Claude Skills by aibot88

Deploys React + Azure Functions apps to Azure Static Web Apps with managed API functions, including the CommonJS / index.ts import / route-registration gotchas that make new functions 404 silently. Provides the SWA Bicep module, staticwebapp.config.json routing + security headers, and the API entrypoint convention. Use when scaffolding a SWA-based project, adding a new API function, or fixing a deployed function that returns 404 even though it compiled successfully.

Deploys standalone Azure Function Apps on Flex Consumption (FC1) for workloads SWA managed functions can't handle — timer triggers, queue triggers, AI workloads, long-running operations. Provisions via ARM REST API or Bicep because az CLI flags silently fall back to deprecated Y1/Dynamic. Includes the forbidden-app-settings list, the ESM-vs-CommonJS module setting, and managed-identity storage authentication. Use when adding a non-HTTP trigger, exceeding the 30s SWA limit, or fixing a Functio...

Bir tanık veya taraf (isticvap) için duruşma/ifade soru taslağı (outline) hazırlar — şirket içi belgeleri veya UYAP evraklarını çeker, hukuki teori etrafında başlıkları düzenler ve çelişki yaratacak/yüzleştirilecek materyalleri (impeachment) öne çıkarır. Kullanıcı "[isim] için isticvap/tanık hazırlığı yap", "soru listesi oluştur" veya "[isim]'in duruşmasına hazırlan" dediğinde kullanın.

Check dependencies for vulnerabilities. Use when user asks to "audit dependencies", "/deps-audit", "check for vulnerabilities", or wants to check dependency health. Don't use for yarn, pnpm, or bun projects (npm only), or for reviewing code quality.

Use when hardening npm supply chain, pinning dependency versions, adding .npmrc security flags, or setting up Renovate and audit workflows. Locks down install-time scripts, registries, version ranges, and CI checks.

Create or revise Markdown `description` frontmatter so `docgarden match` routes agents to the right repository documents. Use when adding a new routed Markdown document, updating existing frontmatter, fixing noisy or missing match results, tuning skills or docs discovery, or making descriptions more query-aligned without loading document bodies.

Eine A2A-Agentenkarte (.well-known/agent.json) als Manifest entwerfen, das Agentenfaehigkeiten, Skills, Authentifizierungsanforderungen und unterstuetzte Inhaltstypen beschreibt. Verwenden beim Erstellen eines Agenten, der von anderen A2A-konformen Agenten auffindbar sein muss, beim Bereitstellen von Faehigkeiten fuer Multi-Agenten-Orchestrierung, beim Migrieren eines bestehenden Agenten zum A2A-Protokoll, beim Definieren des oeffentlichen Vertrags fuer einen Agenten vor der Implementierung o...

Design API endpoints: routes, request/response shapes, authentication, pagination, error responses, and versioning strategy.

Define system architecture — components, boundaries, communication patterns, data flow, and compliance requirements.

Use when auditing UI/UX designs for quality, detecting AI-generated slop patterns, validating WCAG accessibility compliance, checking design system token adherence, or reviewing responsive design across breakpoints. Produces three independent grades (Design, AI Slop, Accessibility) with prioritized fix recommendations.

Design system auto-detection — scans repository for installed component libraries, token systems, and variant frameworks to build a structured design-system-profile.yaml. Provides the discoverDesignSystem() algorithm used by devise, strive, and arc workflows. Provides the discoverFrontendStack() algorithm for Layer 1 frontend stack detection with version extraction, used by design-prototype Phase 0. Trigger keywords: shadcn, shadcn/ui, untitled ui, radix ui, design system, design tokens, tail...

Designs backend API error contracts with a REST-default approach using RFC 9457 Problem Details, stable machine-readable codes, retry semantics, validation error payloads, observability, and security-safe messaging. Reviews existing error handling against a binary rubric and proposes concrete fixes. Produces optional artifacts such as errors.yaml entries, Problem Details examples, OpenAPI fragments, and runbook templates. Use when creating or revising backend error responses, auditing API err...

Guides designing, reviewing, and governing RESTful APIs — resource modeling, URL structure, HTTP methods, status codes, error handling (RFC 9457), pagination, versioning, security, authentication, caching, idempotency, bulk operations, async patterns, file uploads, OpenAPI documentation, API-first process, and AI-agent consumers. Use when designing new REST API endpoints, reviewing existing API designs, adopting API-first development, running API design sessions, enforcing API contracts in CI...

Detects whether a user task contains multiple independent subtasks and splits it into a JSON array. Internal helper for orchestrate Phase 0.5; uses session credentials (no API key). Always returns STRICT JSON {is_multi, tasks[]} with cap N=5.

Use Licensee when an agent needs to inspect a repository and determine what license text it actually matches before a dependency is approved or a codebase is redistributed. The skill is about evidence-backed license detection, not legal advice or broader compliance automation.

