Claude Skills by aibot88

Issue-driven development orchestrator. Turns improvement intent into a well-specified, bilingual issue set; clusters issues into milestones that map 1:1 to semver versions; enforces branch, commit, and PR conventions (GitHub Flow — `<type>/<issue-N>-<slug>`, Conventional Commits, mandatory PR template, rebase-first merge); generates changelog entries and release notes deterministically from closed issues; leaves a durable audit trail for the next AI session. Direct-call only — not part of the...

Force a fast, regret-minimizing product decision when a solo founder is stuck choosing between options. Use when the user is paralyzed by a binary or tri-way choice (build A vs B, ship now vs polish, free vs paid, etc.), says "I can't decide", "should I", or asks for a sanity check on a roadmap call.

Full cycle: audit site, check Dependabot alerts, fix issues, push, verify CI, deploy, close. Prioritizes Security > Availability > New features. Parallel dispatch for speed.

Performs network reconnaissance using the Shodan REST API and Shodan InternetDB. Discovers exposed services, CVE mappings, and generates asset inventories with risk scores for security teams.

Search Shodan for internet-connected devices, open ports, and services — host lookups and database queries

Handle Shopify customer PII, implement GDPR/CCPA compliance, and manage data retention with Shopify's mandatory privacy webhooks. Use when building apps that store customer data, preparing for App Store review, or implementing deletion workflows. Trigger with phrases like "shopify data", "shopify PII", "shopify GDPR", "shopify customer data", "shopify privacy", "shopify CCPA", "shopify data request".

Deploy Shopify apps to Vercel, Fly.io, Railway, and Cloud Run with proper environment configuration. Use when deploying Shopify-powered applications to production, configuring platform-specific secrets, or setting up hosting. Trigger with phrases like "deploy shopify", "shopify hosting", "shopify Vercel", "shopify production deploy", "shopify Fly.io".

Builds and debugs Shopify themes (.liquid files, theme.json, sections), develops custom Shopify apps (shopify.app.toml, OAuth, webhooks), and implements Storefront API integrations for headless storefronts. Use when building or customizing Shopify themes, creating Hydrogen or custom React storefronts, developing Shopify apps, implementing checkout UI extensions or Shopify Functions, optimizing performance, or integrating third-party services. Invoke for Liquid templating, Storefront API, app ...

Install and configure Shopify app authentication with OAuth, session tokens, and the @shopify/shopify-api SDK. Use when setting up a new Shopify app, configuring API credentials, or initializing authentication for Admin or Storefront API access. Trigger with phrases like "install shopify", "setup shopify", "shopify auth", "shopify OAuth", "configure shopify API".

Configure Shopify apps across development, staging, and production environments with separate stores, API credentials, and app instances. Use when setting up isolated dev/staging/prod environments for a Shopify app, managing multiple development stores, or configuring per-environment credentials. Trigger with phrases like "shopify environments", "shopify staging", "shopify dev vs prod", "shopify multi-store", "shopify environment setup".

Implement Shopify app policy enforcement with ESLint rules for API key detection, query cost budgets, and App Store compliance checks. Use when hardening a Shopify app against secret leaks, enforcing query cost limits, or preparing for App Store submission review. Trigger with phrases like "shopify policy", "shopify lint", "shopify guardrails", "shopify compliance", "shopify eslint", "shopify app review".

Execute Shopify app production deployment checklist covering App Store requirements, mandatory webhooks, API versioning, and rollback procedures. Use when preparing a Shopify app for production launch, submitting to the App Store, or auditing an existing deployment for compliance gaps. Trigger with phrases like "shopify production", "deploy shopify", "shopify go-live", "shopify launch checklist", "shopify app store submit".

Apply Shopify security best practices for API credentials, webhook HMAC validation, and access scope management. Use when securing API keys, validating webhook signatures, or auditing Shopify security configuration. Trigger with phrases like "shopify security", "shopify secrets", "secure shopify", "shopify HMAC", "shopify webhook verify".

Set up Shopify CLI auth and Admin API access for a store. Workflow: install CLI, authenticate, create custom app, store access token, verify. Use when connecting to a Shopify store, setting up API access, or troubleshooting auth issues with Shopify CLI or Admin API tokens.

Register and handle Shopify webhooks including mandatory GDPR compliance topics. Use when setting up webhook subscriptions, handling order/product events, or implementing the required GDPR webhooks for app store submission. Trigger with phrases like "shopify webhook", "shopify events", "shopify GDPR webhook", "handle shopify notifications", "shopify webhook register".

Shrink an embedding/RAG vector store 4–32× via int8 or binary quantization with a float rescore pass, preserving recall and provenance metadata. Use when a vector store is too large to be laptop-resident, query cost/latency is too high, or embeddings need to be quantized for FAISS/Qdrant/usearch. Do NOT use for embed-time ingestion failures (e.g. a provider 'too many tokens' 400 — that is an upstream chunking bug, not a storage-size problem) and do NOT enable the dark TurboQuant 4-bit path wi...

Auxiliary service sharing lifecycle with main service. Trigger: When adding logging, monitoring, or auth proxy to microservices without code changes.

