Claude Skills by AgenticPawan

WCAG 2.2 AA enforcement for Angular apps. Semantic HTML first, ARIA only when needed, focus management on route change and dialog open/close using CDK FocusTrap and LiveAnnouncer, keyboard navigation, colour contrast, skip links, and screen reader announcements. AAA items are marked advisory.

Reviews how an Angular app consumes its .NET backend's API contract. Flags hand-typed TypeScript interfaces re-declared per feature instead of generating a typed client from the backend's OpenAPI/Swagger spec (NSwag/openapi-typescript), a generated client checked in but never regenerated against the current API version, hand-written HttpClient calls duplicating what the generated client already provides, and no CI step failing the build when the frontend model drifts from the backend contract...

Reviews how an Angular SPA authenticates against an OIDC/OAuth2 IdP or the .NET backend — distinct from angular-security's permission gating, which assumes authentication already happened. Flags tokens in localStorage instead of httpOnly Secure cookies, no central auth interceptor, no silent renewal, hand-rolled OIDC/PKCE, decentralized auth state, and no global 401 handling. Outputs pilot-angular authentication standard IDs.

General Angular coding-standards enforcement — naming conventions, standalone-first architecture (v17+), service extraction for business logic, strict TypeScript compiler options, barrel-file risk, and signal-based input()/output() adoption (v17.1+). Version-gated checks read .claude/pilot/stack-profile.json (angular.majorVersion) when present; otherwise ask or infer from angular.json/package.json.

Reviews JSON-schema-driven Angular reactive forms — a shared field-descriptor model driving FormGroup construction and template rendering. Flags hand-coded form fields where a descriptor should drive them, validation duplicated between descriptor and ad-hoc Validators, missing generic field renderers, enabled/disabled state set directly on FormControl, and hardcoded tooltips/labels instead of localization keys. Builds on angular-shared-libraries' form-factory guidance.

Reviews Angular application-level error handling — the frontend counterpart to dotnet-error-handling's ProblemDetails contract. Flags no global ErrorHandler for uncaught exceptions, per-component ad-hoc catchError blocks with no shared error-boundary/toast pattern, HTTP error responses not parsed against the .NET ProblemDetails shape, and no user-facing fallback UI distinguishing recoverable errors from a full application crash. Outputs findings with pilot-angular error-handling standard IDs.

Reviews Angular feature-flag usage and its coordination with dotnet-feature-flags — the same flag key must resolve consistently on both sides. Flags build-time constants requiring a rebuild to toggle, flag keys drifting from backend names, ad-hoc conditionals instead of a centralized service, no fallback when evaluation is unreachable, stale fully-rolled-out flags, and client-side-only gating with no server enforcement. Outputs pilot-angular feature-flags standard IDs.

Typed HttpClient wrappers, interceptor-based retry with exponential backoff and per-request timeout, correlation-ID header propagation to .NET backends, error normalisation into typed error models, and loading-state management. Targets Angular 17+ functional HttpClient configuration.

Reviews Angular internationalization architecture — the frontend counterpart to dotnet-localization's XML-default-plus-DB-override model. Flags hardcoded UI strings with no i18n library wired, translation keys that don't share a common key space with the .NET DB-override table, locale-unaware date/number/currency formatting, missing RTL layout support, and locale switches that require a full page reload. Outputs findings with pilot-angular i18n standard IDs.

Reviews ongoing ESLint/Prettier enforcement in CI — distinct from angular-upgrade-path's one-time TSLint migration. Flags ESLint not run as a required CI gate, missing @angular-eslint template linting, ESLint/Prettier conflicts without eslint-config-prettier, no husky + lint-staged pre-commit hook, blanket eslint-disable comments, and no warning-vs-error severity policy. Outputs pilot-angular lint-governance standard IDs.

Detects and prevents Angular memory leaks. Covers subscription leaks, takeUntilDestroyed() (v16+), async pipe preference, DestroyRef, detached change-detector trees, DOM event listeners left attached, and NgZone.runOutsideAngular misuse. Includes a leak-hunt checklist.

Reviews Nx/monorepo workspace boundaries once an Angular codebase spans multiple apps or teams — the layer above angular-shared-libraries' single-library guidance. Flags no enforced module/library-tag boundaries, shared libraries without ownership or versioning, no module-federation boundary for independently deployable apps, and cross-cutting concerns (auth, theming) reimplemented per app. Outputs pilot-angular monorepo-governance standard IDs.

Reviews Angular animation/motion accessibility per WCAG 2.2 (2.3.3 Animation from Interactions, 2.2.2 Pause/Stop/Hide) — the motion dimension angular-a11y doesn't cover. Flags animations with no prefers-reduced-motion fallback, auto-playing carousels/parallax without pause controls, route transitions moving focus early, hardcoded timing/easing with no shared token, and layout-affecting animation properties instead of compositor-friendly ones. Outputs pilot-angular motion-accessibility standar...

