Claude Skills by aibot88

Inject short-lived, scoped service credentials into Claude Code sessions so agents can reach approved systems without exposing raw secrets.

Audit agent code, prompts, and MCP configuration for prompt-injection surfaces, taint issues, and unsafe tool exposure before shipping.

Guide for reading, interpreting, and applying statutes, regulations, and rules in legal and compliance contexts. Use when the user asks about (1) how to read and interpret statutes, regulations, or rules, (2) statutory interpretation methods and canons of construction, (3) understanding legislative intent, (4) applying statutes to specific legal situations, (5) extracting requirements from legal text, (6) distinguishing between different types of legal requirements, or (7) cross-jurisdictiona...

नेपाली नियमित लेखा परीक्षण (statutory audit under NCA Act 2053)। NFRS अनुपालन, ब्यालेन्स शीट / P&L सत्यापन, लेखा परीक्षण मत। Statutory audit under NCA Act 2053. NFRS compliance, balance sheet/P&L verification, audit opinion. Use for audit planning, NFRS compliance checks, or audit report generation.

Author a self-contained bash script that walks a human through a multi-step demo – pausing between steps so they can read output before proceeding, and asserting expected vs. actual so pass/fail is visible at a glance. Use whenever the user wants a runnable repro, walkthrough, or demonstration with discrete steps: reproducing a bug on a sandbox, showing off correct behavior of an API, narrating a CLI flow, making a script an engineer or a stakeholder can paste into a terminal and run top-to-b...

Stewardship virtues (Care, Curiosity, Humility, Diligence). Use when authoring or auditing a plugin for healthy maintenance posture.

Integrates shadcn/ui into React apps generated from Stitch designs. Component discovery and installation, token alignment with Stitch design system, customization patterns, and blocks (auth, dashboard, sidebar). Use with stitch-react-components or stitch-nextjs-components.

Authenticated Shopify implementation skill for fixing SEO, data quality, and theme issues after an audit or from a specific request. Use when a user wants to fix, implement, update, or roll out changes to product/collection content, SEO fields, image alt text, tags, schema markup, robots rules, internal linking, or other store data that requires Shopify authentication. Supports Admin GraphQL API, theme code, and mixed changes. Do not use for public-only audits (use store-analyzer), non-Shopif...

Personal anecdote and experience storage — save your stories, failures, wins, observations, and quotes with tags for instant retrieval when writing content. Adds authenticity and originality to every piece. The most underrated content differentiator.

strace and ltrace skill for system call and library call tracing. Use when a binary behaves incorrectly without crashing, diagnosing file-not-found errors, permission failures, network issues, or unexpected library calls by tracing syscalls and library function calls. Activates on queries about strace, ltrace, syscall tracing, library interception, ENOENT, EPERM, strace -e, or diagnosing binary behaviour without a debugger.

Architect-level Streamlit development for building, refactoring, debugging, testing, and deploying Streamlit apps (single-page or multipage) with correct rerun/state/caching/fragments, AppTest-based testing, custom components v2, safe theming/CSS, security-by-default, and Playwright MCP end-to-end automation.

Жёсткий No-Go аудит для safety-critical архитектуры, кода и PR: выдаёт PASS/FAIL, блокирующие замечания и обязательные доказательства по таймингам, измерениям и fault-injection. Использовать перед включением силовой части и для спорных safety/timing-изменений; не использовать как обычное обзорное ревью по умолчанию.

Systematically identify and classify threats using the software-centric STRIDE framework across six categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Run a STRIDE threat-modelling pass against an access-surface map a software engineer has already produced for a feature they're about to ship. Use when the engineer has a surface map in hand and wants threats walked across the six STRIDE categories before picking one to harden against. Read-only analysis, not a patch.

Manages Stripe Connect onboarding flows using the stripe-node SDK. Handles account creation, capability requests, OAuth redirects, and payout scheduling via the Stripe Accounts API.

Use the Stripe Link CLI as an agent wallet to create spend requests, generate one-time-use payment credentials, and complete 402 / Machine Payment Protocol (MPP) payment flows on the user''s behalf. Triggers on intents like "buy", "purchase", "pay for", "spend up to <amount>", "complete this 402", or any flow involving link-cli, spend-request, mpp pay, shared payment tokens, or @stripe/link-sdk. Also triggers automatically whenever any tool or API produces a checkout URL, hosted payment page,...

