Claude Skills by claude-dev-suite

ColBERT / ColBERTv2 late interaction as a first-stage retriever — not just a reranker. MaxSim scoring, PLAID index, Ragatouille for deployment, storage cost of token-level embeddings, when to pick ColBERT over dense-plus-rerank, and fine-tuning for domain. USE WHEN: user mentions "ColBERT", "ColBERTv2", "late interaction", "MaxSim", "PLAID", "Ragatouille", "token-level embeddings", "multi-vector retrieval" DO NOT USE FOR: single-vector dense retrieval - use `vector-stores/qdrant-advanced` o...

Fine-tuning cross-encoders for domain-specific reranking. Training data (query-doc relevance labels, MS MARCO format), sentence-transformers CrossEncoder API, loss functions (BCE, margin), hard negative mining from BM25 and dense retrievers, distillation from strong teacher rerankers (BGE-reranker-v2, Cohere) into small models, NDCG@10 evaluation. USE WHEN: user mentions "fine-tune cross-encoder", "train reranker", "hard negative mining", "MS MARCO triples", "knowledge distillation reranker"...

LLM-as-reranker patterns. RankGPT listwise / pairwise / pointwise prompting, sliding window for long candidate lists, cost-latency vs Cohere Rerank, calibration tricks, structured output for rank lists. Code uses the Anthropic SDK. USE WHEN: user mentions "LLM reranker", "RankGPT", "listwise reranking", "pairwise reranking", "pointwise reranking", "GPT reranker", "Claude reranker" DO NOT USE FOR: standard cross-encoder reranking - use `rag/reranking`; fine-tuning cross-encoders - use `retri...

SPLADE / SPLADE++ learned sparse retrieval in depth. How SPLADE differs from BM25 (learned term expansion), FLOPS regularization, indexing in Qdrant sparse vectors and Elasticsearch, hybrid with dense, efficiency tradeoffs, and when SPLADE beats BM25. USE WHEN: user mentions "SPLADE", "SPLADE++", "learned sparse", "neural sparse", "FLOPS regularization", "sparse vector retrieval", "naver/splade" DO NOT USE FOR: classical BM25 tuning - use `retrieval/bm25-tuning`; dense retrieval - use `vect...

Reviewing C++ code - what to flag, and what the compiler, clang-tidy and sanitizers already flag for you USE WHEN: you are reviewing, critiquing or auditing existing C++ code - a "code review", a "review" of a .cpp/.hpp/.cc/.h file, a diff, a PR or a pull request; deciding what to comment on in C++; avoiding false positives on C++ DO NOT USE FOR: writing, explaining or learning C++ - use `languages/cpp`; anything `-Wall -Wextra`, clang-tidy or a sanitizer run already reports (this skill lis...

Reviewing C# code - what to flag, and what Roslyn analyzers and nullable reference types already flag for you USE WHEN: you are reviewing, critiquing or auditing existing C# code - a "code review", a "review" of a .cs file, a diff, a PR or a pull request; deciding what to comment on in C#; avoiding false positives on C# code DO NOT USE FOR: writing, explaining or learning C# - use `languages/csharp`; anything the built-in Roslyn analyzers or nullable reference types already report (this ski...

Reviewing Go code - what to flag, and what the toolchain already flags for you USE WHEN: you are reviewing, critiquing or auditing existing Go code - a "code review", a "review" of a .go file, a diff, a PR or a pull request; deciding what to comment on in Go; avoiding false positives on Go code DO NOT USE FOR: writing, explaining or learning Go - use `languages/go`; anything `go vet` or a default golangci-lint run already reports (this skill lists those so you can stay silent about them); f...

Reviewing Java code - what to flag, and what javac, the IDE and SpotBugs already flag for you USE WHEN: you are reviewing, critiquing or auditing existing Java code - a "code review", a "review" of a .java file, a diff, a PR or a pull request; deciding what to comment on in Java; avoiding false positives on Java code DO NOT USE FOR: writing, explaining or learning Java - use `languages/java`; anything javac warnings, SpotBugs or a standard Checkstyle run already report (this skill lists tho...