Detect and analyze SQL injection vulnerabilities in application code and database queries. Use when you need to scan code for SQL injection risks, review query construction, validate input sanitization, or implement secure query patterns. Trigger with phrases like "detect SQL injection", "scan for SQLi vulnerabilities", "review database queries", or "check SQL security".

IDS/IPS detection content for a CVE — Snort/Suricata-compatible rules, YARA signatures, ProjectDiscovery Nuclei templates, traffic-filter rules. Capability-aware: skips families when the binary is not installed (no Snort = no Snort output). Use when deploying defences for a CVE without a patch, augmenting SAST with active detection, or feeding the SOC engineering pipeline.

Intercepts and audits dependency installations (pip, npm, go) before they execute. Validates package identity, checks vulnerabilities, flags supply-chain risk signals, and enforces hash pinning in lockfiles.

Creates or audits Dockerfiles to achieve Docker Hub Health Score grade A. Enforces non-root user, minimal base images, supply chain attestations, and zero fixable CVEs.

Développement d'APIs Node.js avec Express, middleware, routing, gestion d'erreurs, authentification et bonnes pratiques de conception. Se déclenche avec "Express", "Express.js", "middleware Express", "Node.js API", "router Express".

Automated software development agent using ChatDev 2.0 and GLM-5. Discovers topics from GitHub Trending, CVE databases, and security news → generates code with 7-agent ChatDev team → tests automatically → publishes to GitHub. Self-correction loop (error → fix → retry, max 3 times). Use when you want to automate development, create security tools, or generate DevOps utilities. Triggers: \"자동 개발\", \"도구 생성\", \"builder agent\", \"chatdev\".

Gate 6 of frontend development cycle — ensures Core Web Vitals compliance, Lighthouse performance score > 90, and bundle size within budget.

Watchdog automatico per file critici: avvisa prima di modificare .env, migrations, CI, secrets. Usa questa skill quando l'utente vuole protezione automatica, o dice guard, watchdog, proteggi file, guardia, sentinel, file critici.

Mandatory skill for creating and maintaining Helm charts following Lerian conventions. Enforces standardized chart structure, values organization, template patterns, security defaults, and dependency management.

This skill should be used when the user asks to "dev-impl", "タスクを実装", "テストファースト実装", "implement task", "実装を開始", "クイック修正", "quick fix", "dev-impl auth 001". TDDをガードレールとしたテストファースト実装を行う。通常モード（Plan+タスク指定）とクイックモード（直接指示）に対応。

Développement Java avec Spring Boot, Spring Security et l'écosystème Spring. Se déclenche avec "Java", "Spring Boot", "Spring", "JPA", "Hibernate", "Maven", "Gradle", "Spring Security", "microservices Java".

Multi-tenant development cycle orchestrator following Ring Standards. Auto-detects service stack (PostgreSQL, MongoDB, Redis, RabbitMQ, S3) and executes gate-based implementation using tenantId from JWT for database-per-tenant isolation via the lib-commons v5 dispatch layer with event-driven tenant discovery (Redis Pub/Sub). Use to add tenant isolation to a Go service. Requires lib-commons v5 + lib-auth v2.

Configuration Nginx — reverse proxy, SSL/TLS, load balancing, caching et security headers. Se déclenche avec "Nginx", "nginx.conf", "reverse proxy", "SSL Nginx", "load balancer Nginx".

Implémentation d'OAuth2, OpenID Connect, JWT et gestion des tokens pour sécuriser des APIs et applications web. À utiliser quand l'utilisateur configure de l'authentification, des tokens JWT, ou intègre un identity provider. Se déclenche aussi avec "OAuth2", "OIDC", "OpenID Connect", "JWT", "token", "refresh token", "identity provider", "Keycloak", "Azure AD", "Auth0".

Vérifie un projet contre le OWASP Top 10 et propose des remédiations. À utiliser pour vérifier la conformité OWASP. Se déclenche avec "OWASP", "top 10", "failles web", "sécurité web", "A01 broken access", "injection", "vérifier OWASP".

Guide méthodologique pour tests d'intrusion et évaluation de sécurité. À utiliser pour préparer ou conduire un pentest. Se déclenche avec "pentest", "test d'intrusion", "test de pénétration", "hacking éthique", "red team", "bug bounty", "surface d'attaque".

Readiness implementation orchestrator for Lerian services. Drives a 12-gate cycle that detects stack, audits existing /readyz compliance, dispatches language-specific engineers (Go / TypeScript / Next.js) to implement the canonical /readyz contract, ValidateSaaSTLS() enforcement, metrics emission, startup self-probe, graceful-drain coupling, circuit-breaker integration, and multi-tenant carve-out — then runs 13 parallel reviewers.

Kích hoạt khi người dùng muốn Claude đóng vai hoặc hỗ trợ công việc của nhóm Phát triển (Development) trong dự án phần mềm outsource. Bao gồm: Tech Lead, Senior Developer, Junior Developer, DevOps Engineer, DBA, Mobile Developer, Security Engineer. Dùng skill này khi người dùng đề cập: thiết kế technical solution, code review, viết code, review architecture, CI/CD pipeline, database design, technical documentation, debug, refactor, technical debt, pull request, branching strategy, deployment,...

