claude-code-skills-distilled

Use when an AI agent has been compromised, behaved unexpectedly, executed unauthorized actions, or may have had credentials exposed. Use when CLAUDE.md was modified without authorization, a skill executed a malicious payload, an agent accessed files outside its scope, or suspicious tool calls were detected. Triggers: "agent compromised", "agent behaved unexpectedly", "suspicious agent behavior", "CLAUDE.md modified", "skill executed payload", "agent accessed credentials", "unauthorized tool calls", "agent incident", "agent compromise response", "agent forensics", "credential exposed by agent", "agent wrote unexpected files", "memory poisoned", "hook fired", "agent anomaly".

Use when auditing AI/LLM systems for security vulnerabilities, reviewing prompt injection risks, auditing MCP server tool integrations, assessing AI agent behavioral drift, reviewing credential scoping for agents, or designing safe agentic systems. Triggers: "AI security", "LLM security", "prompt injection", "tool abuse", "MCP security", "agent security", "behavioral drift", "AI agent audit", "insecure plugin", "agentic threat", "LLM threat", "indirect injection", "credential exposure", "excessive agency".

Use when implementing animations, transitions, hover effects, page transitions, exit animations, scroll-linked animations, drag interactions, or motion design in React/Next.js. Triggers: "animation", "animate", "framer motion", "motion", "transition", "hover effect", "page transition", "AnimatePresence", "spring physics", "micro-interaction", "scroll animation", "exit animation", "layout animation", "shared element transition", "gesture".

Use when designing APIs, defining interfaces, choosing between REST and alternatives, applying Hyrum's Law, designing resilience patterns (circuit breaker, retry with backoff, health checks), writing API contracts, or reviewing API design for consistency and correctness. Triggers: "design an API", "API design", "REST API", "interface design", "HTTP endpoints", "contract-first", "Hyrum's Law", "circuit breaker", "retry logic", "health check endpoint".

Use when diagnosing slow API responses, fixing N+1 query problems, optimizing database queries, adding indexes, debugging memory leaks, profiling server-side code, setting API latency budgets, or detecting performance regressions. Triggers: "slow API", "slow query", "N+1", "database performance", "N+1 queries", "memory leak", "backend performance", "profiling", "API latency", "EXPLAIN plan", "missing index", "unbounded fetch".

Use when transcribing video audio, generating visual descriptions from video frames, or creating rough cut edit sequences from video footage. A three-phase AI-assisted video editing workflow: transcribe audio with WhisperX, analyze frames with FFmpeg, create rough cut YAML for Buttercut. Triggers: "Buttercut", "rough cut", "video rough cut", "video transcription", "WhisperX", "video analysis", "visual transcript", "video sequence", "video scene", "Final Cut Pro XML", "video editing workflow", "video footage".

Use when reviewing code, giving feedback on a PR, auditing a codebase for quality problems, or evaluating code before submitting. Triggers: "review this", "code review", "review this PR", "give me feedback on this code", "audit this code", "what's wrong with this", "is this implementation good", "critique this", "check this for issues".

Use when evaluating whether code meets quality standards, checking naming conventions, assessing complexity thresholds, identifying anti-patterns, understanding what good code looks like, or applying quality standards to your own code before submitting. Triggers: "is this code good", "code quality", "does this follow best practices", "naming conventions", "is this too complex", "code standards", "what makes good code", "anti-patterns".

Use when making implementation decisions, deciding how to structure code, choosing between simple and clever approaches, managing dependencies, applying 12-factor principles, handling destructive operations safely, or applying incremental delivery discipline. Use when starting to implement a feature and needing a guiding framework for day-to-day coding decisions. Triggers: "how should I write this", "should I abstract this", "is this too complex", "what dependencies should I use", "incremental delivery", "simplicity", "YAGNI".

Use when preparing for SOC 2 Type I or Type II audits, implementing ISO 27001 ISMS, achieving GDPR compliance, conducting gap analysis against compliance frameworks, mapping controls to audit criteria, collecting and automating audit evidence, designing continuous compliance monitoring, or managing vendor risk assessments. Apply to SaaS companies, regulated industries, or any organization requiring third-party security or privacy assurance.