Reviewing Kotlin code - what to flag, and what the compiler, detekt and ktlint already flag for you USE WHEN: you are reviewing, critiquing or auditing existing Kotlin code - a "code review", a "review" of a .kt file, a diff, a PR or a pull request; deciding what to comment on in Kotlin; avoiding false positives on Kotlin code DO NOT USE FOR: writing, explaining or learning Kotlin - use `languages/kotlin`; anything the compiler, detekt or ktlint already reports (this skill lists those so yo...

Reviewing Node.js runtime code - what to flag beyond the language, and what the toolchain already flags USE WHEN: you are reviewing, critiquing or auditing existing Node.js code - a "code review" of server code, a CLI, a script, a diff or a PR - and the concern is the RUNTIME: the event loop, streams, processes, file handles, EventEmitter, unhandled rejections DO NOT USE FOR: language-level review - use `review/typescript` for typed code; Express/NestJS/Fastify routing - use the framework s...

Reviewing Python code - what to flag, and what ruff, mypy and the interpreter already flag for you USE WHEN: you are reviewing, critiquing or auditing existing Python code - a "code review", a "review" of a .py file, a diff, a PR or a pull request; deciding what to comment on in Python; avoiding false positives on Python code DO NOT USE FOR: writing, explaining or learning Python - use `languages/python`; anything ruff's default rules or a configured mypy already reports (this skill lists t...

Reviewing Rust code - what to flag, and what rustc and clippy already flag for you USE WHEN: you are reviewing, critiquing or auditing existing Rust code - a "code review", a "review" of a .rs file, a diff, a PR or a pull request; deciding what to comment on in Rust; avoiding false positives on Rust code DO NOT USE FOR: writing, explaining or learning Rust - use `languages/rust`; anything rustc or a default clippy run already reports (this skill lists those so you can stay silent about them...

Reviewing SQL - what to flag, and what the database and linters actually check for you USE WHEN: you are reviewing, critiquing or auditing existing SQL - a "code review" of a query, a migration, a stored procedure, a view, or ORM-generated SQL in a diff or a PR; deciding what to comment on in SQL; judging whether a query is correct under concurrency and at scale DO NOT USE FOR: writing or learning SQL - use `databases/sql-fundamentals` or `databases/sql-advanced`; vendor-specific tuning - u...

Reviewing Swift code - what to flag, and what the compiler and SwiftLint already flag for you USE WHEN: you are reviewing, critiquing or auditing existing Swift code - a "code review", a "review" of a .swift file, a diff, a PR or a pull request; deciding what to comment on in Swift; avoiding false positives on Swift code DO NOT USE FOR: writing, explaining or learning Swift - use `languages/swift`; anything the compiler or a configured SwiftLint already reports (this skill lists those so yo...

Reviewing TypeScript code - what to flag, and what the compiler and linter already flag for you USE WHEN: you are reviewing, critiquing or auditing existing TypeScript or TSX code - a "code review", a "review" of a .ts/.tsx file, a diff, a PR or a pull request; deciding what to comment on in TypeScript; avoiding false positives on typed JavaScript DO NOT USE FOR: writing, explaining or learning TypeScript - use `languages/typescript`; anything `tsc` under `strict` or a default typescript-es...

age — modern file encryption format and tool by Filippo Valsorda. Replaces GPG for most use cases (encrypted backups, exports, secrets in CI). Covers age CLI, X25519 + Scrypt-based recipients, SSH key recipients, plugin system (YubiKey, Secure Enclave, age-keyring), Rust (`age` crate), Go (filippo.io/age), encrypted backup workflows for wallets. USE WHEN: user mentions "age", "age-encryption", "rage", "filippo.io/age", "ssh-rsa age", "age plugin", "age-yubikey", "age recipient", "age identit...

> **USE WHEN:** Reviewing AI-generated code (GitHub Copilot, ChatGPT, Claude, etc.) for security vulnerabilities, or establishing secure AI coding practices. > **DO NOT USE FOR:** AI/ML model security, prompt injection attacks on AI systems, or general code review.

> **USE WHEN:** Designing, implementing, or auditing REST, GraphQL, or gRPC APIs for security vulnerabilities. > **DO NOT USE FOR:** General API design patterns (use rest-api/graphql skills), authentication setup (use jwt/oauth2 skills).