This skill should be used when the user asks to "dev-run", "自動実装", "タスクを一括実装", "auto implement", "run all tasks", "タスクを自動実行", "バッチ実装", "dev-run auth 001 005". Plan内の指定範囲のタスクをdev-impl/dev-verify/dev-debugのワークフローで自動実行するオーケストレーションスキル。

Détecte les secrets, clés API et credentials exposés dans le code. À utiliser pour vérifier qu'aucun secret n'est dans le code. Se déclenche avec "secrets", "clé API exposée", "credential leak", "mot de passe dans le code", "token exposé", ".env", "secret scanner".

Audit de sécurité complet d'une application ou d'un code source. À utiliser quand l'utilisateur veut vérifier la sécurité de son projet. Se déclenche avec "audit sécurité", "security audit", "vérifier la sécurité", "est-ce que mon code est sécurisé", "analyse de sécurité".

Audit de sécurité de smart contracts Solidity et blockchain. Se déclenche avec "smart contract", "Solidity", "audit blockchain", "vulnérabilité smart contract", "reentrancy", "ERC-20", "ERC-721", "Web3 security".

Guide pour écrire des requêtes SQL et concevoir des schémas SQLite avec les bonnes pratiques. À utiliser quand l'utilisateur travaille avec SQLite, écrit des requêtes SQL ou conçoit des schémas de base de données. Se déclenche aussi avec "requête SQL", "schéma SQLite", "base de données SQLite", "migration SQL", "table SQLite", "query SQL".

i-Willink 共通開発標準。スタック非依存の汎用層（TypeScript strict / Conventional Commits / OWASP / テスト方針 / コミット粒度）。各 agent が起動時に preload する。プロジェクト固有の規約は `project-standards` skill 側に書く。

Backend development with Supabase. Trigger when the user wants to configure auth, the database, or Supabase storage.

Analyse et évalue les vulnérabilités d'un système ou d'une application. À utiliser pour comprendre et prioriser les vulnérabilités. Se déclenche avec "vulnérabilité", "CVE", "faille", "vulnerability", "risque sécurité", "score CVSS", "patch critique".

Create or harden a devcontainer-based development sandbox so coding agents run inside an isolated container with least privilege and strong guardrails (no destructive host access, controlled network/secrets, reproducible toolchain).

Use Automattic’s official wp-plugin-development skill when an agent needs to build, refactor, secure, or package a WordPress plugin with correct activation hooks, settings handling, uninstall behavior, and data hygiene. This is a plugin engineering playbook, not a generic WordPress listing.

Middleware HTTP Basic Authentication para Horse. Cobre HorseBasicAuthentication (callback de validação, configuração THorseBasicAuthenticationConfig), Header, RealmMessage, SkipRoutes e proteção por rota. Fonte: app/package/docs/pacotes/horse-basic-auth.md.

Middleware CORS para Horse. Cobre HorseCORS/CORS, HorseCORSConfig (AllowedOrigin, AllowedMethods, AllowedHeaders, AllowedCredentials, ExposedHeaders), preflight OPTIONS (204) e ordem de registro. Fonte: app/package/docs/pacotes/horse-cors.md.

Middleware HTTP Basic Authentication para Horse. Cobre HorseBasicAuthentication (callback de validação, configuração THorseBasicAuthenticationConfig), Header, RealmMessage, SkipRoutes e proteção por rota. Fonte: app/package/docs/pacotes/horse-basic-auth.md.

Middleware CORS para Horse. Cobre HorseCORS/CORS, HorseCORSConfig (AllowedOrigin, AllowedMethods, AllowedHeaders, AllowedCredentials, ExposedHeaders), preflight OPTIONS (204) e ordem de registro. Fonte: app/package/docs/pacotes/horse-cors.md.

Údržba a aktualizace Klabis developer manuálu v docs/developerManual/. Použij tento skill kdykoli uživatel řekne "vytvoř developer manuál", "aktualizuj manuál", "doplň manuál o X", "podívej se co se změnilo a aktualizuj manuál", "zkontroluj manuál proti kódu", "syncuj manuál se zdrojákem", nebo žádá změnu ve struktuře/obsahu HTML stránek v docs/developerManual/. Použij ho i proaktivně po větším refactoringu v common modulu nebo framework-like částech members modulu (ActingUser, OAuth2 customi...

Best practices for authoring Genkit tooling, including CLI commands and MCP server tools. Covers naming conventions, architectural patterns, and consistency guidelines.

React Flow 라이브러리를 사용한 노드 기반 UI 개발 지원. 노드/엣지 생성, 커스터마이징, 레이아웃, 상호작용 구현 시 사용. 항상 최신 문서를 WebFetch로 참조하여 정확한 정보 제공.