Claude Skills by aibot88

Search 50,000+ smart contract vulnerabilities from Cyfrin Solodit. 8 MCP tools with intelligent caching for searching, filtering, and analyzing blockchain security findings.

Specialized knowledge for developing Java applications with the Solon framework. Covers core concepts, web, data, security, remoting, AI, flow orchestration, cloud-native, testing, and more. Solon is an independent Java enterprise framework (NOT based on Spring) with its own annotation system, IoC/AOP container, and plugin ecosystem.

[discovery-phase pack · scoping] High-level solution design as a discovery deliverable — system context, logical components, data flow, integrations, NFRs (perf/scale/security/SLA), and tech-stack rationale. Not detailed design; feeds estimation and surfaces tech risks. Produces solution-architecture.md. Reads scope-doc.md, mvp-definition.md, risk-assumption-map.md.

Solves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf-* skill. Use when the user gives you a challenge bundle, a remote service, a suspicious file, or only a vague challenge description and you must determine where to start. Do not use it when the category is already clear and a specialized skill can be invoked directly; this is the dispatcher and recon entrypoint, not the deepest reference for category-spe...

SonarQube-style quality gate analyzer + auto-fix. Inspects code for Bugs · Vulnerabilities · Security Hotspots · Code Smells · Duplication · Coverage with severity (BLOCKER/CRITICAL/MAJOR/MINOR/INFO) and Reliability/Security/Maintainability ratings A-E. Follows 'Clean as You Code' — focus changes on new code, leave legacy. Use when running quality gate, fixing sonar issues, pre-commit lint, before PR merge, or any code-smell/coverage/duplication/vulnerability check.

Music and audio file analysis agent. Produces reproducible Python/Shell analysis pipelines (librosa, pyloudnorm, essentia, madmom, mutagen, ffprobe) for BPM/key/time-signature detection, LUFS/True Peak loudness measurement, spectral balance, dynamic range (LRA/PLR/PSR), structural segmentation, mastering QC, and reference-track comparison. Verifies distribution-platform compliance (Spotify/Apple Music/YouTube/Tidal/Amazon Music/EBU R128). Effort baseline: xhigh; stems and batch >50 files expe...

Arbeite gezielt mit SonarCloud Security Hotspots und normalen Issues für `smart-village-app_sva-studio`. Nutze diesen Skill, wenn Befunde gelistet, geprüft, kommentiert oder statusseitig bearbeitet werden sollen.

Integrates with the SonarQube REST API to run static code analysis scans, retrieve quality gate results, and flag code smells. Supports SonarCloud and on-premise SonarQube instances via token-based authentication.

Run SonarQube static analysis scans via the SonarQube Web API and sonar-scanner CLI. Detects code smells, bugs, and security vulnerabilities with configurable quality gates and branch analysis support.

Runs SonarQube static analysis via the SonarQube Web API and sonar-scanner CLI. Detects code smells, bugs, and security vulnerabilities across 30+ languages with quality gate enforcement.

Automated code quality scanning using SonarQube REST API and SonarScanner CLI. Detects code smells, bugs, and vulnerabilities across 30+ languages with configurable quality gates.

Enforces SonarQube quality gates in pull request workflows using the SonarQube Web API and ce/task endpoint. Blocks merges when code coverage drops, duplications exceed thresholds, or security hotspots are unreviewed.

Fetches the latest SonarQube project analysis result, explains why the Quality Gate failed in plain English, and links to specific issues. Covers coverage drops, new bugs, and security hotspots. Supports SonarQube Server and SonarCloud. Diagnostic only.

Integrates with SonarQube Web API and sonar-scanner CLI to enforce code quality gates across pull requests. Automatically blocks merges when critical code smells, security hotspots, or duplications exceed configurable thresholds.