Audit logging for compliance and security. Structured audit events, immutable logs, user action tracking, database change tracking, and regulatory compliance (SOC2, HIPAA, GDPR). USE WHEN: user mentions "audit log", "audit trail", "activity log", "change tracking", "compliance logging", "who changed what", "SOC2 logging" DO NOT USE FOR: application logging - use logging skills; error tracking - use observability skills

> **USE WHEN:** Securing Docker containers, Kubernetes deployments, or reviewing container configurations. > **DO NOT USE FOR:** General Docker usage (use docker skill), Kubernetes architecture (use kubernetes skill).

CORS configuration and HTTP security headers. CORS middleware, preflight requests, Content-Security-Policy, CSRF protection, Helmet.js, and secure cookie configuration. USE WHEN: user mentions "CORS", "cross-origin", "CSP", "Content-Security-Policy", "CSRF", "security headers", "Helmet", "preflight", "Access-Control" DO NOT USE FOR: authentication tokens - use `jwt` or `oauth2`; encryption - use `cryptography`

C++ memory and concurrency safety: AddressSanitizer (ASan), UndefinedBehaviorSanitizer (UBSan), ThreadSanitizer (TSan), MemorySanitizer (MSan), MSVC `/sdl` and `/guard:cf`, CERT C++ secure coding rules, integer-overflow safe arithmetic, and Control Flow Integrity. USE WHEN: user mentions "ASan", "AddressSanitizer", "UBSan", "TSan", "MSan", "use-after-free", "buffer overflow", "undefined behavior", "data race", "CERT C++", "secure C++", "/sdl", "/GS", "ASLR", "DEP", "stack canary" DO NOT USE...

Application-level cryptography. Password hashing (bcrypt, argon2), encryption (AES-GCM), digital signatures, key management, and secure random generation. USE WHEN: user mentions "encryption", "hashing", "bcrypt", "argon2", "AES", "cryptography", "digital signature", "key management", "HMAC" DO NOT USE FOR: TLS/HTTPS configuration - use infrastructure skills; JWT tokens - use `jwt`; OAuth flows - use `oauth2`

.NET and ASP.NET Core security patterns. Covers Identity, authentication, dependency auditing, secure coding practices, and OWASP for .NET ecosystem. USE WHEN: user works with "C#", ".NET", "ASP.NET Core", "Entity Framework", asks about ".NET vulnerabilities", "NuGet security", ".NET authentication", "Blazor security" DO NOT USE FOR: general OWASP concepts - use `owasp` or `owasp-top-10` instead, Java/Python security - use language-specific skills

GDPR compliance implementation. Data subject rights (access, deletion, portability), consent management, data processing records, PII handling, and privacy by design patterns. USE WHEN: user mentions "GDPR", "data privacy", "right to be forgotten", "data deletion", "consent management", "PII", "data subject request", "privacy policy", "cookie consent" DO NOT USE FOR: authentication - use auth skills; encryption - use `cryptography`; audit logging - use `audit-logging`

Go security patterns for web applications. Covers dependency auditing, secure coding practices, crypto, and OWASP for Go ecosystem. USE WHEN: user works with "Go", "Golang", "Gin", "Fiber", "Echo", asks about "Go vulnerabilities", "Go modules security", "Go injection", "Go authentication" DO NOT USE FOR: general OWASP concepts - use `owasp` or `owasp-top-10` instead, other language security - use language-specific skills

> **USE WHEN:** Securing Terraform, CloudFormation, Ansible, Pulumi, or other IaC configurations. > **DO NOT USE FOR:** General IaC patterns, cloud architecture design, cost optimization.

Java and Spring Boot security patterns. Covers Spring Security, dependency auditing, secure coding practices, and OWASP for Java ecosystem. USE WHEN: user works with "Java", "Spring Boot", "Spring Security", asks about "Java vulnerabilities", "Maven security", "Gradle security", "Java injection", "Java authentication" DO NOT USE FOR: general OWASP concepts - use `owasp` or `owasp-top-10` instead, Node.js/Python security - use language-specific skills

> **USE WHEN:** Securing Kotlin applications (backend/Android), reviewing code for vulnerabilities, or implementing security best practices. > **DO NOT USE FOR:** Code quality issues (use kotlin-quality), general Kotlin patterns, UI/UX concerns.

libsodium — modern, easy-to-use, audited crypto library. Provides authenticated encryption (XSalsa20-Poly1305, XChaCha20-Poly1305, AES-GCM), public-key cryptography (X25519, Ed25519), key derivation (Argon2id, HKDF, BLAKE2b), password hashing, and authenticated streams (secretstream). Wraps NaCl with better defaults. Bindings for Rust (sodiumoxide, libsodium-sys-stable, dryoc), Python (PyNaCl), JS (libsodium-wrappers), Java/Android (lazysodium-android), Swift (Sodium / Clibsodium). USE WHEN:...

