All authors
Claude Skills by jeremylongshore
github.com/jeremylongshore5,187 skills76 installs8,596 views
- Agent Context Loader'Execute proactive auto-loading: automatically detects and loads agents.mdVotes: 0GitHub stars: 2,719
- Audit Tests"Diagnostic-only test suite auditor. Classifies repo type, maps against\Votes: 0GitHub stars: 2,719
- Validate SkillmdValidate a SKILL.md file against the four-tier validation system: Tier 0 (locate), Tier 1 (standard or marketplace grading per the IS 100-point rubric), Tier 2 (static production gate — allowed-tools accuracy, auth protocol, dead code, tool safety, orchestration bounds), and Tier 3 (JRig 7-layer behavioral eval, opt-in via --thorough). Use when creating a new skill, checking skill quality, preparing for marketplace submission, running deep quality analysis, or gating a skill for production. T...Votes: 0GitHub stars: 2,719
- J RigSkill Refiner, the eval-guided improvement loop for SKILL.md files. Runs the bootstrap, score, propose, apply, and status cycle as a thin wrapper over the published @intentsolutions/refiner CLI, proposing safe, minimal, bounded SKILL.md edits and accepting an edit only when a held-out eval score strictly improves with no regression on any other case. Ships a 3-layer cost-tiered hook architecture (sinker, line, hook) that gates skill quality at edit time, end of turn, and commit time. Use when...Votes: 0GitHub stars: 2,719
- Coreweave Fabric DiagnosticsDiagnose the most expensive silent failure on a CoreWeave multi-node GPU job: GPUDirect RDMA falling back from InfiniBand to TCP. When NCCL drops from NET/IB to NET/Socket, collectives keep running with NO error but throughput collapses (commonly 5-20x slower) while every GPU still bills at full rate — 5x the GPU bill for the same work, invisibly. Paste an NCCL_DEBUG=INFO log (and/or a pod-spec, ibstat, or all_reduce_perf output) and the bundled deterministic script verdicts whether RDMA is a...Votes: 0GitHub stars: 2,719
- Coreweave Gpu Cost Leak HunterHunt down CoreWeave GPU cost leaks — idle reserved capacity, wrong-GPU-type right-sizing waste, allocated-but-idle instances, and on-demand spend that should be committed — then produce a CFO-grokkable, dollar-ranked FinOps report. CoreWeave ships no cost dashboard and no billing API, so the spend view is built from PromQL against its managed Grafana. Use when a user asks why their CoreWeave GPU bill is high, wants to find wasted GPU spend or idle reservations, or needs a GPU FinOps cost repo...Votes: 0GitHub stars: 2,719
- Coreweave Gpu Node ForensicsTriage a dead or degraded GPU on a CoreWeave node fast — decide reschedule vs GPU-reset vs node-reboot vs RMA from an Xid code or a pasted dmesg / nvidia-smi blob, so a bad card does not silently kill a multi-day training run. Use when a GPU throws an Xid error, a node "fell off the bus", a training run stalls or NCCL hangs on one rank, or you need to know whether to replace, reset, or just reschedule. Trigger with "xid error", "gpu fell off the bus", "coreweave gpu dead", "should I RMA this ...Votes: 0GitHub stars: 2,719
- Databricks Bundle MedicFix the deploy-time foot-guns of Databricks Asset Bundles (DAB) and the infrastructure operations around them: the bundle-bind gap for UC catalogs and external locations, the "unexpected EOF reading terraform.tfstate" redeploy failure, the schema-GRANT-ordering bug that fails the first deploy, customer-managed-key (CMK) rotation that requires draining the whole workspace, and the PrivateLink cost leak where S3/STS/Kinesis still traverse the NAT. Includes a PreToolUse hook that backs up and va...Votes: 0GitHub stars: 2,719
- Databricks Cluster ForensicsDiagnose broken or unexplained Databricks compute — slow cold starts, failed cluster launches, Photon paying its premium without the speedup, DBR-upgrade landmines, and spot-interruption shuffle aborts — by correlating a cluster's live event stream across API surfaces. Use when a Databricks cluster won't start, died mid-run, is randomly slow to start, when planning a Databricks Runtime upgrade, or when a job keeps failing on spot loss. Trigger with "databricks cluster won't start", "cluster f...Votes: 0GitHub stars: 2,719
- Databricks Cost Leak HunterHunt down Databricks cost leaks — wasted DBUs, idle clusters, oversized SQL warehouses, and untagged runaway spend — and produce a FinOps cost report. Use when a user asks why their Databricks bill is high, wants to find cost leaks / wasted DBUs / idle clusters, or needs a FinOps cost report. Trigger with "databricks cost", "why is my databricks bill", "find wasted spend", "cost leak".Votes: 0GitHub stars: 2,719
