Claude Skills by aibot88

Use when building or reviewing GraphQL APIs in Rails with the graphql-ruby gem. Covers schema design, N+1 prevention with dataloaders, field-level auth, query limits, error handling, and testing resolvers/mutations with RSpec.

Use when planning or reviewing production database migrations, adding columns, indexes, constraints, backfills, renames, table rewrites, or concurrent operations. Covers phased rollouts, lock behavior, rollback strategy, strong_migrations compliance, and deployment ordering for schema changes.

Multi-pass Rails code review workflow that identifies bugs, security vulnerabilities, and architectural issues; assigns severity levels (Critical, Suggestion, Nice-to-have); and generates actionable review comments with a mandatory re-review loop for Critical findings. Use for full PR review workflows, multi-pass security or architecture audits, or implementing and verifying responses to review feedback. Trigger: review this PR, full code review, multi-pass review, audit security vulnerabilit...

Performs security audits and vulnerability assessments on Ruby on Rails application code. Use when reviewing Rails code for security risks, assessing authentication or authorization, auditing parameter handling, redirects, file uploads, secrets management, or checking for XSS, CSRF, SSRF, SQL injection, and other common vulnerabilities.

Use when auditing a Rails app for SQL injection, XSS, CSRF, mass-assignment, or Gemfile.lock CVEs, or when reviewing only NEW security regressions in a PR vs base branch.

Complete Rails project setup workflow. Installs dependencies via Bundler, configures database connections, generates Rails app scaffold, validates the dev environment, and generates GitHub Actions or GitLab CI pipelines with linting, testing, and security scanning. Use when starting a new Rails project, running `rails new`, configuring a Gemfile or .ruby-version, setting up a development environment, or wiring up CI/CD for a Ruby on Rails app. Trigger: setup project, new Rails app, configure ...

Rakiplerin içeriklerini (Instagram, TikTok) ve reklam stratejilerini (Meta Ads vb.) analiz ederek içerik boşluklarını (content gap) bulmaya yarayan araştırma motoru.

Ramp install auth — corporate card and expense management API integration. Use when working with Ramp for card management, expenses, or accounting sync. Trigger with phrases like "ramp install auth", "ramp-install-auth", "corporate card API".

Ramp security basics — corporate card and expense management API integration. Use when working with Ramp for card management, expenses, or accounting sync. Trigger with phrases like "ramp security basics", "ramp-security-basics", "corporate card API".

Audit web pages and components against RAWeb 1.1 (Luxembourg Web Accessibility Framework). Use when reviewing existing code for accessibility compliance, generating audit reports, checking conformance levels, or preparing for Luxembourg accessibility certification. Covers all 17 themes with systematic test procedures. Default target: Level AA.

Use Raymon’s MCP server to search and inspect Ray-style logs. Use when you need to (1) set up Raymon as an MCP server (local or remote with auth), (2) search stored entries with filters/pagination, or (3) fetch full entry payloads by UUID for debugging/triage.

Rclone is an open-source command-line program to sync files and directories to and from over 70 cloud storage providers including Google Drive, S3, Dropbox, Azure, OneDrive, and Backblaze B2. Often called the Swiss Army knife of cloud storage, it handles copy, sync, mount, and serve operations with encryption support.

Use when creating, modernizing, or production-hardening a standalone React SPA after frontend architecture is approved or intentionally deferred. Produces a production-ready app shell with Vite (or Webpack) project layout, environment and profile handling, top-level and route-level error boundaries, a structured logging client, RUM and error-reporting wiring, the auth provider/wrapper baseline downstream skills extend, CSP and security-header posture via host config, and container or static-C...

Use when integrating, reviewing, or hardening the design system and accessibility posture of a React app after the app scaffold exists and frontend architecture has defined the design-system seam and a11y target. Produces design-token wiring (CSS variables / Tailwind theme / vanilla-extract), primitive composition over an accessible headless library (Radix / React Aria / Headless UI), theming and dark-mode strategy, WCAG 2.2 AA conformance posture, keyboard-navigation and focus-management dis...

Zoom Meeting SDK for React Native. Use when embedding Zoom meetings in React Native iOS/Android apps with @zoom/meetingsdk-react-native, JWT auth, join/start flows, platform setup, and native bridge troubleshooting.

Use when defining, reviewing, or hardening the routing topology and client rendering strategy of a standalone React SPA after the app scaffold exists and frontend architecture has decided rendering modes per route. Produces React Router 6 data-router topology (nested routes, loaders, actions, deferred data), CSR-only rendering posture with suspense and transition boundaries, per-route loading and error UI, route-level metadata and SEO posture, and protected-route gates and redirect flows wire...