Open source license compliance and SPDX standards. Covers license types, compatibility, auditing with license-checker, and SBOM generation. USE WHEN: user mentions "license", "SPDX", "GPL", "MIT", "Apache", asks about "license compatibility", "license-checker", "copyleft", "proprietary compliance", "OSI approved" DO NOT USE FOR: dependency vulnerabilities - use `supply-chain`, security scanning - use `owasp-top-10`, secrets - use `secrets-management`

OWASP Top 10:2025 security vulnerabilities. Covers access control, injection, supply chain, cryptographic failures, and more. Use for security reviews. USE WHEN: user mentions "OWASP 2025", "Top 10", "security review", "vulnerability assessment", asks about "broken access control", "injection", "supply chain", "cryptographic failures", "exception handling" DO NOT USE FOR: general OWASP (2021) - use `owasp` instead, secrets - use `secrets-management`, dependencies - use `supply-chain`

OWASP security guidelines and Top 10 vulnerabilities USE WHEN: user mentions "OWASP", "security audit", "vulnerability scan", asks about "injection", "XSS", "CSRF", "access control", "authentication security" DO NOT USE FOR: OWASP Top 10:2025 specific - use `owasp-top-10` instead

> **USE WHEN:** Securing PHP applications, reviewing code for vulnerabilities, or implementing security best practices. > **DO NOT USE FOR:** Code quality issues (use php-quality), general PHP development patterns.

Python security patterns for Django, FastAPI, and Flask. Covers Bandit, Safety, secure coding practices, and OWASP for Python ecosystem. USE WHEN: user works with "Python", "Django", "FastAPI", "Flask", asks about "Python vulnerabilities", "pip security", "Bandit", "Python injection", "Python authentication" DO NOT USE FOR: general OWASP concepts - use `owasp` or `owasp-top-10` instead, Node.js/Java security - use language-specific skills

Rate limiting and throttling. Token bucket, sliding window, fixed window algorithms. Express rate limit, Spring rate limiting, Redis-based distributed rate limiting, and API quota management. USE WHEN: user mentions "rate limit", "throttle", "API quota", "too many requests", "429", "express-rate-limit", "sliding window", "token bucket" DO NOT USE FOR: circuit breaker patterns - use `resilience-patterns`; DDoS protection - use infrastructure/WAF solutions

Rust security patterns for web applications. Covers memory safety guarantees, dependency auditing, secure coding practices, and OWASP for Rust ecosystem. USE WHEN: user works with "Rust", "Actix", "Axum", "Rocket", "Warp", asks about "Rust vulnerabilities", "cargo audit", "Rust injection", "Rust authentication" DO NOT USE FOR: general OWASP concepts - use `owasp` or `owasp-top-10` instead, other language security - use language-specific skills

Secrets and credentials management. Covers environment variables, secret stores, rotation policies, and detection of leaked secrets. USE WHEN: user mentions "secrets", "credentials", "API keys", "environment variables", ".env", asks about "secret leaks", "vault", "secret rotation", "gitleaks", "secret detection" DO NOT USE FOR: OWASP vulnerabilities - use `owasp-top-10`, supply chain - use `supply-chain`, general security - use `owasp`

Sigstore — keyless signing for software artifacts using OIDC identities and short-lived certificates from Fulcio CA, with Rekor transparency log. Cosign is the CLI for signing/verifying containers, OCI artifacts, blobs, and attestations (SBOMs, provenance). Covers GitHub Actions OIDC integration, policy enforcement (cosign-policy-controller, Kyverno), Notary v2 vs Cosign, and supply-chain attestation patterns (SLSA). USE WHEN: user mentions "Sigstore", "Cosign", "Fulcio", "Rekor", "keyless s...