Use this when: track aircraft in real time, monitor vessel positions, build situational awareness dashboard, my OSINT pipeline is broken, ingest threat feeds, set up geospatial alerts, correlate events across sources, detect tracking anomalies, monitor radio frequencies, ingest ADS-B data, track vessels with AIS, ingest APRS feeds, build real-time data pipeline, set up feed ingestion, alert on anomalous behavior, dedup high-volume feeds, watch for entity patterns, spatial correlation of events

Continuous macro-market signal detection and classification engine that surfaces emerging trends, threats, and whitespace opportunities. Use when: market signals, market intelligence, trend analysis, emerging threats, market monitoring, what is changing in our market.

Verifies container image signatures and SBOMs using Sigstore Cosign and Rekor transparency log. Enforces supply chain security policies by validating keyless signatures against Fulcio certificate authorities.

QuantumAgent — Declare a macro-scale singularity event that reshapes project context. Singularities are project-level events (migration, paradigm shift, compliance change) that invalidate prior insights and inject new constraints into all future cosmos spawns.

SiteOne Crawler is a real website crawler and analyzer for technical SEO, accessibility, security, and performance checks. This skill uses the upstream SiteOne Crawler project to turn large site crawls into structured diagnostics, export files, and remediation queues.

Author, run, and operate skelm pipelines — typed TypeScript orchestrations for agentic and deterministic workflows with default-deny permissions. Use when the user mentions skelm, agent permissions, pipeline.ts, AgentPermissions, skelm.config.ts, MCP servers, or wants to scaffold a workflow.

Skeptic Engine v2.1 — falsification-first анализ в 4 режимах. Триггеры: 'skeptic:', 'сломай идею', 'стоит ли делать', 'проверь идею', 'аудит архитектуры', 'проверь решение', 'red-team архитектуры', 'разбор эксперимента', 'проверь метрики', 'это работает?', 'проверь claim', 'дебаг', 'что пошло не так', 'разбери инцидент', 'почему сломалось'. НЕ использовать для: выполнения задач — только для анализа и falsification.

Create and refine high-quality Agent Skills (SKILL.md + bundled resources). Use when the user wants to create a new skill, improve an existing one, or turn a workflow into a reusable skill package. Covers structure, progressive disclosure, conciseness, feedback loops, and the quality checklist. Do NOT use for skill validation (use skill-check) or for prompt engineering (use prompt-craft).

Turn raw PM content into a compliant, publish-ready skill. Use when creating or updating a repo skill without breaking standards.

Guide to creating Claude Code skills using TDD methodology and persuasion principles. Use for new skill development.

Skill and prompt benchmarking expertise for measuring latency, accuracy, token cost, and token-budget compliance across variants

Buenas prácticas para crear commits de git claros, atómicos y bien estructurados en español. Activa esta skill siempre que el usuario pida hacer un commit, confirmar cambios, guardar cambios en git, o cualquier variación de "haz commit", "commitea", "sube los cambios", "guarda en git", "git commit", etc. También cuando el usuario pida revisar o mejorar un mensaje de commit existente.

中文优先：用于技能合规检查相关任务，帮助识别、设计、实现或验证对应工作流。English keywords: Visualize whether skills, rules, and agent definitions are actually followed — auto-generates scenarios at 3 prompt strictness levels, runs agents, classifies behavioral sequences, and reports compliance rates with full tool call timelines

Local-first self-assessment for Claude Code skills. After you use any skill (your own or someone else's), call `skill-feedback log <skill> --rating N --outcome ... [--friction "..."]` to append one entry to `.agent-plus/skill-feedback/<skill>.jsonl`. The skill author can then run `skill-feedback report` for an aggregate, or `skill-feedback submit <skill>` to bundle entries into a GitHub issue body for the skill's source repo. No telemetry leaves the machine unless the user explicitly runs `su...

Use when turning local, private, or personal Agent Skills into publishable skills for GitHub, marketplaces, teams, or public sharing, especially when private paths, personal habits, credentials, internal hosts, or user-specific context must be removed.

Guidelines for authoring SKILL.md files with progressive disclosure. Apply when editing files under `.claude/skills/` or creating new skills. Use for pattern extraction, skill assimilation, simplification, bullet format. Keywords: skill creation, SKILL.md, progressive disclosure, reference files, pattern extraction, skill assimilation, bullet format, guideline skill.

Use when designing the deterministic health-tooling layer for a skill library, diagnosing why an existing library is decaying invisibly, deciding which categories of automated check to add (inventory, protocol consistency, conflict detection, routing health, drift sentinel), debugging eval-threshold violations across many skills at once, or auditing whether a skill-system has the safety nets a production library needs. Covers the five categories of skill-health tooling, the library-as-databas...

Es un motor de gestión de versiones que transforma cambios de código complejos en un historial atómico y semántico mediante la disección de fragmentos (hunks) y el cumplimiento estricto de Conventional Commits en español. Esta skill debe activarse de forma automática siempre que el usuario solicite en estos contextos "guardar cambios", "hacer commit", "finalizar una tarea" o "guardar avances"

Initialize or update the metadata field in one specific skill's SKILL.md according to this repository's CONTRIBUTING.md rules. Use when Codex needs to maintain metadata for exactly one target skill, derive author and created from git history, and require explicit confirmation before overwriting existing metadata values.