- Databricks Streaming GuardianGuard production Databricks data pipelines — Delta Lake, Liquid Clustering, Structured Streaming, Auto Loader, and DLT — against the twelve foot-guns that fire at scale: OPTIMIZE/auto-compaction conflicts, Liquid-Clustering merge conflicts, VACUUM breaking a streaming checkpoint, RocksDB OOM, Auto Loader schema-evolution stops, and DLT refresh data loss. Includes a PreToolUse hook that blocks DROP/CREATE-OR-REPLACE/VACUUM on a table with active streaming consumers. Use when a Delta MERGE/OPTI...Votes: 0GitHub stars: 2,719
- Databricks Uc Migration PilotPilot a Databricks Hive Metastore (HMS) → Unity Catalog (UC) migration before the deadline — audit every table's migratability, produce a dependency-ordered migration plan, trace UC's two-level permission model, and pick an environment isolation pattern. Use when a user asks how to migrate off the Hive metastore, move to Unity Catalog, which tables are UC-ready, why a table won't migrate, why a user lacks access after migration, or how to isolate dev/test/prod under UC. Trigger with "migrate ...Votes: 0GitHub stars: 2,719
- Langchain Ci Integration"Wire LangChain 1.0 / LangGraph 1.0 tests into a GitHub Actions pipeline\Votes: 0GitHub stars: 2,719
- Langchain Common Errors"Paste-match catalog of 14 real LangChain 1.0 / LangGraph 1.0 exceptions\Votes: 0GitHub stars: 2,719
- Langchain Cost Tuning'Control LangChain 1.0 AI spend with accurate streaming token accounting,Votes: 0GitHub stars: 2,719
- Langchain Data Handling"Load and chunk documents for LangChain 1.0 RAG pipelines correctly \u2014\Votes: 0GitHub stars: 2,719
- Langchain Debug Bundle"Produce a reproducible, sanitized diagnostic bundle for a LangChain\Votes: 0GitHub stars: 2,719
- Langchain Deploy IntegrationDeploy a LangChain 1.0 / LangGraph 1.0 app to Cloud Run, Vercel, or LangServe correctly — with timeouts sized for chain length, cold-start mitigation, SSE anti-buffering headers, and Secret Manager over .env. Use when prepping a first production deploy, debugging a stream that hangs behind a proxy, or diagnosing p99 latency spikes. Trigger with "langchain deploy", "langchain cloud run", "langchain vercel python", "langchain langserve", or "langchain docker".Votes: 0GitHub stars: 2,719
- Langchain Enterprise Rbac"Enforce tenant isolation and role-based access across LangChain 1.0\Votes: 0GitHub stars: 2,719
- Langchain Incident Runbook"Triage LangChain 1.0 / LangGraph 1.0 production incidents \u2014 LLM-specific\Votes: 0GitHub stars: 2,719
- Langchain Local Dev Loop"Build a fast, deterministic local test loop for LangChain 1.0 / LangGraph\Votes: 0GitHub stars: 2,719
- Langchain Multi Env Setup"Build reliable dev / staging / prod isolation for LangChain 1.0 services\Votes: 0GitHub stars: 2,719
- Langchain Observability"Wire LangSmith tracing and custom metric callbacks into a LangChain\Votes: 0GitHub stars: 2,719
- Langchain Performance Tuning"Tune LangChain 1.0 / LangGraph 1.0 Python chains and agents for throughput,\n\Votes: 0GitHub stars: 2,719
- Langchain Rate Limits"Rate-limit LangChain 1.0 calls correctly across multi-worker deployments\Votes: 0GitHub stars: 2,719
- Langchain Reference Architecture"A reference layered architecture for production LangChain 1.0 / LangGraph\Votes: 0GitHub stars: 2,719
- Langchain Sdk Patterns'Compose LangChain 1.0 Python runnables with the production defaultsVotes: 0GitHub stars: 2,719
- Langchain Security Basics"Harden a LangChain 1.0 chain or LangGraph agent against prompt injection,\Votes: 0GitHub stars: 2,719
- Langchain Upgrade Migration"Migrate a LangChain 0.3.x Python codebase to LangChain 1.0 / LangGraph\Votes: 0GitHub stars: 2,719
- Langchain Webhooks Events"Dispatch LangChain 1.0 chain/agent events to external systems \u2014\Votes: 0GitHub stars: 2,719
- Agent Safety PreflightGenerate a local repository risk receipt before Claude Code or other AI-agent edits. Use when the user asks to prepare a repository for agent changes, check for risky hooks or credential-writing automation, or run the /agent-preflight command. Trigger with "run agent preflight", "check this repo before agent edits", or "/agent-preflight".Votes: 0GitHub stars: 2,719
- Analyzing Tls ConfigAnalyze a target's TLS configuration — negotiated protocol version, cipher suite, certificate chain, expiry, and downgrade vectors. Use when: SOC2 auditor flagged your endpoint for "weak TLS" but you don't know which control failed (TSC CC6.7 transmission integrity vs CC6.6 encryption) or which cipher is the problem. Threshold: any negotiated TLSv1.0 or TLSv1.1, OR a cipher with RC4 / 3DES / null / EXPORT, OR a cert with under 30 days to expiry, OR a chain that fails hostname verification. Tr...Votes: 0GitHub stars: 2,719
- Auditing Cors PolicyAudit a target's CORS posture — Access-Control-Allow-Origin handling, reflected-origin bypass, credentials+wildcard mismatch, preflight OPTIONS behavior, Vary header correctness. Use when: a third-party integration is failing CORS preflight and someone proposes "just set Allow-Origin to *" as the fix, OR your bug-bounty inbox has a credential-reuse exploit chain. Threshold: any reflection of arbitrary Origin into Allow-Origin, Allow-Credentials:true with wildcard origin (browser-rejected comb...Votes: 0GitHub stars: 2,719
