kiro-rails

星标8

分支1

更新时间2026年7月17日 11:28

Index of the kiro-rails engineering toolbox in this repo: every review command, spec workflow, subagent, and steering rule, with when to use each. Load this to decide which review or workflow to run, or to discover what kiro-rails offers. Routing only - each entry points at its own command, skill, or agent.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

来源

sourjya

sourjya/kiro-rails

打开 GitHub 仓库查看创作者相关仓库

下载

kiro-rails toolbox

GENERATED by scripts/export-to-claude.sh from .kiro/ - do not edit by hand. This is a routing index: it points you at the right command, skill, agent, or steering section; it does not do the work itself. The full source→target map with fidelity grades is in docs/references/kiro-claude-sync-ledger.md.

Review commands

Invoke as /<name>. Each audits one dimension; see the "Periodic Review Policy" section of CLAUDE.md for when each triggers and the recommended sequencing.

/review-ai-agent-surface - Audit the AI and agent attack surface: prompt injection, tool-permission scope, unbounded agent loops, and unsafe handling of model output. Produces an AISR report.
/review-api-contracts - Audit API boundary code for contract drift: response envelope consistency, error response shapes, HTTP status-code semantics, and frontend/backend type agreement.
/review-cicd-pipeline - Audit CI/CD pipelines for missing quality gates, unpinned actions, secret exposure in logs, and deploy steps that can run without passing tests.
/review-code-maintainability - Structural maintainability audit: god objects, hidden coupling, dead code, comment-standard compliance, and drift from documented architecture. Produces an MRR report.
/review-code-security - Tiered application security audit (T1 pre-commit, T2 feature complete, T3 sprint end) covering OWASP, secrets, authorization, crypto quality, and supply chain. Produces an SRR report.
/review-commit-pr-discipline - Review the current branch's commits and working tree for commit and pull-request discipline, then produce well-structured commit messages and a PR description.
/review-css-architecture - Audit CSS and design-token usage against the console-idiom rubric: ad hoc overrides, magic values, duplicated spacing scales, and design-system drift.
/review-dependency-risk - Audit dependency manifests for supply-chain risk: unmaintained or typosquatted packages, license conflicts, unpinned versions, and known vulnerabilities.
/review-frontend-performance - Audit frontend performance: bundle size and code splitting, render waterfalls, N+1 data fetching, unmemoized work, and lazy-loading gaps.
/review-hardcoded-values - Scan for embedded literals that belong in config or a constants module: URLs, magic numbers, thresholds, error message strings, and environment-dependent values.
/review-iac-consistency - Audit infrastructure-as-code for per-environment drift, over-permissive IAM policies, unencrypted resources, and infrastructure changed outside version control.
/review-observability - Audit logging, metrics, tracing, and correlation IDs across pipelines and background jobs. Flags blackbox code paths that emit no telemetry and cannot be debugged in production.
/review-spec-readiness - Grade a Kiro spec (requirements, design, tasks) against the spec quality standards before implementation begins. Flags thin specs that will cause rework.
/review-test-quality - Audit test suite quality: coverage gaps, weak assertions, missing negative cases, over-mocking, and tests that cannot fail regardless of implementation.
/review-ux-audit - Full UX audit of a frontend codebase. Produces persona cards, journey maps, heuristic sweep, anti-pattern findings, and a prioritized fix register formatted for Kiro spec output.
/review-ux-live - Live browser-walk UX review using the console-idiom rubric. Requires a browser MCP (Playwright, Chrome DevTools, or equivalent). Walks each page/route with a 9-step protocol, collects quantitative evidence, and produces a scored report with rubric IDs.
/review-ux-preflight - Pre-implementation UX gate. Run before coding any UI feature to validate layout decisions, interaction placement, and hierarchy. Produces a PROCEED/REVISE/BLOCK decision.

