All authors
Claude Skills by adnanmokhtar
github.com/adnanmokhtar258 skills0 installs0 views
- Launch ReadinessLaunch gate per feature and repo readiness scorecard: 21 cumulative bronze/silver/gold rules, typed evidence, never PASS by default.Votes: 0GitHub stars: 2
- Tracking Plan ScanAnalytics detector: event vs tracking-plan drift, name and property drift, conversions fired early, duplicate fires.Votes: 0GitHub stars: 2
- Ci Security ScanCI workflows as attack surface on six platforms — untrusted code in privileged jobs, expression injection, unpinned deps by token scope, secrets, runners.Votes: 0GitHub stars: 2
- Data Exposure ScanInformation leakage — stack traces and raw errors in responses, debug and admin endpoints reachable in prod, over-returning serializers, account enumeration, secrets and PII in logs, fingerprinting headers, cacheable private responses, and exposed internal files.Votes: 0GitHub stars: 2
- Deps AuditRun the ecosystem's dependency audit (npm / pip / cargo / composer / go) and triage the findings, separating blockers from noise. Run before every release, after a fresh install, when a new advisory lands, and weekly in CI. Scans the manifest and lockfile — `release-security` is what scans the built container image's OS layer.Votes: 0GitHub stars: 2
- File Access ScanFile upload and file read surface — type by magic bytes, size caps, storage outside webroot, served content-type, SVG/HTML/polyglot, archive extraction (zip-slip), path traversal and LFI on every read/download, symlinks, and download IDOR.Votes: 0GitHub stars: 2
- Iac ScanInfrastructure files as attack surface — Dockerfiles, compose, Kubernetes, Terraform, CI workflows and reverse-proxy configs: root containers, exposed ports and dashboards, secrets in images or env, wildcard IAM, public buckets, script injection in CI, missing TLS and headers at the edge.Votes: 0GitHub stars: 2
- Injection ScanSource-to-sink taint trace for every interpreter sink — SQL/NoSQL, OS command, code eval, template (SSTI), XML (XXE), LDAP/XPath, header/log injection, unsafe deserialization, prototype pollution, ReDoS, CSV/spreadsheet formula injection. Every finding cites the sink, the tainted source and the fix.Votes: 0GitHub stars: 2
- Llm Trust ScanLLM trust boundary: untrusted text in privileged roles, tool authority, output exfil, provider data, tracing, RAG scope.Votes: 0GitHub stars: 2
- Logic Race ScanFlaws no pattern scanner sees — client-trusted prices and quantities, skippable workflow steps, negative and overflow values, missing idempotency, check-then-act races (double spend, double redeem), and a per-role authorization matrix proved route by route.Votes: 0GitHub stars: 2
- Mcp Server ScanMCP servers and client configs: token audience, Origin and bind, URL opening, tool poisoning, scopes, tenancy, sessions.Votes: 0GitHub stars: 2
- Mobile Security ScanOn-device security for Android, iOS, React Native and Flutter — storage, transport, IPC, links, WebViews, release flags, shipped secrets.Votes: 0GitHub stars: 2
- Sast ScanRuns the static analyzers that exist for the stack — semgrep, the language's security linter, gitleaks — records every tool as RAN or SKIPPED, and triages each hit to a confirmed file:line finding or a cited false positive. A tool that did not run is a coverage gap, never a pass.Votes: 0GitHub stars: 2
- Secret Scan MethodScan the repo including git history for leaked secrets — API keys, tokens, private keys, credentials. Run before any first push to a public remote, immediately after a committed-`.env` event, in CI on every PR, and as a quarterly full-history sweep. This skill is the detection primitive; `/secret-scan` is the remediation session that owns rotation playbooks, the history scrub and the persisted report.Votes: 0GitHub stars: 2
- Ssrf ScanStatic taint-trace for URL-shaped sinks — user-controlled URL reaching an outbound fetch with no allow-list, unblocked internal/metadata ranges, hostname validated but not the resolved IP (DNS rebinding), followed redirects, dangerous URL schemes, reachable IMDSv1, and user-controlled redirect targets (open redirector). Run on any endpoint that fetches a user-supplied URL, unfurls a link, imports from a URL, registers a webhook, or bounces the browser to a URL from a query parameter. Not a de...Votes: 0GitHub stars: 2