Guide to analyze a current work session and propose improvements to skills. Use (1) automatically after working with a skill to capture learnings, (2) when the user suggests improvements, corrections, or additions during a skill-related session, or (3) when the user manually invokes `self-improve`.

Sistema de validação de segurança para skills — Bianinho Vetter. Valida skills antes de instalar, detecta padrões maliciosos (exfiltração, injection, shell injection, commands destrutivos), audit das já instaladas, e integração automática no workflow de instalação. CORREIGIDO E AMPLIADO em 19/04/2026.

Especialista PhD em engenharia de sistemas com foco em FFI (Foreign Function Interface), ABI (Application Binary Interface), Go runtime, purego, SDL3 bindings e problemas de compatibilidade em arquiteturas 32-bit (x86/386) e 64-bit. Use esta skill sempre que o usuário mencionar: purego, go-sdl3, FFI em Go, problemas com float32 em 32-bit, calling conventions (cdecl/stdcall), cgo vs purego, bindings C/Go, wrappers de biblioteca nativa, GOARCH=386, ABI de float, SDL3 render/input/math, geração ...

Scan all artefacts (epics, stories, PRDs) for Base Rule #2 compliance — verify that every artefact declares skills_invoked and related_decs in frontmatter. Produces an audit report with pass/fail per artefact and overall compliance rate.

Security audit for AI agent skills before installation. Scans SKILL.md files, hooks, scripts, and MCP configs for prompt injection, data exfiltration, credential theft, and malicious automation patterns. Use when installing a new skill, reviewing a skills repo, or auditing existing installed skills. Trigger phrases: "verify this skill", "is this skill safe", "audit skill", "check before installing", "scan this plugin".

Static analysis security scanner for third-party OpenClaw skills. Detects eval/spawn risks, malicious dependencies, typosquatting, and prompt injection patterns before installation. Use when vetting skills from ClawHub or untrusted sources.

Build flawless Claude Code skills. Studies existing skills as reference, ensures correct format, and pushes for genuine intelligence — skills that exploit something specific about how Claude works. SKIP for one-off scripts, prompts, or task helpers.

Bookshelf4MD形式の教科書・勉強教材Markdownドキュメントを作成します。フロントマターの設定、##でのページ分割、画像・動画のパス指定、コードブロックの記述など、AI_GUIDELINE.mdに沿った形式で出力します。ユーザーが「〜の教科書を作って」「〜の教材を書いて」「〜の技術書を作成」「ドキュメントを作成して」などと依頼したときや、教育コンテンツ、学習教材、技術書の執筆を依頼されたときに使用してください。

Lift a proven skill from a host repo (e.g. your OpenClaw fork) back into gbrain's bundle so other clients can scaffold it. Editorial workflow: the CLI does the file copy + privacy lint; this skill drives the judgment-heavy genericization (scrub real names, generalize triggers, lift fork-specific conventions to references).

Use when the user mentions a skill or plugin by name, asks "should I install X?", asks "what skills fit this project?", asks to audit installed skills, asks whether a skill is safe to use, or wants to customize an external skill for their stack. Evaluates skills against the user's actual project (pros / cons / conflicts / ADOPT-PARTIAL-SKIP verdict), recommends what fits, scans for security red flags before adoption, persists every decision to a registry the user keeps in Project Knowledge, a...

Use when the user mentions a skill/plugin by name, asks "should I install X", asks for skill recommendations, wants a security check on a skill, asks about duplicates or conflicts, wants to create a new skill, or wants to migrate skills across agent platforms (Cursor, Codex, Gemini, etc.).

Manage API keys for the runner's --execute layer. CRUD on ~/.skills.env (chmod 600): list / add / update / remove / enable / disable gate flags / verify (ping vendor APIs) / export (eval-ready). Single source of truth for OPENAI_API_KEY, GEMINI_API_KEY, BFL_API_KEY, FAL_KEY, REPLICATE_API_TOKEN, RUNWAY_API_KEY, KLING_ACCESS_KEY_ID/SECRET, SUNO_API_KEY, ELEVENLABS_API_KEY, IDEOGRAM_API_KEY, ANTHROPIC_API_KEY, S3_* + gate flags (LYRIA_API_ENABLED, SUNO_API_ENABLED, OPENAI_SORA_API_ENABLED). Exp...

Syncs skills across AI CLI tools (Claude, Cursor, Windsurf, etc.) from a single source of truth. Global mode (~/.config/skillshare/) and project mode (.skillshare/ per-repo). Commands: status, sync, install, uninstall, update, check, search, new, collect, push, pull, diff, list, doctor, audit, init-rules, trash, log, backup, restore, target, ui, upgrade. Features: target filtering (include/exclude), skill-level targets field, .skillignore, --exclude flag, group uninstall (--group/-G), declara...

OAuth flows, token management, and security best practices for Slack apps. Use when implementing app distribution, multi-workspace installations, token storage and rotation, managing scopes and permissions, or securing production Slack applications.