This skill should be used when implementing security for Stripe webhook endpoints, handling "webhook rate limiting", "Stripe secret management", "webhook abuse prevention", "log redaction for billing", "STRIPE_WEBHOOK_SECRET storage", "webhook endpoint protection", "Stripe API key security", "billing security review", "sensitive data in logs", "production webhook hardening", "DDoS protection for webhooks", or when the user asks about securing Stripe webhook endpoints and billing infrastructur...

Use when validating incoming Stripe webhook requests in a Node.js or Next.js backend before processing any payment event. Verifies the `stripe-signature` header against `STRIPE_WEBHOOK_SECRET` using Stripe's HMAC-SHA256 scheme, and rejects replays older than 300 seconds. Do NOT use for general HTTP signature validation (use a generic crypto-signature skill), for processing the webhook payload after signature is confirmed (use payment-provider-router), or for Stripe API calls that are not webh...

Verifies Stripe webhook payload signatures using the Stripe.js SDK and the stripe.webhooks.constructEvent method. Validates the Stripe-Signature header against the raw request body and a configured endpoint secret. Handles tolerance windows for replay attack prevention and logs verification failures to Datadog via the Datadog Logs API.

Use when asked to map, crosswalk, align, compare, or gap-analyze any two cybersecurity frameworks, control catalogs, or regulatory requirements using NIST IR 8477 Set-Theory Relationship Mapping (STRM). Triggers on terms like "map controls", "crosswalk", "framework alignment", "gap analysis", or producing a STRM CSV output file.

Contexto completo del proyecto Structify CLI. Leer SIEMPRE al inicio de cualquier sesión de trabajo en este proyecto antes de tocar código, planificar tareas, o responder preguntas sobre la arquitectura.

Performs a structured five-stage code review covering requirements compliance, correctness, code quality, testing, and security/performance. Each stage uses targeted checklists and categorized feedback (Blocker/Major/Minor/Nit) with actionable suggestions and rationale. Use when the user asks for code review, PR feedback, pull request review, or wants their code checked for bugs, style issues, or vulnerabilities — triggered by phrases like "review my code", "check this PR", "review my changes...

Audit adaptive learning and student personalization systems for pedagogical quality. Use when you need to evaluate learning path algorithms (branching, remediation, acceleration), mastery detection models (Bayesian, IRT, threshold-based), knowledge graph prerequisite accuracy, recommendation engine fairness and bias, spaced repetition and interleaving, WCAG 2.1 AA and Section 508 accessibility compliance, IEP/504 accommodation implementation, xAPI/SCORM/LTI data integration, or teacher/studen...

Audit a media production studio or post-production facility. Analyzes facility scheduling and utilization, equipment lifecycle tracking, editorial and VFX pipelines, color grading and finishing workflows, digital asset management (MAM/DAM), IMF/MXF format compliance, SMPTE standards adherence, content security posture (TPN readiness), and talent/crew coordination systems.

Identifies the real underlying study design used in a medical or biomedical paper, distinguishes primary and secondary design components when papers are hybrid, and converts the paper into an evidence-aware design label suitable for literature appraisal, evidence grading, and downstream review workflows. Always identify the actual design from what the study did, not from how the authors describe it. Never fabricate references, metadata, or study features.

Subfinder is a passive subdomain discovery tool by ProjectDiscovery that finds valid subdomains for websites using curated online sources. Optimized for speed and stealth, it integrates cleanly into security reconnaissance pipelines via stdin/stdout support.

使用 subfinder 进行被动子域名枚举。当需要发现目标域名的子域名、扩展攻击面时使用。subfinder 是 ProjectDiscovery 出品的被动子域名发现工具，聚合 Shodan、Censys、SecurityTrails、VirusTotal 等多数据源，快速且隐蔽。任何涉及子域名枚举、攻击面发现、被动信息收集的场景都应使用此技能

Add Sui zkLogin for Google, Apple, Facebook, or Twitch sign-in. Use when the user mentions zkLogin, social login, or OAuth-based Sui auth.

