Claude Skills by AgenticPawan

Applies the Azure Well-Architected Framework five-pillar checklist (Reliability, Security, Cost Optimization, Operational Excellence, Performance Efficiency) to Bicep files and GitHub Actions workflows detected in stack-profile.json. Outputs findings with WAF pillar IDs (WAF-REL, WAF-SEC, WAF-COST, WAF-OPS, WAF-PERF) and Microsoft Learn references. Uses the microsoft-learn MCP server when available for live documentation lookups.

Reviews the cross-cutting REST contract tying dotnet-api-pagination, dotnet-error-handling, and dotnet-api-versioning to angular-api-client-codegen's generated client. Flags inconsistent resource naming, pagination shape differing per endpoint, error bodies not following ProblemDetails, no versioning strategy tied to client regeneration, and misused HTTP status codes. Outputs pilot-core api-design-standards standard IDs.

Reviews whether significant architectural decisions are captured as ADRs rather than living in chat threads or PR descriptions. Flags significant decisions with no ADR, ADRs outside a discoverable version-controlled location, no lightweight template, superseded decisions never marked, no trigger defining when an ADR is required, and PRs silently contradicting an existing ADR. Outputs pilot-core architecture-decision-records standard IDs.

Four-phase security-audit orchestrator: (1) detect available scanners and mark coverage gaps; (2) run each scanner scoped by stack-profile.json; (3) normalise findings into .claude/pilot/audit/findings.json (severity P0-P3, cwe, owasp, file, line, evidence, proposedFix); (4) generate AUDIT-REPORT.md and print the P0 table. Claude semantic pass strictly limited to IDOR/missing authorization, tenant isolation, authN/authZ logic, and secrets in config — every finding must cite file:line evidence...

Reviews the cross-cutting auth contract tying angular-authentication (SPA OIDC/PKCE) to dotnet-authentication (token validation) plus the permissions-only rule shared by angular-security and dotnet-authorization. Flags audience/issuer/scope mismatch between SPA and API, claim-name drift between issuance and permission checks, token lifetime/renew misalignment, and client-only gating with no server enforcement. Outputs pilot-core auth-token-contract standard IDs.

Batched remediation pipeline. Reads audit findings.json, filters one severity tier (--batch P0-P3), groups by root cause, validates --max-files (default 10), creates branch pilot/fix-<tier>-<n>, applies fixes, verifies with build/tests, rolls back on failure. Updates finding statuses and writes a PR-ready description. Hard rules: never mix tiers; never exceed --max-files; API-surface changes need explicit human sign-off first.

Reviews CI-level secret scanning (gitleaks/trufflehog/GitHub Advanced Security) — the safety net beyond the local secret-guard.js hook, which never sees direct pushes or forked PRs. Flags no CI secret-scanning step, diff-only instead of full-history scans, no leak-to-rotation runbook, findings that don't fail the build, and no false-positive allowlist. Outputs pilot-core ci-secret-scanning standard IDs.

Samples the current codebase (≤50 files, ignore lists apply) and writes detected house conventions — naming, folder layout, error-handling shape, DI registration style, test naming — to .claude/pilot/knowledge/conventions.md. Enforcement threshold: every convention requires ≥3 distinct evidence paths (file:line); fewer evidence paths → listed as tentative with no enforcement weight. Never invents conventions not evidenced in the code.

Reviews a diff that spans multiple layers simultaneously and flags cross-cutting issues no per-stack reviewer can see alone — an Angular component calling an endpoint that doesn't exist yet, a .NET auth change not reflected in the Angular route guard, a SQL column rename with no EF Core model update. Runs after individual stack skills, not instead of them. Outputs CSR-* standard IDs.

Reviews data-residency/sovereignty — where regulated data may legally live and move — over sql-data-protection's at-rest controls and azure-dr-multiregion's replication. Flags regulated data deployed outside the required boundary, replication/failover copying it out of geography, backups/logs/telemetry in a non-compliant region, no residency requirement per data classification, and personal data to a third party with no residency guarantee. Outputs pilot-core data-residency-compliance standar...