- Threat Model MethodSystematic threat modeling via STRIDE — identify threats per component before attackers do. Run at design time, not after incident. This skill is the dispatchable primitive (agents invoke it); `/threat-model` is the session that turns its output into a durable artifact with ADRs, residual risk and re-audit triggers.Votes: 0GitHub stars: 2
- Xss ScanBrowser-side injection and client exposure — raw-HTML sinks in every frontend framework, URL-scheme sinks, DOM sinks, postMessage, CSP and frame-ancestors, CSRF, tokens in web storage, secrets and source maps shipped in the client bundle.Votes: 0GitHub stars: 2
- Assertion Strength ScanFind tests that cannot fail — no or weak oracle, interaction-only, unreached or un-awaited assertions, swallowed failures, expected values from the code under test, snapshot-only — whole suite, each proved by breaking the code under test.Votes: 0GitHub stars: 2
- CharacterizePin current behaviour before a change — golden-master capture of HTTP endpoints, CLI commands and pure functions on sampled inputs, scoped to a run's design.md files and their _graph.json callers, registered as a behavioural baseline that gate G14 re-runs at HEAD. Runs first in /add-feature P5, /refactor, /optimize, /upgrade-dep and /migrate.Votes: 0GitHub stars: 2
- Contract TestGenerate and verify consumer-driven contracts between services (Pact-style), catching "the frontend and backend disagree on the API" before integration. Use in multi-service architectures, when frontend and backend move in parallel, or when an API change carries breaking-change risk. Cross-service agreement only — a single service's internal behaviour belongs to its own suite.Votes: 0GitHub stars: 2
- Coverage GapFind code no test runs or pins: changed lines and branches no test executes (diff-cover, plus the changed file missing from the report), guarded routes with no denial test, typed errors never asserted, critical modules with no test, consumed APIs with no contract test. --diff or --whole-repo.Votes: 0GitHub stars: 2
- Flake Source ScanFind what makes tests flaky — real clock and expiring fixture dates, unseeded randomness, fixed sleeps, real network, leaked shared state, async leaks, parallel-unsafe resources, brittle e2e waits — each proved by a perturbation that flips the test.Votes: 0GitHub stars: 2
- Mutation ProbeMeasure test strength on changed lines: run the repo's mutation tool with current flags (or seed one mutant by hand), surface surviving mutants, dismiss equivalents by a five-check procedure, and emit the mutant-kill evidence row a fix consumes.Votes: 0GitHub stars: 2
- Property InvariantsFind functions whose correctness lives in properties that must hold for ALL inputs — round-trip, idempotence, commutativity, invariants — and generate property-based tests instead of a handful of examples. Use when a pure function (parser, encoder, formatter, sort/dedupe, path builder) has only example tests, or a serialize/parse pair has no round-trip property. Not for I/O-bound or side-effecting code.Votes: 0GitHub stars: 2
- Suite Execution ScanFind tests that never run or never fail CI — focus and ownerless skips, files no runner collects, suites no CI job runs, masked exit codes, coverage config that hides code, retries with no flaky gate — each proved by a collection list or a CI canary.Votes: 0GitHub stars: 2
- Test Double ScanFind test doubles that lie — the code under test mocked, untyped or loose doubles, mocks of libraries the project does not own, emulated databases, test seams and test-input special cases in shipped code — each proved by a typed double, the real engine or a broken SUT.Votes: 0GitHub stars: 2
- Test FactoriesConsolidate test data creation into factories/builders with sensible defaults plus per-test overrides — killing copy-pasted object literals and shared mutable fixtures that couple tests to each other. Use when the same literal is built inline across three or more tests, when a mutated shared fixture makes suite order matter, or when a new required field forces edits across many test files. Restructures setup only; it never changes what a test asserts.Votes: 0GitHub stars: 2
- A11y Quick Check60-second a11y pass on one screen or diff for @ux-reviewer: a machine lane (static greps, one axe route with wcag22aa, computed contrast) and a human runbook, each with its real coverage.Votes: 0GitHub stars: 2