Software supply chain security. Covers dependency management, SBOM generation, package integrity verification, and CI/CD security. OWASP A03:2025. USE WHEN: user mentions "supply chain", "dependencies", "npm audit", "SBOM", "vulnerable packages", asks about "dependency scanning", "lockfiles", "Dependabot", "typosquatting", "CI/CD security" DO NOT USE FOR: license compliance - use `license-compliance`, secrets - use `secrets-management`, general OWASP - use `owasp-top-10`

> **USE WHEN:** Securing TypeScript/JavaScript applications, reviewing frontend/backend code for vulnerabilities. > **DO NOT USE FOR:** Code quality issues (use typescript-quality), general TypeScript patterns, styling.

NgRx Store, Effects, Entity, and ComponentStore for Angular state management. Covers reactive patterns with signals integration. USE WHEN: user mentions "NgRx", "Angular state management", "NgRx Store", "NgRx Effects", "NgRx Entity", "ComponentStore", "Angular Redux" DO NOT USE FOR: Redux Toolkit - use `redux-toolkit`, Zustand - use `zustand`, Pinia - use `pinia`, simple Angular signals state

Pinia state management for Vue. Covers stores, actions, and getters. Use for Vue 3 state management. USE WHEN: user mentions "pinia", "vue state", "vue store", asks about "defineStore", "vue 3 state management", "composition stores", "vue global state", "storeToRefs", "pinia plugin" DO NOT USE FOR: React apps - use `zustand` or `redux-toolkit`; server data - use composables with fetch/axios; Vuex projects - migrate to Pinia first

Redux Toolkit for React state management. Covers slices, thunks, and RTK Query. Use for complex global state. USE WHEN: user mentions "redux", "redux toolkit", "RTK", "createSlice", asks about "complex state management", "time-travel debugging", "middleware", "thunks", "RTK Query", "global state with DevTools", "enterprise state management" DO NOT USE FOR: simple state - use `zustand`; server data - prefer `tanstack-query`; Vue apps - use `pinia`; small projects - overhead not justified

SWR - React hooks for data fetching with caching. Lightweight alternative to TanStack Query for simple data fetching needs. USE WHEN: user mentions "swr", "stale-while-revalidate", "useSWR", asks about "simple data fetching", "real-time data", "automatic revalidation", "lightweight caching", "vercel data fetching" DO NOT USE FOR: Vue apps - use `pinia` or composables; complex cache management - use `tanstack-query`; client state - use `zustand`

TanStack Query for data fetching. Covers queries, mutations, and caching. Use for server state management in React. USE WHEN: user mentions "tanstack query", "react query", "data fetching", "API calls", asks about "cache management", "mutations", "infinite scroll", "optimistic updates", "prefetching", "server state", "useQuery", "useMutation" DO NOT USE FOR: client state - use `zustand` or `redux-toolkit`; Vue apps - use `pinia` with composables; static data - use React context

Zustand state management for React. Covers stores, actions, and persistence. Use for simple global state management. USE WHEN: user mentions "zustand", "global state", "store", asks about "simple state management", "lightweight state", "create store", "persist state", "middleware", "devtools integration" DO NOT USE FOR: server data - use `tanstack-query` or `swr` instead; Vue apps - use `pinia`; complex async workflows - use `redux-toolkit`

clip-path, masks, backdrop-filter, blend modes, CSS 3D, scroll-driven animations, @property, CSS Houdini.

Radix UI unstyled accessible React components. Headless primitives. USE WHEN: user mentions "Radix", "Radix UI", "headless components", "unstyled primitives", asks about "accessible components", "Radix primitives" DO NOT USE FOR: shadcn/ui (use shadcn-ui skill), styled component libraries (Material-UI, Chakra), Vue/Svelte (use Headless UI)

shadcn/ui component library with Radix primitives and Tailwind CSS. Covers component installation, customization, theming, and common patterns. USE WHEN: user mentions "shadcn", "shadcn/ui", asks about "shadcn components", "installing shadcn", "shadcn setup", "copy-paste components" DO NOT USE FOR: Radix UI only (use radix-ui skill), Tailwind only (use tailwindcss skill), Material-UI, Chakra UI, Ant Design