Reviews open-source license risk — a legal-compliance concern distinct from dependency-supply-chain's vulnerability/version-pinning focus. Flags no license scanning in the dependency pipeline, a copyleft (GPL/AGPL) dependency pulled into proprietary code with no legal review, no documented license allow-list/deny-list policy, and license metadata missing from the SBOM already generated for release artifacts. Outputs findings with pilot-core license-compliance standard IDs.

Defines the triage and patch-cadence policy layered over audit-orchestration's raw dotnet/npm vulnerability scanner output. Flags no severity-to-patch-cadence SLA, direct dependencies pinned to a floating/wildcard version range, no private-feed/allow-list policy for third-party packages, and no SBOM generated for release artifacts. Outputs findings with pilot-core dependency-supply-chain standard IDs.

Reviews W3C traceparent correlation — the seam the per-layer observability skills each cover on one side only. Flags no traceparent from the SPA, a bespoke correlation-ID header instead of traceparent, context dropped at async boundaries, SQL/downstream calls not in the request trace, and no trace id in errors or logs. Outputs distributed-tracing-correlation standard IDs.

The /fsp-bootstrap pipeline engine. Detects which baseline modules (authentication, authorization, logging, error handling, health checks, CORS, and stack-appropriate recommended modules) already exist in a project, scaffolds the missing required ones via the stack implementors on a dedicated branch, and writes .claude/pilot/foundation/STATUS.md — the marker fsp-build-orchestration checks before allowing feature work on a greenfield project.

Assess the whole solution against the pilot target state and emit a ranked, buildable gap register with ready-to-run /fsp-build lines.

Run a full security audit (automated scanners plus a bounded Claude triage pass) on the current repository and write a findings report.

Detect and scaffold missing baseline modules (auth, authz, logging, error-handling, health-checks, CORS) before feature work begins.

The /fsp-build pipeline engine. Orchestrates spec (fsp-analyst) → scout briefs (fsp-scout) → plan (fsp-architect) → gated implement (stack implementors, opus only for complexity-high items) → diff-scoped review loops (max 2) → QA with deterministic test-path diff enforcement → summary. File handoffs only; STATE.json checkpoint after every step enables --resume; hard safety gates are never waived by --yes.

Build a feature end to end — spec, plan, implement, review, test — on a reviewable branch in one command.

Save session state — commit staged changes and write .claude/handoff.md with branch, test status, what changed, and next action.

Apply /fsp-audit findings for one severity tier on a safe, reviewable git branch.

Generate a graded A–F health report across Build, Tests, Security, Dependencies, Architecture, and Observability for the full stack.

Detect the project's Angular/.NET/SQL/Azure stack, write stack-profile.json, then scaffold CLAUDE.md and governance rules from the confirmed profile.

Distil durable, project-specific knowledge from the current session into reviewable knowledge files. Never commits.

Integrates ZAP (OWASP Zed Attack Proxy) baseline DAST scan into CI against a staging slot. Governs ZAP job setup in GitHub Actions, scan scope, alert thresholds, findings.json output for /fsp-audit, and suppression management. Cross-references ci-secret-scanning for the SAST complement.

Run the 7-phase quality gate (build, lint, antipatterns, tests, security, migrations, diff) before declaring a feature done or opening a PR.

Instruments and baselines the four DORA metrics (deployment frequency, lead time for changes, change failure rate, mean time to restore) across Angular CI pipelines and .NET/Azure deployments: GitHub Actions workflow tagging, Azure Monitor workbook queries, alert rules for MTTR SLO, and a starter dashboard template. Outputs baseline measurements and top-3 improvement recommendations.

Reviews end-to-end user-journey test coverage across the deployed SPA + API + SQL stack — the tier the per-layer testing skills each only half-cover. Flags no E2E suite driving a full critical journey through a real browser, E2E tests mocking the API instead of a real backend, shared mutable test data with no per-run isolation, no pre-deploy CI gate, and flaky tests masked with retries/skips instead of fixed. Outputs pilot-core fullstack-e2e-testing standard IDs.