Planowanie projektów dodatków dla platformy enova365/Soneta Enterprise. Tworzy kompletną dokumentację projektową obejmującą: strukturę danych (tabele, relacje), elementy konfigurowalne, definicje list i menu, formularze, workery i raporty. Używaj gdy użytkownik prosi o zaplanowanie nowego modułu/dodatku enova365, przygotowanie założeń projektu, stworzenie specyfikacji funkcjonalnej dodatku, lub zdefiniowanie struktury danych i interfejsu użytkownika dla nowego modułu.

Klasy ORM i wzorce kodu biznesowego enova365 / Soneta Enterprise / Triva: Row/Table/Module, sesja i transakcje (Session, Commit/CommitUI, Save, optimistic lock), Login/Database/BusApplication, Datapack/GuidedRow/ExportedRow, serwerowy LINQ (RowCondition, SubTable[condition]), Context, Worker/Extender/[Action], ViewInfo/FolderView, Features, Translate/ILogger oraz zasady bezpiecznego kodu (safe-code, code review). Używaj gdy użytkownik: (1) pisze, modyfikuje lub refaktoruje kod biznesowy enova...

Use when the user wants to manage agency SOPs — create from template, assign to brands, track compliance, review or update existing SOPs, or version control procedures.

SOPS (Secrets OPerationS) is an editor of encrypted files that supports YAML, JSON, ENV, INI, and BINARY formats. It encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, and PGP, making it the standard tool for managing secrets in version-controlled repositories.

SOPS manages encrypted YAML, JSON, ENV, INI, and binary files with KMS, age, and PGP. It is a tight fit for secrets handling, rotation, and encrypted configuration workflows.

Fires when the task adds a new data source or changes an existing one (xtb, gold, bond, manual, future: crypto/IKE). Use proactively when user mentions a source name or /source.

Erkennt Spam-Muster in eingehenden Mandantenanfragen: Werbung, Spamfilter-Umgehung, klassische 419-Scams, automatisierte Recruiter-Mails, Massen-Mandantenanfragen und Phishing. Kennzeichnet die Anfrage zur Aussortierung ohne Erstantwort. Laedt wenn der Nutzer 'Spam pruefen', 'verdaechtige Anfrage', 'Scam-Mail', '419-Betrug', 'Massen-Anfrage erkennen' oder 'Phishing Kanzlei' sagt.

Examine every existing page on the site, build a semantic map across pillars, and add missing internal links so the site becomes a semantic graph anchored on clear topical pillars. Use this skill whenever the user asks to "add internal links", "build internal linking", "build a semantic graph", "link related pages", "strengthen topical authority", "fix orphan pages", "add pillar linking", or wants hub-and-spoke linking between pillars, hubs, and supporting content. Output is an edit list (pro...

Diagnose and fix common Speak API errors: authentication failures, audio format issues, rate limits, and session management problems. Use when implementing common errors features, or troubleshooting Speak language learning integration issues. Trigger with phrases like "speak common errors", "speak common errors".

Handle student audio data, assessment records, and learning progress with GDPR/COPPA compliance. Use when implementing data handling, or managing Speak language learning platform operations. Trigger with phrases like "speak data handling", "speak data handling".

Collect diagnostic information for Speak API issues: auth verification, audio format validation, session inspection, and network testing. Use when implementing debug bundle features, or troubleshooting Speak language learning integration issues. Trigger with phrases like "speak debug bundle", "speak debug bundle".

Set up Speak language learning API integration and authentication. Use when configuring Speak API access, setting up OAuth with OpenAI Realtime API for speech, or initializing a language tutoring application. Trigger with phrases like "install speak", "setup speak", "speak auth", "configure speak API", "speak language learning setup".

Production readiness checklist for Speak language learning integrations: auth, audio pipeline, monitoring, and compliance. Use when implementing prod checklist features, or troubleshooting Speak language learning integration issues. Trigger with phrases like "speak prod checklist", "speak prod checklist".

