triggers whenever a trained binary classifier needs scoring, whenever class imbalance is suspected, whenever a metric is reported as bare accuracy on imbalanced data, or whenever threshold selection is needed. Refuses to lead with bare accuracy under imbalance and refuses to default to the 0.5 threshold without a sweep.

Produces a complete multi-class classifier evaluation report from y_true (integer or string labels, 3+ classes) and y_pred_proba (n_samples x n_classes matrix): per-class precision / recall / F1, macro-F1 + weighted-F1 + micro-F1, full K x K confusion matrix (counts plus row-normalized), top-k accuracy where k makes sense, one-vs-rest ROC and PR per class, per-class support, and class imbalance check. Triggers whenever a trained classifier has 3 or more labels (image classification across N categories, intent classification, multi-class vulnerability triage, ICD-code prediction). Refuses to lead with bare overall accuracy under imbalance, refuses to report only macro-F1 without naming whether macro or weighted matches the deployment cost model, and hands off to evaluating-binary-classifiers when the task is actually two-class.

Evaluates an out-of-distribution (OOD) detector on a held-out in-distribution set plus one or more curated OOD sets, using AUROC, AUPR-out, FPR-at-95-TPR, and near-OOD vs far-OOD stratification. Walks a method selection (max-softmax-probability, energy score, Mahalanobis distance, KNN distance, ODIN) and a calibration step. Use when deploying a classifier into an open-world setting where novel-class inputs arrive, when a safety reviewer requires "the model should know what it doesn't know", or when the model has a documented rejection / abstain pathway. Refuses to evaluate OOD detection in a closed-world setting where every test input is guaranteed in-distribution, and refuses to compare OOD detectors using only in- distribution accuracy.

Produces a complete evaluation report for a Retrieval-Augmented Generation (RAG) system from a golden Question-Answer set, separating retrieval-stage metrics (recall@k, MRR, nDCG@k) from generation-stage metrics (faithfulness, answer relevance, context utilization). Triggers whenever a RAG pipeline needs scoring, whenever the user reports the RAG "feels worse than direct LLM" but cannot localize where, whenever retrieval-vs-generation failure attribution is needed, or whenever a chunking or embedding-model change is being evaluated. Refuses to report a single aggregate score that conflates retrieval and generation failures.

Produces a complete regression-model evaluation report: RMSE + MAE + R² (with adjusted-R² for multi-feature models) + residual plots (residuals vs fitted, QQ-plot of residuals, residual histogram) + k-fold cross-validation (mean ± SD across folds). Triggers whenever a regression model needs scoring, whenever residual diagnostics are needed, whenever only R² is reported without RMSE / MAE, or whenever CV is missing. Refuses to report R² alone and refuses k-fold CV on time-series data (recommends walk-forward CV instead).

Adjudicates between two statistical tests applied to the same data that reach opposite conclusions — paired t versus Wilcoxon signed-rank, two- sample t versus Mann-Whitney, McNemar versus exact binomial sign, chi- squared versus Fisher, parametric ANOVA versus Kruskal-Wallis — by building an assumption-status table for both tests, identifying which assumptions actually hold, and committing to a single winner with named reasoning. Refuses to wave both results around as 'mixed evidence' or to keep switching tests until one is significant (p-hacking). Use whenever two tests on the same data disagree on the null-hypothesis verdict, the user asks which p-value to report, or a reviewer has flagged conflicting results in a manuscript.

Builds a per-feature data-drift monitor for a deployed ML model — population stability index (PSI) and Kolmogorov-Smirnov for continuous features, chi-squared / Jensen-Shannon for categorical features, with a documented reference window, alerting thresholds calibrated against baseline noise, and attribution to the top drifting features. Triggers whenever a production model has been live long enough to accumulate at least one reference window of inference traffic, whenever the user suspects upstream data has shifted, whenever feature ranges look different from training, or whenever model performance erodes without a known cause and the drift hypothesis must be tested before retraining. Refuses to set fixed alert thresholds without a baseline-noise calibration and refuses to engage on pre-deployment systems where no inference traffic exists yet.

Builds a prediction-side drift monitor for a deployed ML model — tracks the predicted-score distribution, calibration over time (reliability curve slope and intercept), and per-segment performance erosion (AUC / F1 / precision-recall by cohort). Triggers whenever a production model has accumulated live predictions plus labels for at least one labeling-delay-aware evaluation window, whenever performance metrics suggest erosion but the input features look stable, whenever predicted scores look unusually high or low, or whenever per-segment fairness or accuracy must be tracked over time. Refuses to interpret calibration without a labeling-delay-aware window and refuses to engage on pre-deployment systems where no live predictions exist yet.

Profiles the per-call and per-task cost of an LLM-powered application by building a token-cost rollup from logged traces: input tokens, output tokens, cached vs. uncached input tokens, model tier, and downstream calls. Produces a $ / task figure with attribution (which step burns the most), a cache-hit rate trend, and a list of the highest-leverage cost-reduction opportunities. Triggers whenever production LLM cost is exceeding budget, whenever the user reports a sudden cost spike with no obvious traffic change, whenever prompt-cache hit rate is dropping, or whenever an agentic system's $-per-task is unknown and needs to be measured before optimization. Refuses to recommend cost-cutting actions without a measured baseline.

Runs a structured adversarial-perturbation robustness suite (FGSM, PGD, AutoAttack) against a trained vision or tabular classifier under a declared threat model (L-infinity / L2 / L0, white-box / black-box, targeted / untargeted, epsilon budget, iteration count). Produces a clean-accuracy vs robust-accuracy table per attack, an attack-success-rate breakdown, and a saved set of adversarial examples for inspection. Use when a deployed or pre-deployment vision / tabular model needs an adversarial-robustness measurement, when a regulator or downstream team asks for a robustness number, or when the user reports high clean accuracy and wants to know whether the model is brittle to small input perturbations. Refuses to engage on LLM prompt-injection or text-jailbreak scenarios (different attack surface, no continuous gradient — hand off to security/running-prompt-injection-eval).