Skills

Invoke by name (the model also auto-surfaces them by their triggers).

auth-implementation - Authentication, SSO, OAuth, OIDC, login, redirect, token implementation patterns. Use when implementing auth flows, login pages, token refresh, SSO integration, or redirect handling.
incident-response - Security incident response, breach containment, evidence preservation, and recovery verification. Use when a breach, compromise, or security incident is detected or suspected.
review-guide - Interactive guide to kiro-rails review prompts, agents, and tools. Explains which review to run, when, and why. Invoke with /review-guide or ask "what reviews should I run?", "which prompt?", or "how do I audit?".
spec-archive - Archive a completed and verified spec. Moves it from active specs to the docs archive, updates the spec registry. Use after spec-verify passes.
spec-implement - Implement a proposed spec. Reads the spec folder, follows the task checklist, writes code using TDD. Use after spec-propose is complete and approved.
spec-propose - Propose a new feature or change. Creates a structured spec folder with proposal, requirements, design, and tasks before any code is written. Use when starting new work.
spec-verify - Verify a completed implementation against its spec. Checks all acceptance criteria, runs tests, validates coverage. Use after spec-implement is done.

Subagents

Spawn via the Agent/Task tool for restricted, focused work (most are read-only).

code-security-reviewer - Performs structured code security and quality audits with restricted tool access. Supports tiered review (T1 pre-commit, T2 feature, T3 sprint).
security-verifier - Adversarial verification agent. Assumes each security finding is a false positive and searches for compensating controls that disprove it. Use after the code-security-reviewer produces findings.
ux-red-team - Hostile UX reviewer. Assumes the implementation is flawed. Finds friction, hierarchy issues, accessibility gaps, pointer travel problems, and pattern violations. Read-only - cannot modify code.
ux-reviewer - Performs live browser-walk UX audits using the console-idiom rubric. Restricted to read-only browser interaction - no writes, deletes, or submissions. Requires a browser MCP.

Spec-driven workflow

For feature-sized work (a new capability, multi-file/multi-layer, new endpoints/models/UI), follow the Kiro spec cycle rather than coding ad hoc: spec-propose → spec-implement → spec-verify → spec-archive (the skills above). Specs live under .kiro/specs/.

Engineering rules (always loaded)

Every steering rule is concatenated into CLAUDE.md. Start with Agent Boundaries (the hard stops), then Git & Focus Discipline, Change Discipline, Testing Standards, and Database Conventions. The review commands above exist to enforce these rules.

同仓库更多 Skills

同仓库

incident-response

sourjya/kiro-rails

Security incident response, breach containment, evidence preservation, and recovery verification. Use when a breach, compromise, or security incident is detected or suspected.

2026-07-088

review-guide

sourjya/kiro-rails

Interactive guide to kiro-rails review prompts, agents, and tools. Explains which review to run, when, and why. Invoke with /review-guide or ask "what reviews should I run?", "which prompt?", or "how do I audit?".

2026-07-088

auth-implementation

sourjya/kiro-rails

Authentication, SSO, OAuth, OIDC, login, redirect, token implementation patterns. Use when implementing auth flows, login pages, token refresh, SSO integration, or redirect handling.

2026-06-058

spec-archive

sourjya/kiro-rails

Archive a completed and verified spec. Moves it from active specs to the docs archive, updates the spec registry. Use after spec-verify passes.

2026-06-058

spec-implement

sourjya/kiro-rails

Implement a proposed spec. Reads the spec folder, follows the task checklist, writes code using TDD. Use after spec-propose is complete and approved.

2026-06-058

spec-propose

sourjya/kiro-rails

Propose a new feature or change. Creates a structured spec folder with proposal, requirements, design, and tasks before any code is written. Use when starting new work.

2026-06-058

name	kiro-rails
description	Index of the kiro-rails engineering toolbox in this repo: every review command, spec workflow, subagent, and steering rule, with when to use each. Load this to decide which review or workflow to run, or to discover what kiro-rails offers. Routing only - each entry points at its own command, skill, or agent.

kiro-rails toolbox

Review commands

Invoke as /<name>. Each audits one dimension; see the "Periodic Review Policy" section of CLAUDE.md for when each triggers and the recommended sequencing.