Reviews multi-layout Angular shells (header nav vs sidebar nav, switchable per user/tenant/preference) for a centralized layout component, a layout-selection service, persisted layout preference, responsive sidebar collapse, and a single shared navigation-model consumed by every layout variant.

Governs classic NgRx Store/Effects usage in large or legacy Angular codebases and when NgRx is still the right call versus Signals covered by `angular-signals-and-state`. Flags full NgRx boilerplate for simple local state, unmemoized selectors recomputing on every emission, Effects with no catchError killing the whole effects stream, direct store.subscribe() reintroducing manual subscription management, eagerly-registered root state instead of lazy feature state, and no documented policy for ...

Angular rendering performance: OnPush change detection, zoneless (v18+ experimental, v20 stable), @for with track (v17+), deferrable views with @defer triggers (v17+), lazy-loaded routes, bundle budget configuration in angular.json, and NgOptimizedImage for LCP (v15+).

Reviews Angular PWA/offline-first setup for apps that need to work in the field with intermittent connectivity. Flags @angular/service-worker not configured, no offline fallback page/shell, a caching strategy that doesn't distinguish app-shell assets from API data, and no conflict-resolution story for data edited offline and synced later. Only relevant for shops shipping field/offline-capable apps — most internal line-of-business apps can skip this. Outputs findings with pilot-angular pwa-off...

Reviews the Angular SignalR client — the frontend counterpart to dotnet-realtime's hub. Flags a raw HubConnection scattered across components instead of a typed connection service, no automatic reconnect with backoff, the access token not attached (or not refreshed) on the socket, untyped on()/invoke() calls that drift from the hub's method contract, and subscriptions/connections not torn down on component destroy. Targets Angular 17+ standalone + Signals. Outputs pilot-angular angular-realti...

Reviews Angular Router architecture beyond permission guards (owned by angular-security) — resolvers, typed route data, nested composition. Flags detail data fetched in ngOnInit instead of a Resolver, magic-string route data, deep routes with no lazy boundary, missing wildcard/redirect strategy, guards duplicated across siblings instead of applied at a parent, and components ignoring paramMap changes. Outputs pilot-angular routing-architecture standard IDs.

Reviews runtime environment configuration for containerized Angular SPAs — the frontend mirror of dotnet-dynamic-configuration. Flags API URLs/flags baked into environment.ts at build time (one Docker image per environment), no runtime config.json + APP_INITIALIZER pattern, config fetched too late for interceptors, secrets in client-visible config, no startup error handling for an unreachable config endpoint, and unclear build-vs-runtime precedence. Outputs pilot-angular runtime-config standa...

Angular security hardening: XSS template-binding hygiene, DomSanitizer bypass policy, nonce-based CSP, Trusted Types (v17+), CSRF handling with the .NET backend, and permission-ONLY client-side access control — route guards and UI gating check permissions, never roles; client checks are UX only, real enforcement is dotnet-authorization. References OWASP A01/A03.

Structuring reusable Angular code across an app or Nx/Angular-CLI workspace — shared reactive-forms building blocks (form-group factories, centralized validators) and a generic typed paged/sortable/filterable DataTableComponent, extracted into proper workspace libraries with clean public APIs instead of duplicated per feature.

Reviews the shared UI-kit layer beyond forms and tables already covered by angular-shared-libraries — modals/dialogs, toast/notification service, and confirmation prompts. Flags MatDialog/CDK Overlay usage reimplemented per feature instead of a shared DialogService, ad-hoc snackbar/toast calls with inconsistent styling and no queuing policy, destructive actions with no shared confirmation-dialog component, and dialog/toast components with no accessibility contract (focus trap, aria-live annou...

Guides signal-based state design in Angular 17–20. Covers signal()/computed()/effect() patterns, when RxJS still wins, toSignal()/toObservable() interop (v16+), linkedSignal() (stable v20), and resource()/httpResource() async data (stable v20 / experimental v19.2).

Reviews Angular SSR (@angular/ssr) and hydration. Flags SEO-sensitive routes without SSR, browser-only APIs (window, localStorage) unguarded by isPlatformBrowser, missing provideClientHydration(), data fetched twice with no TransferState, prerendering vs per-request SSR conflated, and browser-only libraries imported eagerly. Outputs pilot-angular ssr standard IDs.

Reviews Angular application telemetry — the frontend counterpart to dotnet-observability. Flags no Application Insights JS SDK (or equivalent) wired, user-interaction events tracked with inconsistent/ad-hoc naming instead of a shared event-tracking convention, no correlation between a frontend user action and the backend request trace ID already established by angular-http-resilience/dotnet-observability, and PII captured in telemetry event properties. Outputs findings with pilot-angular tele...