Implement Supabase across different app architectures: Next.js SSR with server components using service_role and client components with anon key, SPA (React/Vue), mobile (React Native), serverless (Edge Functions), and multi-tenant with schema-per-tenant or RLS isolation. Use when choosing how to integrate Supabase into your specific stack, setting up SSR auth flows, configuring mobile deep links, or designing multi-tenant data isolation. Trigger with phrases like "supabase next.js", "supabas...

Implement Supabase Auth (signUp, signIn, OAuth, session management), Storage (upload, download, signed URLs, bucket policies), and Realtime (Postgres changes, broadcast, presence). Use when building user auth flows, file upload features, or live-updating UIs with Supabase. Trigger with phrases like "supabase auth", "supabase storage upload", "supabase realtime subscribe", "supabase oauth", "supabase file upload", "supabase presence", "supabase rls storage".

This skill should be used when configuring Supabase authentication, setting up auth providers, managing users, working with JWTs, or implementing auth flows in applications. Trigger when: "Supabase auth", "authentication", "sign up", "sign in", "OAuth provider", "auth configuration", "JWT", "auth.users", "auth.uid()", "secret key", "service role key", "publishable key", "anon key", "user management", "auth hooks", "Custom Access Token Hook", "asymmetric JWT", "JWKS", "JWT signing keys", "anon...

Diagnose and fix Supabase errors across PostgREST, PostgreSQL, Auth, Storage, and Realtime. Use when encountering error codes like PGRST301, 42501, 23505, or auth failures. Use when debugging failed queries, RLS policy violations, or HTTP 4xx/5xx responses. Trigger with "supabase error", "fix supabase", "PGRST", "supabase 403", "RLS not working", "supabase auth error", "unique constraint", "foreign key violation".

Implement GDPR/CCPA compliance with Supabase: RLS for data isolation, user deletion via auth.admin.deleteUser(), data export via SQL, PII column management, backup/restore workflows, and retention policies. Use when handling sensitive data, implementing right-to-deletion, configuring data retention, or auditing PII in Supabase database columns. Trigger: "supabase GDPR", "supabase data handling", "supabase PII", "supabase compliance", "supabase data retention", "supabase delete user", "supabas...

Collect Supabase diagnostic info for troubleshooting and support tickets. Use when debugging connection failures, auth issues, Realtime drops, Storage errors, RLS misconfigurations, or preparing a support escalation. Trigger: "supabase debug", "supabase diagnostics", "supabase support bundle", "collect supabase logs", "debug supabase connection".

Deploy and manage Supabase projects in production. Covers database migrations, Edge Functions deployment, secrets management, zero-downtime rollouts, blue/green branching, rollback procedures, and post-deploy health checks. Use when deploying Supabase to production, running migrations, deploying Edge Functions, managing secrets, or implementing zero-downtime deployments. Trigger: "deploy supabase", "supabase migration push", "deploy edge function", "supabase rollback", "supabase blue green", ...

This skill should be used when developing, deploying, or managing Supabase Edge Functions, working with Deno in Supabase, or building serverless endpoints. Trigger when: "edge function", "deploy function", "supabase functions", "Deno function", "serverless endpoint", "functions serve", "functions deploy", "create function", "webhook handler", "Supabase function secrets", "function logs", "supabase functions new", "invoke function", "edge runtime", "Deno.serve", "Supabase Cron", "scheduled fun...

Implement custom role-based access control via JWT claims in Supabase: app_metadata.role, RLS policies with auth.jwt() role extraction, organization-scoped access, and API key scoping. Use when implementing role-based permissions, configuring organization-level access, building admin/member/viewer hierarchies, or scoping API keys per role. Trigger: "supabase RBAC", "supabase roles", "supabase permissions", "supabase JWT claims", "supabase organization access", "supabase custom roles", "supaba...

Expert guide for Supabase integration - database schemas, RLS policies, auth, Edge Functions, and real-time subscriptions. Use when working with Supabase backend features.