This skill should be used when the user is securing a React application, asking about "XSS in React", "dangerouslySetInnerHTML security", "Server Actions security", "React data exposure", "sensitive data in React", "auth token storage", "IDOR in Next.js", "React security audit", "secure React forms", "Server Component secrets", "server-only package", "React taint API", "DOMPurify React", "prototype pollution React", "hardcoded secrets React", or reviewing React code for security vulnerabilities.

Use when defining, reviewing, or hardening client state and data fetching for a standalone React SPA after the app scaffold and routing exist and frontend architecture has decided the state-tier model and data-fetching strategy. Produces a 4-tier state discipline (URL, server, global, local), a server-state data-fetching layer (TanStack Query default, or RTK Query/Apollo), query and mutation conventions, cache and revalidation policy, optimistic-update posture, and the auth-token storage, ref...

Build SQLite-backed reactive UI in `apps/desktop` using stable patterns for reads, selection, forms, writes, and loading states. Use when implementing or reviewing screens built on `useDrizzleLiveQuery` and SQLite mutations.

Active-reading scaffolding for nonfiction books (EPUB). Parses an EPUB, generates a structured book analysis in the user's Obsidian vault at Read/{Book Name} ({Author})/, with 0. General.md as the book-level overview and one numbered markdown file per chapter containing pre-read brief, the user's own notes section, and post-read synthesis — all through configurable role lenses (e.g. PM, CEO, Entrepreneur). Six sub-skills — `reading-lens:setup` loads an EPUB with lens selection, `reading-lens:...

MLS listing writing, social media marketing, and Fair Housing Act compliance for real estate

Rebate Management setup: rebate types, payout calculations, accruals, partner rebates, program setup, compliance reporting. NOT for CPQ discounts on quotes (use revenue-cloud-cpq-setup). NOT for channel loyalty programs (use partner-loyalty-programs).

Integrates the Recap Swift package into SwiftUI apps, authors Recap-compatible releases markdown, and configures RecapDisplayPolicy and RecapScreen customization. Use when adding Recap into an app, updating Releases.md, or customizing the behavior of a Recap screen.

Recettix : compétence de recette et validation des livrables d'une application métier TypeScript. Couvre : Plan de Recette contractuel, critères d'acceptance Gherkin, jeux de tests (unitaires Vitest, intégration, E2E Playwright, performance Lighthouse CI, sécurité OWASP, accessibilité WCAG), conduite de campagnes UAT, Procès-Verbal de Recette (PVR) et Rapport de Validation Finale (RVF) opposables. Déclencher dès qu'une question touche à : recette, PVR, RVF, validation client, critères d'accep...

Compliance gap analysis for Austrian law — KSchG, DSGVO/DSG, MRG, UGB, GewO, ArbVG, FAGG. For contracts, websites, and business operations.

Austrian social security appeals — challenging Bescheide from ÖGK/PVA/AMS/SVS, Klage to Arbeits- und Sozialgericht (ASG), pension disputes, Pflegestufe appeals, and AMS sanctions (Sperren). Kostenfreiheit in Sozialrechtssachen.

Austrian social security law analysis — health insurance (ASVG/GSVG/BSVG), pension (Pensionsrecht), unemployment benefits (AlVG), care allowance (BPGG), accident insurance, and Mindestsicherung. Analyzes entitlements, contribution obligations, and benefit calculations.

Design Doc compliance and security validation with optional auto-fixes

Design Doc compliance and security validation with optional auto-fixes

Brainstorma receptidéer, föreslå kompletta recept på svenska och spara nya recept till SQLite-databasen. Triggas när användaren vill ha receptförslag, matinspiration, middagstips, eller spara ett nytt recept. Nyckelord: recept, middag, mat, laga, ingredienser, spara recept, push, brainstorm. För att redigera/uppdatera/justera ett befintligt recept — använd skillen edit-recipe istället.

Automated full-scope reconnaissance starting from a domain or domain list. Performs subdomain enumeration, port scanning, technology fingerprinting, OSINT correlation, Google dorking, and Wayback analysis. Use when user provides a domain or list of domains and asks for "recon", "reconnaissance", "attack surface mapping", "subdomain enumeration", "footprinting", or "information gathering". Designed for authorized penetration testing and bug bounty.

Recon-ng is a full-featured modular reconnaissance framework written in Python, designed to conduct web-based open source intelligence (OSINT) gathering quickly and thoroughly. Its Metasploit-like interface and extensible module system make it the standard tool for structured OSINT workflows.

Run, audit, and design authorized Recon Workbench workflows when scoped target interrogation needs evidence artifacts, redaction, validation, and safe reporting.

Diagnose why a user can or cannot see/edit a record: UserRecordAccess SOQL, Why Can a User Access This Record debug log, OWD, role hierarchy, sharing rules, manual/team/apex shares, implicit parent share. NOT for field-level security (use field-level-security-audit). NOT for designing sharing (use sharing-selection decision tree).