/review-ai-agent-surface - Audit the AI and agent attack surface: prompt injection, tool-permission scope, unbounded agent loops, and unsafe handling of model output. Produces an AISR report.
/review-api-contracts - Audit API boundary code for contract drift: response envelope consistency, error response shapes, HTTP status-code semantics, and frontend/backend type agreement.
/review-cicd-pipeline - Audit CI/CD pipelines for missing quality gates, unpinned actions, secret exposure in logs, and deploy steps that can run without passing tests.
/review-code-maintainability - Structural maintainability audit: god objects, hidden coupling, dead code, comment-standard compliance, and drift from documented architecture. Produces an MRR report.
/review-code-security - Tiered application security audit (T1 pre-commit, T2 feature complete, T3 sprint end) covering OWASP, secrets, authorization, crypto quality, and supply chain. Produces an SRR report.
/review-commit-pr-discipline - Review the current branch's commits and working tree for commit and pull-request discipline, then produce well-structured commit messages and a PR description.
/review-css-architecture - Audit CSS and design-token usage against the console-idiom rubric: ad hoc overrides, magic values, duplicated spacing scales, and design-system drift.
/review-dependency-risk - Audit dependency manifests for supply-chain risk: unmaintained or typosquatted packages, license conflicts, unpinned versions, and known vulnerabilities.
/review-frontend-performance - Audit frontend performance: bundle size and code splitting, render waterfalls, N+1 data fetching, unmemoized work, and lazy-loading gaps.
/review-hardcoded-values - Scan for embedded literals that belong in config or a constants module: URLs, magic numbers, thresholds, error message strings, and environment-dependent values.
/review-iac-consistency - Audit infrastructure-as-code for per-environment drift, over-permissive IAM policies, unencrypted resources, and infrastructure changed outside version control.
/review-observability - Audit logging, metrics, tracing, and correlation IDs across pipelines and background jobs. Flags blackbox code paths that emit no telemetry and cannot be debugged in production.
/review-spec-readiness - Grade a Kiro spec (requirements, design, tasks) against the spec quality standards before implementation begins. Flags thin specs that will cause rework.
/review-test-quality - Audit test suite quality: coverage gaps, weak assertions, missing negative cases, over-mocking, and tests that cannot fail regardless of implementation.
/review-ux-audit - Full UX audit of a frontend codebase. Produces persona cards, journey maps, heuristic sweep, anti-pattern findings, and a prioritized fix register formatted for Kiro spec output.
/review-ux-live - Live browser-walk UX review using the console-idiom rubric. Requires a browser MCP (Playwright, Chrome DevTools, or equivalent). Walks each page/route with a 9-step protocol, collects quantitative evidence, and produces a scored report with rubric IDs.
/review-ux-preflight - Pre-implementation UX gate. Run before coding any UI feature to validate layout decisions, interaction placement, and hierarchy. Produces a PROCEED/REVISE/BLOCK decision.

Skills

Invoke by name (the model also auto-surfaces them by their triggers).

auth-implementation - Authentication, SSO, OAuth, OIDC, login, redirect, token implementation patterns. Use when implementing auth flows, login pages, token refresh, SSO integration, or redirect handling.
incident-response - Security incident response, breach containment, evidence preservation, and recovery verification. Use when a breach, compromise, or security incident is detected or suspected.
review-guide - Interactive guide to kiro-rails review prompts, agents, and tools. Explains which review to run, when, and why. Invoke with /review-guide or ask "what reviews should I run?", "which prompt?", or "how do I audit?".
spec-archive - Archive a completed and verified spec. Moves it from active specs to the docs archive, updates the spec registry. Use after spec-verify passes.
spec-implement - Implement a proposed spec. Reads the spec folder, follows the task checklist, writes code using TDD. Use after spec-propose is complete and approved.
spec-propose - Propose a new feature or change. Creates a structured spec folder with proposal, requirements, design, and tasks before any code is written. Use when starting new work.
spec-verify - Verify a completed implementation against its spec. Checks all acceptance criteria, runs tests, validates coverage. Use after spec-implement is done.

Subagents

Spawn via the Agent/Task tool for restricted, focused work (most are read-only).

code-security-reviewer - Performs structured code security and quality audits with restricted tool access. Supports tiered review (T1 pre-commit, T2 feature, T3 sprint).
security-verifier - Adversarial verification agent. Assumes each security finding is a false positive and searches for compensating controls that disprove it. Use after the code-security-reviewer produces findings.
ux-red-team - Hostile UX reviewer. Assumes the implementation is flawed. Finds friction, hierarchy issues, accessibility gaps, pointer travel problems, and pattern violations. Read-only - cannot modify code.
ux-reviewer - Performs live browser-walk UX audits using the console-idiom rubric. Restricted to read-only browser interaction - no writes, deletes, or submissions. Requires a browser MCP.