Reviews Angular test suite conventions. Flags component tests that query the DOM by CSS class/tag instead of accessible role/label, HTTP calls in component tests hitting a real HttpClient instead of HttpTestingController, Angular Material components tested via raw DOM queries instead of Component Test Harnesses, no documented e2e convention despite Playwright tooling being available, and signal-based components tested by triggering change detection ad-hoc instead of via proper flush/harness A...

Multi-theme support in Angular apps — light/dark/brand and per-tenant theming via CSS custom property design tokens, runtime theme switching without reload, Angular Material M3 theming (v17+), persisted theme preference with flash-of-wrong-theme prevention, and WCAG contrast validation across theme variants.

Reviews third-party script governance — CDN-loaded scripts, analytics/chat-widget tags — that angular-security's CSP work doesn't fully close on its own. Flags a CDN-loaded script with no Subresource Integrity (SRI) hash, a third-party tag added with no documented allow-list/review process, a third-party script granted broader CSP allowances than it needs, and no monitoring for a third-party script's behavior changing after initial approval. Outputs findings with pilot-angular third-party-scr...

Reviews visual/UI-UX implementation consistency in Angular apps — spacing/typography scale discipline, mobile-first responsive layout, visual hierarchy between primary/secondary actions, cross-feature component consistency, and a design-to-code fidelity check. Distinct from angular-a11y (ARIA/keyboard), angular-theming (color tokens only), and angular-shared-ui-kit (dialog/toast architecture only).

Step-by-step Angular upgrade path from v15 to v17+. Covers standalone migration schematics (v15+), NgModule removal, control-flow migration (v17+), signal input/output adoption, ESLint migration from TSLint, and ng update safety checks. Only skill with deep v15/v16 EOL content.

Reviews Storybook and visual regression testing coverage for shared Angular component/UI-kit libraries. Flags a shared component library with no isolated component playground documenting variants/states, no visual regression tooling catching unintended pixel-level style changes, stories that only cover the happy-path state, snapshot diffs auto-accepted in CI with no human review, theme variants left uncovered by visual snapshots, and no hard CI gate blocking merge on an unreviewed visual diff...

Guides migration from Zone.js to Angular's zoneless change detection: bootstrapping swap (provideZonelessChangeDetection / provideExperimentalZonelessChangeDetection), component audit for manual tick calls or NgZone.runOutsideAngular usage, CD strategy alignment (OnPush or signal-based), async-pipe alignment, and NgZone import elimination. Targets Angular 17.1+ (experimental) and 18+ (stable).

Reviews AKS-specific governance for shops running Azure Kubernetes Service instead of Container Apps. Flags pods with no Pod Security Standards enforcement, containers with no resource requests/limits (noisy-neighbor and OOM-kill risk), no NetworkPolicy restricting pod-to-pod traffic, and workload identity not used for pod-to-Azure-resource authentication. Outputs findings with pilot-azure aks-governance standard IDs.

Reviews Azure API Management gateway-layer policies — a distinct layer from dotnet-rate-limiting's app-layer checks. Flags no rate-limit/quota policy at the gateway, JWT validation duplicated or missing at the gateway when the backend already validates tokens, backend health/circuit-breaker not configured for APIM's own backend pool, and request/response transformation logic that duplicates backend validation instead of being a thin pass-through. Outputs findings with pilot-azure api-manageme...

Reviews Bicep files for production-readiness: module decomposition vs monolithic templates, parameterization of environment-specific values, what-if step in GitHub Actions deployment workflow, required cost tags on all resources, secure parameter types for secrets, conditional deployment for environment tiers, and Azure Verified Modules (AVM) alignment. Outputs a scored checklist with Bicep best-practice IDs.

Enforces Azure Cloud Adoption Framework naming and tagging conventions: validates resource names match the CAF pattern <type>-<workload>-<env>-<region>-<instance> using the official abbreviation list, checks required tags (env, costCenter, owner, managedBy), detects missing or wrong type prefixes, and emits a regex pattern set consumable by the dangerous-patterns hook for live enforcement. Uses microsoft-learn MCP server when available for the current abbreviation reference.

Reviews GitHub Actions deployment workflow security beyond azure-bicep-patterns' what-if check. Flags long-lived service-principal secrets used instead of OIDC federated credentials, missing environment protection rules/approval gates on production deploys, deployment identities granted broader roles than the resources they touch, and secrets referenced directly in workflow YAML instead of GitHub encrypted secrets or Key Vault. Outputs findings with pilot-azure cicd-security standard IDs.