Reviews branching strategy, PR size/review policy, and merge hygiene — distinct from always-conventional-commits, which governs message format only. Flags no documented branching strategy, no PR size guidance, no branch protection on the default branch, long-lived branches with no rebase cadence, and no squash/merge/rebase policy. Outputs pilot-core git-workflow-governance standard IDs.

Takes multiple error artifacts — a .NET exception, a SQL timeout, an Angular HTTP error, an Azure alert body — and correlates them into a single request-chain timeline. Outputs correlation/request ID (if found), layer-by-layer event sequence, which layer introduced the failure vs. which propagated it, and a confidence rating (High/Medium/Low). Loaded exclusively by fsp-incident-responder.

Defines what happens after an azure-observability alert fires — the response layer this marketplace's observability/alerting skills wire up but don't govern. Flags an alert with no linked runbook, no severity-to-response-time SLA, no blameless-postmortem template/process, and no tracked action-item follow-through after an incident closes. Outputs findings with pilot-core incident-response standard IDs.

Reviews load/performance testing strategy and release-gating, tying thresholds to the SLO/error-budget targets defined via azure-slo-error-budget and using Azure Load Testing. Flags no load testing before shipping a hot-path change, thresholds chosen arbitrarily instead of derived from SLOs, tests run against a non-representative environment, no CI/CD-wired regression gate, and scenarios that only model the happy path and never simulate retry storms under partial downstream failure. Outputs f...

Reviews how quickly and consistently a new developer can get a full-stack local environment (Angular + .NET API + SQL Server + Azure emulators) running. Flags no single documented clone-and-run quick-start, no docker-compose (or equivalent) bringing up backing services together, local configuration diverging from CI/staging, no seeded local database available out of the box, no documented minimum tool-version matrix, and onboarding docs that go stale silently with no check confirming they sti...

Scans the project dependency graph for technologies that have companion MCP servers, proposes a curated list with one-line supply-chain risk notes, and writes approved entries into the project .mcp.json only after explicit per-server user consent. Never auto-registers third-party servers.

Phase 2 of /fsp-init. Reads the confirmed stack-profile.json, runs a compact one-block interview covering unknowns plus architecture/tenancy/compliance/team-size, generates a facts-only CLAUDE.md (hard limit 100 lines), and materializes version-gated governance rules from the rules catalog into .claude/rules/.

Three-tier project learning system for multi-stack codebases. Instincts (`.claude/instincts.json`) are unconfirmed hypotheses (confidence 0.0–1.0): auto-applied at ≥0.7, promoted to memory at ≥0.9. User corrections go directly to MEMORY.md. Non-obvious discoveries go to `.claude/learning-log.md`. Covers Angular, .NET, SQL, and Azure patterns. Trigger phrases activate the three modes: status, export, import.

Seven-phase verification pipeline Claude runs before declaring any feature done across the full Angular/.NET/SQL/Azure stack. Phases: (1) Build — dotnet build + ng build, zero errors; (2) Analyzers — dotnet format --verify-no-changes + ng lint; (3) Antipatterns — antipattern-guard scan on changed files; (4) Tests — dotnet test + ng test --watch=false, no new failures; (5) Security — secrets, open firewall rules, unprotected endpoints; (6) Migrations — ef migrations list, no unapplied pending;...

Reviews the cross-cutting SignalR seam tying dotnet-realtime (hub) to angular-realtime (client), as auth-token-contract and api-design-standards govern theirs. Flags hub method/event names duplicated as magic strings instead of a shared contract, push payloads with no matching typed Angular interface, the hub token diverging from REST auth, no hub-contract versioning tied to client regeneration, and reconnect gaps where missed messages are neither replayed nor re-fetched. Outputs pilot-core s...

Reviews dedicated search-service integration (Azure AI Search / Elasticsearch / OpenSearch) replacing ad-hoc SQL. Flags full-text/fuzzy search as LIKE queries against the OLTP database, no re-indexing/sync strategy, no incremental indexing path (CDC/outbox), default relevance with no scoring profile, no access control at the search layer, and no degradation when search is down. Outputs pilot-core search-integration standard IDs.