Use when designing or building data pipelines, ETL/ELT workflows, or data infrastructure. Use when implementing data quality checks, schema validation, or deduplication. Use when modeling data for analytics (fact/dimension tables, star schema), setting up orchestration with Airflow or dbt, troubleshooting pipeline failures, or instrumenting analytics events. Triggers: "data pipeline", "ETL", "ELT", "batch job", "streaming", "data quality", "dbt", "Airflow", "data model", "star schema", "analytics events", "event tracking".

Use when designing relational database schemas from requirements, normalizing existing schemas, planning zero-downtime migrations for large tables, implementing multi-tenancy patterns, designing audit trails or soft-delete strategies, configuring row-level security (RLS), planning index strategies, or generating TypeScript/Python types from schema. Use for schema normalization, relationship design, migration planning, index optimization, and data integrity.

Use when encountering any bug, test failure, build error, unexpected behavior, or production incident. Use before proposing any fix — diagnosis must precede solution. Triggers: "bug", "broken", "failing test", "unexpected behavior", "error", "not working", "production incident", "why is this happening", "help me debug", "exception", "crash", "race condition", "flaky test".

Use when configuring CI/CD pipelines, deploying to production, implementing feature flags, monitoring canary releases, setting up GitHub Actions, managing rollbacks, configuring observability for deployments, or responding to production incidents. Triggers: "deploy", "CI/CD", "pipeline", "release", "feature flag", "canary", "rollback", "GitHub Actions", "ship", "production", "incident", "monitoring deployment", "deployment strategy".

Use when establishing a design system, choosing color palettes, defining typography, creating design tokens, setting spacing standards, writing a DESIGN.md document, or making foundational visual design decisions for a product. Triggers: "design system", "color palette", "typography", "design tokens", "brand", "visual design", "DESIGN.md", "spacing system", "what colors should I use", "font choice", "design language", "visual theme".

Use when reading, creating, editing, merging, splitting, or extracting content from PDF files or Excel/spreadsheet files. Use when processing tabular data, building financial models in Excel, extracting text from scanned documents, or converting between document formats. Triggers: "PDF", "Excel", "spreadsheet", "xlsx", "pypdf", "pdfplumber", "reportlab", "openpyxl", "pandas", "document processing", "extract text from PDF", "merge PDF", "split PDF", "financial model", "OCR", "spreadsheet automation".

Use when writing end-to-end tests, browser automation with Playwright, integration tests hitting real databases, API integration testing, testing complete user flows, managing test data lifecycle, or applying property-based testing. Triggers: "e2e test", "end-to-end", "Playwright", "browser test", "integration test", "user flow test", "API test", "test data", "Cypress", "property-based testing", "fuzz testing".

Use when building mobile or universal apps with Expo and Expo Router. Covers file-based routing, native tabs, form sheets, Reanimated animations, scroll-driven effects, media handling, storage patterns, visual effects (blur, glass), 3D graphics, and platform- specific design patterns for iOS and Android. Triggers: "Expo", "Expo Router", "React Native UI", "native tabs", "form sheet", "native navigation", "Expo app", "mobile UI", "React Native animations", "expo-image", "native modal", "Reanimated", "expo-blur", "expo-sqlite", "SF Symbols", "Apple design".

Use when setting up or using Tailwind CSS in Expo or React Native projects with NativeWind v5 and react-native-css for universal styling across iOS, Android, and web. Covers Metro config setup, PostCSS configuration, CSS component wrappers, platform-specific styles, Apple system colors, and dark mode. Triggers: "NativeWind", "Tailwind Expo", "Tailwind React Native", "react-native-css", "Tailwind mobile", "Expo Tailwind setup", "NativeWind v5", "Tailwind v4 Expo", "universal styling", "Tailwind iOS", "Tailwind Android".

Use when starting a new feature, clarifying requirements before writing code, deciding scope, creating a vertical slice delivery plan, or determining what not to build. Triggers: "plan this feature", "how should I approach", "what should we build", "clarify requirements", "break this down", "scope this", "what's the MVP", "where do I start", "think before coding".

Use when optimizing frontend performance, improving Core Web Vitals (LCP, INP, CLS), reducing JavaScript bundle size, fixing slow page loads, debugging React re-renders, implementing performance budgets, or setting up Lighthouse CI. Triggers: "slow page", "LCP", "INP", "CLS", "Core Web Vitals", "bundle size", "frontend performance", "re-renders", "Lighthouse", "page load", "large bundle", "layout shift", "interaction delay".

