Claude Skills by crewforth

Versioning and CHANGELOG: SemVer mapped from Conventional Commits, Keep a Changelog format, tagging, pre-release gates. Use when cutting a version: bumping, writing the CHANGELOG entry, or tagging.

Stack-agnostic security audit: map the attack surface, trace untrusted input to dangerous calls, surface dependency and configuration flaws. Severity-ranked report with fixes. Use when auth, input handling, secrets or dependencies change, and before a release.

SonarQube quality gate, any language, no company server needed: run SonarQube Community Build locally (Docker), read the real gate + issues, fix by rule id, re-scan and diff. A linter's green build is a pre-check, never the gate.

Spec-first planning: task breakdown, measurable acceptance criteria, dependency order, risk priority. crew-planner applies it; the plan goes to docs/PLAN.md. Use when the scope is unclear or the work spans more than one change.

Root-cause a bug before touching a fix: reproduce, isolate, form and test a hypothesis, confirm the cause, then fix and verify. Stops guess-driven patching. For persistent, intermittent, or "already tried a few things" bugs.

The how of testing: pyramid, AAA, isolation, risk coverage, determinism. Guarantees the DoD's "tests are green". crew-test-expert applies it. Use when writing or changing tests, or when a suite is flaky, slow or green for the wrong reason.

Scope a security audit BEFORE scanning, to cut false positives: map assets, entry points, trust boundaries and 5-8 domain-specific attack classes into a parseable THREAT_MODEL.md. A threat survives a patch; a vulnerability is only evidence for one. Feeds security-scan.

Isolate risky or parallel file-mutating work in a git worktree so the main tree's uncommitted changes are never clobbered. For fan-out agents that edit files, throwaway experiments, or any change you may want to discard cleanly.