Security best practices for Speak API keys, audio data privacy, student data protection, and COPPA/FERPA compliance. Use when implementing security basics features, or troubleshooting Speak language learning integration issues. Trigger with phrases like "speak security basics", "speak security basics".

Проводит глубокий QA-аудит спецификации на основе стандартов ISTQB, BABOK и OWASP. Выявляет не только архитектурные дыры, но и логические противоречия между Требованиями, Схемой данных и Примерами (Dry Run). Используй перед написанием тестов, при ревью требований или анализе спецификации на противоречия. Не используй для code review или анализа тестового кода.

Author a hardened spec through multi-pass adversarial review

Expertise in writing clear, testable specifications. Activates when user discusses requirements, features, user stories, or acceptance criteria. Trigger keywords: specification, requirements, user story, acceptance criteria, feature spec, functional requirement, non-functional requirement, spec.md

Iteratively review an instar-development spec with multi-angle internal reviewers (security, scalability, adversarial, integration) and cross-model external reviewers (GPT, Gemini, Grok) until convergence, then produce a comprehensive ELI10 convergence report. Output is a spec tagged review-convergence — one of the two tags /instar-dev requires before it will touch instar source. NOT user-invocable; run by the instar-developing agent before any spec-driven /instar-dev work.

Generate CI/CD pipeline workflows through spec-driven workflow generation with structural anti-skip enforcement. Implements 5 phases covering preflight validation, configuration loading, workflow template generation, cost optimization, and final validation using the Execute-Verify-Gate pattern at every step. Designed to prevent token optimization bias through lean orchestration and binary CLI gate enforcement. Currently supports GitHub Actions with cost-optimized Claude API integration (promp...

Validate epic-to-story coverage with gap detection and batch story creation using structural anti-skip enforcement. Implements 6 phases of the DevForgeAI coverage workflow using the Execute-Verify-Gate pattern at every step. Designed to prevent token optimization bias through lean orchestration, fresh-context subagent delegation, and binary CLI gate enforcement. Detects coverage gaps between epics and stories, generates visual coverage reports, and orchestrates batch story creation with failu...

Automated documentation generation, auditing, and remediation with structural anti-skip enforcement. Supports 3 workflows: Generation (greenfield/brownfield), Audit (4-dimension DevEx scoring), and Fix (automated/interactive remediation). Uses Execute-Verify-Gate pattern at every step. Designed to prevent token optimization bias through lean orchestration, fresh-context subagent delegation, per-phase reference loading, and binary CLI gate enforcement. Use when generating project documentation...

Retrospective feedback system with Execute-Verify-Gate structural anti-skip enforcement for DevForgeAI operations. Captures feedback after /dev, /qa, /release, sprint planning, or manual triggers. Handles 6 feedback types: conversation, summary, metrics, checklist, ai_analysis, and triage. Prevents token optimization bias through lean orchestration, per-phase reference loading, checkpoint persistence, and binary CLI gate enforcement. Use when feedback needs to be captured, when the user menti...

Process QA gap files and create remediation user stories with structural anti-skip enforcement (Execute-Verify-Gate pattern at every step). Applies per-phase reference loading, checkpoint persistence, and binary CLI gate enforcement to every step of the 7-phase QA remediation process. Prevents token optimization bias through lean orchestration, fresh-context subagent delegation, and artifact verification. Use when converting QA findings into actionable development work, processing imported QA...

Validates code quality through spec-driven QA validation with structural anti-skip enforcement. Replicates all 6 phases of the DevForgeAI QA workflow using the Execute-Verify-Gate pattern at every step. Designed to prevent token optimization bias through lean orchestration, fresh-context subagent delegation, and binary CLI gate enforcement. Enforces test coverage (95%/85%/80% strict thresholds), detects anti-patterns, validates spec compliance, and analyzes code quality metrics. Use when vali...