Install and configure Supabase SDK, CLI, and project authentication. Use when setting up a new Supabase project, installing @supabase/supabase-js, configuring environment variables, or initializing the Supabase client. Trigger with "install supabase", "setup supabase", "supabase auth config", "configure supabase", "supabase init", "add supabase to project".

Supabase MCP Server is built around Supabase developer platform. The underlying ecosystem is represented by supabase/supabase (99,546+ GitHub stars). It gives an agent a more technical and reliable way to work with the tool than a thin one-line wrapper, using stable interfaces like PostgREST, Auth, Storage, Realtime, Edge Functions, RLS and preserving the operational context [&hellip;]

Configure Supabase across development, staging, and production with separate projects, environment-specific secrets, and safe migration promotion. Use when setting up multi-environment deployments, isolating dev from prod data, configuring per-environment Supabase projects, or promoting migrations through environments. Trigger: "supabase environments", "supabase staging", "supabase dev prod", "supabase multi-project", "supabase env config", "database branching".

Enforce organizational governance for Supabase projects: shared RLS policy library with reusable templates, table and column naming conventions, migration review process with CI checks, cost alert thresholds, and security audit scripts scanning for common misconfigurations. Use when establishing Supabase standards across teams, creating RLS policy templates, setting up migration review workflows, or auditing existing projects for security and cost issues. Trigger with phrases like "supabase g...

Execute Supabase production deployment checklist covering RLS, key hygiene, connection pooling, backups, monitoring, Edge Functions, and Storage policies. Use when deploying to production, preparing for launch, or auditing a live Supabase project for security and performance gaps. Trigger with "supabase production", "supabase go-live", "supabase launch checklist", "supabase prod ready", "deploy supabase", "supabase production readiness".

This skill should be used when managing Supabase projects or organizations, creating new projects, listing projects, checking project status, retrieving API keys, pausing or restoring projects, or working with project costs and billing. Trigger when: "create Supabase project", "list Supabase projects", "Supabase API keys", "pause project", "restore project", "Supabase organization", "project cost", "get project URL", "publishable key", "secret key", "anon key", "service role key", "asymmetric...

Manage Supabase rate limits and quotas across all plan tiers. Use when hitting 429 errors, configuring connection pooling, optimizing API throughput, or understanding tier-specific quotas for Auth, Storage, Realtime, and Edge Functions. Trigger: "supabase rate limit", "supabase 429", "supabase throttle", "supabase quota", "supabase connection pool", "supabase too many requests".

This skill should be used when working with Supabase Realtime, setting up database change listeners, implementing presence, using broadcast channels, or building real-time features. Trigger when: "Supabase Realtime", "realtime subscription", "listen for changes", "database changes", "broadcast", "presence", "WebSocket", "channel", "real-time updates", "subscribe to table", "Postgres changes", "supabase.channel", "realtime configuration", "realtime authorization", "broadcast from database", "r...

Design Supabase Postgres schema from business requirements with migrations, RLS, and types. Use when translating specifications into database tables, creating migration files, adding Row Level Security policies, or generating TypeScript types from schema. Trigger with phrases like "supabase schema", "design database supabase", "schema from requirements", "supabase migration", "supabase tables from spec".

Apply production-ready Supabase SDK patterns for TypeScript and Python projects. Use when implementing queries, auth, realtime, storage, or RPC calls with @supabase/supabase-js or supabase-py. Trigger with phrases like "supabase SDK patterns", "supabase query", "supabase typescript", "supabase python", "supabase client setup", "supabase realtime", "supabase auth", "supabase storage".

Apply Supabase security best practices: anon vs service_role key separation, RLS enforcement, policy patterns, JWT verification, and API hardening. Use when securing a Supabase project, auditing API key usage, implementing Row Level Security, or running a production security checklist. Trigger with phrases like "supabase security", "supabase RLS", "secure supabase", "supabase API key", "supabase hardening", "row level security", "service role key".

Audit de sécurité complet pour les projets Supabase. Lance un pentest automatisé qui vérifie RLS, buckets, auth, keys exposées, et génère un rapport avec remediation. Utiliser quand l'utilisateur dit "audit supabase", "sécurité supabase", "vérifier mon supabase", ou veut s'assurer que son backend Supabase est sécurisé.