Run local adversarial attack passes against agents, RAG pipelines, and chatbots to surface concrete failure classes before production rollout.

红队评估全流程方法论。当开始一个完整的渗透测试项目/红队评估、需要从侦察到报告的完整流程编排时使用。适用于外网打点、安全评估项目、定期渗透测试。本技能负责任务调度——具体漏洞利用调用专项 skills，不要在本技能内做深度漏洞测试

Interactively prepares a targeted Red Team Review package. It conducts a brief discovery interview to determine the threat model, generates a strict security auditor prompt, compiles a manifest of relevant project files, and bundles them into a single Markdown artifact or ZIP archive ready for an external LLM (like Grok, ChatGPT, or Gemini) or a human reviewer.

Use when creating or reviewing red-team eval plugins, attack templates, grader rubrics, safety fixtures, or model-risk test metadata.

(Industry standard: Review and Critique Pattern) Primary Use Case: Iterative generation paired with adversarial review, continuing until an 'Approved' verdict is reached. Orchestrated adversarial review loop. Use when: research, designs, architectures, or decisions need to be reviewed by red team agents (human, browser, or CLI). Iterates in rounds of research → bundle → review → feedback until approved.

Adversarial verification for AI-generated legal content with systematic fact-checking, source validation, and quality control. Use when User requests verification of legal documents, fact-checking of regulatory content, red team review, or quality assurance before distribution to clients/stakeholders. Provides structured verification reports with severity-categorized errors, verified sources, and distribution readiness assessment.

Use cli-web-reddit to browse Reddit feeds, subreddits, search posts, view user profiles, and (with auth) vote, comment, submit posts, save items, and manage subscriptions. Always prefer cli-web-reddit over manually fetching the Reddit website.

Research a subreddit topic, draft a post in authentic Reddit tone, and submit via real Chrome browser. Use when the user wants to post on Reddit — asking a question, sharing experience, or starting a discussion.

Reddit API: пользователи, сабреддиты, посты, комментарии, поиск. OAuth2 (app-only / user mode), кеш-first, опциональные write-операции с двойным предохранителем (REDDIT_ENABLE_WRITE=1 + --confirm). Triggers: reddit, reddit api, reddit subreddit, reddit user, reddit post, reddit search, парсинг reddit, посты reddit, комментарии reddit, реддит.

Uses the Reddit OAuth2 API via PRAW to collect top posts and comments from subreddits on a rolling 24-hour window, then runs batch sentiment scoring via HuggingFace Inference API using twitter-roberta-base-sentiment. Aggregates scores into a daily time-series written to Google Sheets for Looker Studio visualization. Fires Slack alerts when sentiment drops more than 20 points week-over-week.

Redpanda Connect (formerly Benthos) is a high-performance stream processor that connects data sources and sinks through declarative YAML pipelines. It supports hundreds of connectors and a built-in mapping language called Bloblang for data transformation.

Spawn a one-shot red-team subagent to challenge a milestone result. Calibrated to return "nothing substantive" when the work is sound — does not invent issues to seem thorough. Use at goal-locked, major-result, or pre-write-up milestones, or whenever you want a deliberate adversarial check on something specific.

Authoring discipline for new AZIMUTH reference files and templates. Use when adding a new domain reference file, extending an existing one, or creating a new template. Covers: (1) EXTEND vs. CREATE decision heuristic, (2) the Module 7 vocabulary header pattern that prevents domain-gap recurrence, (3) the sourcing caveat pattern for narrow-evidence-base files, (4) pre-verdict gate structure for templates. Validated by research-mpbaese4 (2026-05-18).

Поиск и анализ судебной практики Верховного Суда РФ (СКГД и СКЭС) по базе из ~5300 обзоров определений ВС РФ за 2018–2026 гг. Используй этот скилл всякий раз, когда пользователь: просит найти судебную практику по какому-либо вопросу; хочет подтвердить правовую позицию ссылками на определения ВС РФ; спрашивает, как суды разрешают тот или иной спор; упоминает СКГД, СКЭС, Верховный Суд, определения ВС; просит подобрать практику для процессуального документа (иска, отзыва, жалобы, заключения); за...

MUST use this skill for plain-English developer service/provider/tool questions involving free tier, free trial, cheap, pricing, best value, hosting, Node hosting, Next.js, auth, Postgres, database, email API, transactional email, SaaS stack, API platform, GPU compute, remote MCP endpoints, or low setup friction. Exact triggers include "what are some free tier hosting providers for Node projects", "find me hosting with a free tier", "cheap GPU provider", "free tier hosting for a remote MCP en...

Recommend the best providers for a specific development use case, including plain asks like cheap hosting, best value auth, free-tier database, or good email service for a SaaS. Use as a slash command when the user wants `/nullcost-recommend`. Do not use this for domain/registrar/TLD prompts.