Reviews the ACA / App Service compute host a .NET API lands on — the target azure-aks-governance's Kubernetes checks don't cover. Flags external ingress with no auth/IP restriction, secrets as plaintext env vars instead of secretRef/Key Vault references, minReplicas 0 on a latency-sensitive API or no maxReplicas cap, no liveness/readiness probe, no managed identity for registry pulls/backing calls, and containers with no CPU/memory limits. Outputs pilot-azure azure-container-apps standard IDs.

Reviews container image security for AKS/ACA workloads — the image-build-time layer above azure-aks-governance's pod-spec runtime checks. Flags no base-image vulnerability scanning in the build pipeline, images running as root with no non-root user configured, a full OS base image used where a distroless/minimal image would shrink the attack surface, and no image-signing/provenance verification before deployment. Outputs findings with pilot-azure container-image-security standard IDs.

Goes beyond the WAF-COST pillar checklist into concrete FinOps tooling — budgets with alert thresholds, autoscale right-sizing playbooks, and cost-anomaly detection. Flags no Azure Budget resource with action-group alerting, autoscale rules with no documented right-sizing review cadence, no cost-anomaly alerts configured, and orphaned/unused resources with no automated cleanup policy. Outputs findings with pilot-azure cost-finops standard IDs.

Turns the WAF Reliability pillar's checklist items into concrete Bicep disaster-recovery patterns. Flags a production workload with no paired-region secondary deployment, no Traffic Manager/Front Door failover routing configured, no documented RPO/RTO targets, and a database with no cross-region replication or geo-redundant backup matching those targets. Outputs findings with pilot-azure dr-multiregion standard IDs.

Reviews the edge tier fronting an Angular SPA + public API — Azure Front Door or App Gateway with a Web Application Firewall (WAF) policy. The edge network firewall, NOT azure-waf-review (which is the Well-Architected Framework review). Flags a public API/SPA with no edge WAF, a policy left in Detection mode never switched to Prevention, no managed OWASP rule set, no edge rate limit, the origin reachable directly bypassing the edge, and TLS below 1.2 or no HTTPS redirect. Outputs pilot-azure ...

Reviews Azure provisioning of the secret/config store that dotnet-secrets-rotation, dotnet-dynamic-configuration, and dotnet-feature-flags consume. Flags inline secrets instead of Key Vault references, App Configuration via connection string not managed identity, no Key Vault soft-delete/purge-protection, flags in App Settings not the flag store, and either resource open to public network. Outputs pilot-azure azure-keyvault-appconfig standard IDs.

Reviews enterprise-scale subscription/management-group topology — one level above azure-caf-naming's resource-name-string scope. Flags no management-group hierarchy separating platform from landing-zone subscriptions, a single subscription hosting both production and non-production workloads with no isolation boundary, no Azure Policy initiative assigned at the management-group level for tenant-wide guardrails, and no documented subscription-vending process for onboarding new workload teams. ...

Reviews Azure observability design beyond the WAF-OPS pillar checklist. Flags missing centralized Log Analytics workspace design (per-resource-group workspaces instead of one shared workspace with RBAC), Application Insights sampling left at defaults for high-volume APIs, no alert rules/action groups defined for critical resources, and diagnostic settings not routed to the central workspace. Outputs findings with pilot-azure observability standard IDs.

Checks Azure Bicep resources against the Microsoft security baseline: blocks public blob storage, flags PaaS services without private endpoints, verifies managed identity authentication over connection-string keys, validates Key Vault secret references, checks RBAC least-privilege (no Owner/Contributor at subscription scope), and checks Azure Defender enablement. Outputs findings with Azure Security Benchmark control IDs and OWASP references.

Reviews the Azure infrastructure that scales real-time SignalR — the provisioning side dotnet-realtime RT-002 assumes. Flags a multi-replica app hosting SignalR with no Azure SignalR Service or Redis backplane resource, Default/Serverless service-mode mismatch, the service wired by access key instead of managed identity, fixed capacity with no autoscale (or a free-tier SKU in production), and a SignalR Service reachable publicly with no private endpoint. Outputs pilot-azure standard IDs (SRS-*).

Reviews proactive reliability target-setting — the SLO/error-budget layer above incident-response-runbook's reactive severity SLAs. Flags no defined SLO for a customer-facing service, no error-budget policy gating release velocity when the budget is exhausted, SLIs that don't match what users actually experience, and no dashboard surfacing current budget consumption. Outputs findings with pilot-azure slo-error-budget standard IDs.

Reviews Azure Storage data-plane governance — the client-access side complementing dotnet-document-io's uploads and the secret-guard hook's public-access block. Flags client access via account-key/shared-key SAS instead of Entra user-delegation SAS or managed identity, SAS tokens minted with long or no expiry, storage reachable over the public network with no private endpoint, no lifecycle-management policy, and blob soft-delete plus versioning left disabled. Outputs pilot-azure standard IDs ...