Use when committing code, creating or managing branches, using git worktrees for parallel work, cleaning up merged branches, finishing a development branch, or applying trunk-based development discipline. Triggers: "commit", "branch", "git", "merge", "PR", "pull request", "worktree", "git cleanup", "stale branches", "squash merge", "how to commit", "commit message".

Use when needing to reduce LLM API spend, audit token usage, route tasks to cheaper models, implement prompt caching, batch LLM requests, track cost per feature or user, or design cost governance for AI products. Triggers: "LLM costs", "token usage", "reduce AI spend", "model routing", "prompt caching", "cost per request", "LLM bill", "cheaper model", "batch API calls", "cost optimization", "AI budget".

Use when auditing MCP server configurations for poisoned tool descriptions, malicious tool registrations, or exfiltration channels. Use when reviewing agent config files before adding a new MCP server, auditing live tool descriptions served by an MCP endpoint, or investigating suspicious tool behavior at runtime. Triggers: "MCP audit", "MCP poisoning", "tool description attack", "MCP config review", "tool shadowing", "rug pull", "HashJack", "MPMA", "MCP exfiltration", "mcp.json audit", "tool description injection", "cross-tool escalation", "MCP security", "audit MCP tools", "scan MCP", "MCP server review", "tool poisoning", "claude.json audit", "AgentSeal scan-mcp".

Use when building MCP (Model Context Protocol) servers to expose tools, resources, or prompts to LLMs. Use when designing tool schemas, implementing TypeScript or Python MCP servers, writing tool descriptions for discoverability, creating evaluations for MCP effectiveness, or debugging MCP integrations. Triggers: "MCP server", "model context protocol", "build MCP", "MCP tool", "MCP development", "Claude tool", "tool server", "MCP SDK", "function calling server", "create MCP", "MCP integration".

Use when facing 2+ tasks that can be decomposed and delegated to subagents, when coordinating parallel workstreams across a codebase, when executing implementation plans with independent tasks, or when multiple agents need to work in the same repository without conflicts. Triggers: "run in parallel", "dispatch agents", "subagent", "parallel tasks", "agent coordination", "orchestrate", "multiple agents", "swarm", "worker agents", "concurrent work".

Use when setting up monitoring, logging, tracing, or instrumentation for a production service, adding observability to a new service, debugging a production incident without enough visibility, designing alerting rules, reducing alert fatigue, or building oncall dashboards. Triggers: "observability", "monitoring", "logging", "tracing", "OpenTelemetry", "metrics", "alerting", "dashboard", "distributed tracing", "structured logs", "oncall", "no visibility into".

Use when performing authorized penetration testing, CTF challenges, red team exercises, or security research. Triggers on: pentest, CTF, red team, OSCP, hack the box, privilege escalation, privesc, lateral movement, active directory attack, AD attack, Kerberoasting, ASREPRoasting, BloodHound, Mimikatz, credential dumping, DCSync, pass-the-hash, enumeration, recon, OSINT, web app attack, SQLi, XSS, SSRF, LFI, file upload bypass, password cracking, hashcat, password spray, persistence backdoor, container escape, docker escape, cloud misconfiguration, AWS IAM escalation, Kubernetes attack.

Use when optimizing prompts for clarity or performance, designing reusable prompt templates, implementing few-shot or chain-of-thought patterns, evaluating LLM output quality, versioning and A/B testing prompts, designing system prompts for AI agents, or establishing prompt governance. Use for prompt optimization, LLM evaluation frameworks, structured output design, agent system prompt design, and ReAct/Plan-Execute reasoning patterns.

Use when testing a system prompt against adversarial attack probes, measuring prompt robustness with a 0-100 trust score, or identifying which prompt injection or extraction techniques succeed against a given AI configuration. Use when red-teaming an AI assistant's system prompt, validating injection defenses before production deployment, or reproducing a reported prompt injection. Triggers: "test system prompt", "prompt robustness", "jailbreak test", "trust score", "prompt red team", "extraction probe", "injection probe", "DAN test", "EchoLeak", "skeleton key", "system prompt leakage", "prompt injection test", "adversarial probe", "BiDi injection", "many-shot priming", "canary test", "AgentSeal scan", "instruction override test", "delimiter attack", "prompt security test".