Writes a structured handoff note to `.claude/handoff.md` at session end and reads it at session start, ensuring cross-session continuity for the full stack. Captures last command run, last test result (from `.claude/last-test-run.md` if present), what changed and why, open questions, and next recommended action. For active P0/P1 incidents, extends the note with incident timeline, ruled-out hypotheses, current hypothesis, and escalation status.

Takes a .claude/pilot/specs/*.md spec and a diff or PR description, then validates the implementation against the original spec. Outputs a checklist marking each AC-n as Implemented, Partial, Missing, or Scope Creep, with evidence citations from the diff. Loaded by fsp-tpo-intake when invoked with a PR or diff argument. Outputs SV-* standard IDs.

Evidence-based technology-stack detector. Analyzes the current working repository for Angular (v15–20), .NET (net6–net11), SQL Server, and Azure presence. Every conclusion must cite a file path. Writes .claude/pilot/stack-profile.json then prints a summary table for user confirmation before any downstream governance runs.

Grades the full-stack project A–F across six dimensions: Build health, Test coverage proxy, Security posture, Dependency hygiene, Architecture compliance, and Observability. Produces a graded report card with a GPA (A=4.0, F=0.0) and ranked improvement recommendations. Covers Angular, .NET, SQL Server, and Azure stacks present in the project.

Reviews how lower environments get realistic test data safely — closing the gap left if a raw prod backup lands in a less-protected environment. Flags no anonymization/masking in prod-to-lower refreshes, no synthetic-seeding alternative, lower environments with weaker access control than the production data they hold, and no policy for what's safe to copy. Outputs pilot-core test-data-management standard IDs.

Reviews the migration-to-deploy seam — is a schema change safe while N-1 and N app versions run at once during a rolling deploy? Flags destructive changes shipped with their own code instead of expand/contract, migrations not backward-compatible with N-1, table-locking migrations causing downtime, and migration/rollout not sequenced in CI. Outputs zero-downtime-deployment standard IDs.

Reviews consumer-driven contract testing between Angular and the .NET API — dotnet-api-versioning prevents in-place breaks, but nothing verifies the frontend's actual response-shape assumptions before deploy. Flags no contract tests in CI, happy-path-only verification, no shared schema source of truth, and provider changes deployed without consumer verification. Outputs pilot-dotnet api-contract-testing standard IDs.

Reviews pagination, filtering, and sorting conventions on ASP.NET Core list endpoints. Flags list endpoints with no paging at all, inconsistent paging shapes across endpoints with no shared request DTO, offset/skip-based paging used on high-write frequently-reordered data instead of cursor/keyset pagination, response envelopes missing total-count/hasMore metadata, sort/filter fields concatenated into a query instead of an allow-listed sortable-fields mechanism, and no max page-size cap. Outpu...

Reviews ASP.NET Core API versioning setup. Flags missing Asp.Versioning wiring (endpoints versioned only by folder/route convention), a version reader limited to the URL segment with no header/query fallback, breaking changes made in-place to an existing version's contract instead of introducing a new version, missing deprecation/sunset signaling on superseded versions, and Swagger/OpenAPI docs not grouped per version. Outputs findings with pilot-dotnet api-versioning standard IDs.

Governs .NET Aspire application models: AppHost project composition (resource naming, connection expressions), ServiceDefaults wiring (AddServiceDefaults call, telemetry/health/resilience auto-configuration), dashboard access policy, and container resource declarations. Checks Aspire project references follow the approved cross-project pattern and required observability hooks are registered.

Audits EF Core entities for audit-trail hygiene — verifies CreatedAt/CreatedBy/ModifiedAt/ModifiedBy are populated centrally via a SaveChanges override or ISaveChangesInterceptor rather than duplicated per service method, checks for an IAuditable marker interface, validates CreatedBy/ModifiedBy resolve from an injected current-user abstraction typed as Guid (not string), checks Modified fields only update on actually-changed entities, and flags DateTime.Now instead of DateTime.UtcNow. Outputs...