Orchestrates production releases through spec-driven deployment workflow with structural anti-skip enforcement. Implements 8 phases covering setup, build, validation, staging, production deployment, post-deployment validation, documentation, and monitoring using the Execute-Verify-Gate pattern at every step. Designed to prevent token optimization bias through lean orchestration, fresh-context subagent delegation, and binary CLI gate enforcement. Supports multiple deployment strategies (blue-g...

Create user stories with acceptance criteria, technical specifications, and UI specifications through an 8-phase workflow with structural anti-skip enforcement. Prevents token optimization bias through per-phase reference loading, checkpoint persistence, Execute-Verify-Record enforcement, and artifact verification. Use when transforming feature descriptions into structured stories, generating stories from epic features, or creating follow-up stories for deferred work. Supports CRUD, authentic...

W3 compliance scanning with structural anti-skip enforcement. Detects auto-skill chaining violations (skills/commands that auto-invoke other skills without user approval) using the Execute-Verify-Record pattern at every step. Designed to prevent token optimization bias through lean orchestration and binary CLI gate enforcement. Scans subagent files, skill files, and command files for unauthorized Skill() invocations. Use when auditing W3 compliance, checking for auto-skill chaining violations...

Scrape, download, and analyze websites for mockup generation, design system extraction, accessibility auditing, and web development brainstorming. Use this skill whenever the user wants to clone a website's look and feel, reverse-engineer a page's design, capture a site's CSS/JS/HTML structure, extract design tokens (colors, typography, spacing scales), analyze SEO techniques, run a WCAG accessibility audit, crawl multi-level navigation menus, scrape JavaScript-rendered SPAs (React, Next.js, ...

FIDO2/WebAuthn/パスキー関連の実装・設定・ドキュメント・テストを扱う時に使用。パスキー登録、認証、管理、アテステーション検証に関する作業で自動的に呼び出される。

Use when a Spec Kit feature needs `spec.md` authored or rewritten from natural-language requirements, especially when the feature has no usable specification or requirements are too vague for planning.

Recognize when a mission is a bulk edit and drive the occurrence-classification guardrail on the user's behalf. Triggers: user says any variant of "rename X to Y", "change the terminology", "migrate all occurrences", "replace across the codebase", "the X feature is now the Y feature", "sed everywhere", or any request that touches the same identifier/path/key in many files. Also triggers on gate errors mentioning "change_mode", "occurrence_map.yaml", "Bulk Edit Gate: BLOCKED", or "Bulk Edit Re...

Review a fully merged Spec Kitty mission post-merge (all WPs done/approved) to verify spec→code fidelity, FR coverage, drift, risks, and security. Triggers: "review the merged mission", "post-merge mission review", "verify the completed mission", "audit the mission implementation", "mission-level acceptance review", "is this mission releasable", "final review before tagging", "cross-WP coverage audit". Does NOT handle: per-WP review during implementation (use spec-kitty-runtime-review), imple...

Drive REASONS Canvas authoring and review for Spec Kitty missions that opted in to Structured-Prompt-Driven Development (SPDD) via charter selection. Triggers: "use SPDD", "use REASONS", "generate a REASONS canvas", "apply structured prompt driven development", "make this mission SPDD". Does NOT handle: enforcing SPDD on projects whose charter has not selected the doctrine pack (escalate to charter workflow instead). Does NOT mirror code as prose; code remains the source of truth for current ...

Use when Claude Code needs to create, add, restructure, or improve SpecDD `.sdd` contract files, define ownership or write authority, clean up missing or unclear specs, or introduce SpecDD adoption without changing implementation unless explicitly requested.

Use when Claude Code needs to diagnose or fix a bug in a SpecDD project by reproducing or inspecting failure, comparing observed behavior to active `.sdd` contracts, and applying the smallest authorized fix.

Use when Claude Code needs to implement a requested code, docs, tests, task, or spec change in a SpecDD project by following Resolve, Read, Authorize, Change, Verify, and Report under active bootstrap and `.sdd` authority.