Use when building retrieval-augmented generation (RAG) pipelines, implementing vector search, choosing embedding models or vector databases, optimizing retrieval strategies, evaluating RAG quality (faithfulness, relevance, groundedness), or debugging RAG failures like hallucination, retrieval miss, or context overflow. Use for document chunking, hybrid search, reranking, context window optimization, and RAG evaluation with RAGAS or similar frameworks.

Use when improving code structure, readability, or testability without changing behavior. Apply when functions are too long, code is duplicated across files, names don't match intent, dependencies are tangled, tests are hard to write, or preparing for a large rewrite using the strangler fig pattern. Triggers: code smells (long method, feature envy, data clumps, primitive obsession), "hard to understand", "hard to change", "hard to test", "clean this up".

Use when creating programmatic videos using React and Remotion — composing video from React components, animating with useCurrentFrame and interpolate, adding transitions, handling audio, rendering to MP4, or integrating video assets. Triggers: "Remotion", "programmatic video", "video in React", "React to MP4", "video composition", "video animation", "render video", "Remotion composition", "frame-based animation", "useCurrentFrame", "interpolate Remotion", "TransitionSeries", "video rendering".

Use when hardening application configuration, implementing security headers, adding rate limiting, managing secrets and environment variables, auditing dependencies for vulnerabilities, assessing supply chain risk, responding to leaked secrets, or implementing defense-in-depth architecture. Triggers: "harden", "security headers", "CSP", "HSTS", "rate limiting", "secrets management", "dependency audit", "npm audit", "supply chain", "leaked secret".

Use when auditing code for security vulnerabilities, running static analysis with Semgrep or CodeQL, reviewing against OWASP Top 10:2025, performing variant analysis after a finding, checking constant-time cryptographic code, auditing input validation, authentication, session management, or reviewing for insecure defaults and sharp edges. Triggers: "security audit", "security review", "OWASP", "vulnerability", "static analysis", "semgrep", "injection", "SQL injection", "XSS", "auth vulnerability", "insecure default".

Use when creating a new Claude Code skill, editing or improving an existing skill, reviewing skill quality for discoverability and behavioral impact, structuring skills with subagent delegation, progressive disclosure, or phased execution. Triggers: "create a skill", "new skill", "edit skill", "skill quality", "SKILL.md", "skill description", "skill trigger", "CSO", "skill anatomy", "when to create a skill".

Use when scanning Claude Code skill files on disk for malicious payloads, backdoors, or supply-chain attacks embedded in SKILL.md or bundled scripts. Use when auditing a skill before installing it, reviewing third-party skills for trustworthiness, or investigating suspicious agent behavior after skill installation. Triggers: "scan skills", "dangerous skill", "skill audit", "skill backdoor", "CLAUDE.md poisoning", "memory poison", "skill supply chain", "hook exploit", "conftest RCE", "postinstall hook", "symlink exfiltration", "skill payload", "skill malware", "skill integrity check", "skill security", "audit skills", "skill scanner", "dangerous-skills", "warden scan".

Use when designing system architecture, making architectural decisions, writing Architecture Decision Records (ADRs), applying Domain-Driven Design (DDD) patterns, decomposing a system into bounded contexts or services, designing component boundaries and interfaces, evaluating architectural trade-offs, or planning a major technical direction change. Triggers: "design the architecture", "system design", "ADR", "bounded context", "how should I structure the system", "microservices vs monolith", "event-driven", "trade-offs".

Use when writing unit tests, practicing test-driven development, fixing bugs with the Prove-It Pattern, applying RED-GREEN-REFACTOR discipline, choosing between mocks and stubs, designing the test pyramid, running mutation testing, or verifying test coverage. Triggers: "write tests", "TDD", "unit test", "test this function", "RED-GREEN-REFACTOR", "failing test", "mock vs stub", "test coverage", "test pyramid", "mutation testing".

Use when integrating with external APIs, payment processors (Stripe), webhooks, or third-party services. Use when implementing API clients with authentication and rate limiting, handling webhooks with signature verification and idempotency, writing contract tests for external services, or isolating third-party dependencies behind adapters. Triggers: "Stripe", "payment integration", "webhook", "third-party API", "external service", "API client", "integrate with", "signature verification", "idempotency key".