- Chart Encoding AuditChart honesty detector per chart library: wrong mark, truncated baseline, radius-scaled size, dual axes, gaps drawn as data, colour-only or unsafe series, missing units — proved on the rendered chart.Votes: 0GitHub stars: 2
- Design CanvasDraft a surface, a flow, or a whole product as ARTBOARDS on one pan/zoom canvas — a link a non-engineer can open, react to and annotate — BEFORE any product code is written. Lifts the app's resolved design-system values when `$SOURCE=system`, or designs free of the repo when `$SOURCE=independent`. Writes only under `ai/design/canvas/`, never product source. The visual approval gate `/redesign` and `/art-direct` hand their proposal to; the only artifact in this pack a designer or a stakeholder...Votes: 0GitHub stars: 2
- Design IterateTwo modes. `pick` (attended) — generate 2–3 style variants at the correct design-system layer (leaf scoped styles, shared wrapper, or design tokens), screenshot via Playwright MCP, present side-by-side so the user picks. `refine` (unattended, for /redesign Phase 6 + /art-direct build) — render the approved design, self-critique the PIXELS against the caller's rubric, fix the weakest lens (depth/motion/modern/perf/i18n), re-render, loop up to $MAX_REFINE rounds until it clears the bar. Honors ...Votes: 0GitHub stars: 2
- Design ScoreScores ONE rendered surface against the shared rubric, from the screenshot. Behind /ui-audit Phase 1.5 and /redesign's scorecard; rejects any score derivable from metrics alone.Votes: 0GitHub stars: 2
- Design Token AuditDesign-system drift detector: raw colour, spacing, type and z-index literals, Tailwind arbitrary values, re-built or deprecated DS components, per token-source lane, proved by computed-style conformance.Votes: 0GitHub stars: 2
- Motion AuditMotion detector: transition-all, layout-triggering animation, missing reduced-motion branches, off-scale durations, auto-moving content, infinite loops — proved by an animated-property census and reduced-motion emulation.Votes: 0GitHub stars: 2
- State MatrixWrite or lint a feature's UI state matrix (G12).Votes: 0GitHub stars: 2
- Ui Design SweepCodifies the 19 UI/UX design closure verbs as detector + procedure + verify triples. Used by /polish on frontend-* stacks, /ui-sweep, /enhance-ui, and any /align-recheck run that hits a UI/UX class. Each verb has a fingerprint (what triggers it), a procedure (how to apply it safely), a verify step (what must stay green visually + a11y), and a citation (WCAG / iOS HIG / Material / Refactoring UI). Behaviour-preserving — design changes ship through visual baseline diff + a11y re-check, never bl...Votes: 0GitHub stars: 2
- Ui State ScanMissing UI states per surface, proved by a state-matrix test.Votes: 0GitHub stars: 2
- S1No description providedVotes: 0GitHub stars: 2
- AxVotes: 0GitHub stars: 2
- Apply Pack AdaptationDecision-log owner. Reads `.claude/_phase-4-6-decisions.md`, writes `.claude/_phase-4-8-decisions.md`.Votes: 0GitHub stars: 2
- Extract Codebase OverviewDeterministic, runs before any prose. Denominator from `git ls-files`; `census_kind: git-ls-files` (or `find` with a named exclude list when the repo has no git). `walk_scope` records the dirs the walk could enter, the depth cap, and `parallelism`.Votes: 0GitHub stars: 2
- Extract Codebase OverviewDeterministic, runs before any prose. Denominator from `git ls-files`; `census_method: git-ls-files` (or `find` with a named exclude list when the repo has no git). `walk_scope` records the dirs the walk could enter, the depth cap, and `parallelism`.Votes: 0GitHub stars: 2
- Demo SkillScan the demo app for one defect class.Votes: 0GitHub stars: 2
- Demo Extract- Whenever the orchestrator needs a codebase overview.Votes: 0GitHub stars: 2
- Demo Extract- Whenever the orchestrator needs a codebase overview.Votes: 0GitHub stars: 2
- DemoA skill that never declares the tools it may use.Votes: 0GitHub stars: 2
- DemoA demo skill that does one bounded thing.Votes: 0GitHub stars: 2
- DemoA demo skill pointing at a reference file that was never written.Votes: 0GitHub stars: 2
- DemoA demo skill shipping a reference file nothing in its body ever names.Votes: 0GitHub stars: 2
- DemoA demo skill that inlines everything it will ever need.Votes: 0GitHub stars: 2