- Auditing Npm DependenciesAudit a Node.js project's installed npm dependency tree for known CVEs by wrapping the npm audit JSON output and emitting findings in the canonical penetration-tester schema. Detects direct AND transitive vulnerabilities, normalizes npm's severity scale (info/low/moderate/ high/critical) to the shared Severity enum, and parses both v1 and v2 audit output formats so the skill works against npm 6 and npm 7+ lockfiles. Use when: pre-merge gate on a Node project, post-incident sweep after a trans...Votes: 0GitHub stars: 2,719
- Auditing Python DependenciesAudit a Python project's installed dependencies for known CVEs by wrapping pip-audit (PyPA's official vulnerability auditor) and emitting findings in the canonical penetration-tester schema. Detects vulnerable direct AND transitive packages, normalizes pip-audit's severity output via OSV severity bands, falls back to pip list --outdated when pip-audit isn't installed, and supports requirements.txt, pyproject.toml (PEP 621), Pipfile.lock, and poetry.lock as input sources. Use when: pre-merge g...Votes: 0GitHub stars: 2,719
- Checking Http Security HeadersAudit a target's HTTP security headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the Cross-Origin trio (COOP, COEP, CORP). Use when: SOC2 / PCI auditor flagged "missing security headers" or a Mozilla Observatory grade is below B, OR you need HSTS preload eligibility for chrome://net-internals. Threshold: any missing required header on production HTML response, HSTS max-age below 31536000s (preload requirement), CSP with 'unsafe-inline' or '...Votes: 0GitHub stars: 2,719
- Checking License ComplianceAudit a project's dependency licenses against an explicit policy (allow-list / deny-list / review-required) and flag incompatibilities before they ship to production. Reads SPDX license identifiers from npm package manifests, Python METADATA / PKG-INFO files, and pyproject.toml; classifies each license by family (permissive, weak-copyleft, strong-copyleft, proprietary, unknown); detects copyleft contamination and SPDX-incompatible license combinations. Use when: pre-release legal review, M&A ...Votes: 0GitHub stars: 2,719
- Composing Vulnerability ReportRead findings JSONL files from cluster 1-4 skills, deduplicate by fingerprint, group by severity, and compose a deliverable- grade markdown vulnerability report with per-finding sections (title, severity, target, detail, remediation, evidence) and a top-level summary table. The canonical written artifact a customer receives at engagement close; precise, reproducible, machine- checkable against source findings. Use when: closing an engagement, generating an interim report, regenerating after C...Votes: 0GitHub stars: 2,719
- Confirming Pentest AuthorizationVerify that a penetration test has explicit, written, signed authorization before any scanning begins. Reads a Rules-of- Engagement (ROE) attestation file, validates required fields (authorizer, in-scope targets, time window, emergency contact, signature), checks the signer against an allowlist, and emits a CRITICAL finding if anything is missing. Designed as the first skill the orchestrator routes to. Use when: starting a new engagement, after a scope change, or before any cluster 1-4 scan s...Votes: 0GitHub stars: 2,719
- Defining Pentest ScopeParse the ROE scope definition, enumerate every in-scope target (hostnames, IPs, CIDRs, URLs, cloud accounts, SaaS tenants), validate syntax, detect overlap with out-of-scope or known third-party SaaS ranges, and emit a normalized target list plus IP allowlist for scanning tools. Runs after confirming-pentest- authorization and before any cluster 1-4 scan. Use when: starting an engagement, expanding scope mid-engagement, validating that a target list matches the ROE, or generating an allowlis...Votes: 0GitHub stars: 2,719
- Detecting Command Injection PatternsScan a source tree for command-injection vulnerable patterns: shell=True calls in Python subprocess, os.system / os.popen with interpolated strings, Node child_process.exec with template literals, Ruby backticks / Kernel#system / Kernel#exec with interpolation, Go exec.Command with shell wrapping, PHP system / passthru / shell_exec / backticks with $-interpolation, Java Runtime.exec with concatenated args. Use when: pre-commit gate on code that calls out to shell utilities, audit of file-proc...Votes: 0GitHub stars: 2,719
- Detecting Debug EndpointsProbe a target for accidentally-public admin / debug / introspection endpoints — Spring Boot Actuator, Apache server-status, Prometheus metrics, GraphQL playground, Swagger UI, phpMyAdmin, JMX-over-HTTP (Jolokia), Elasticsearch _cat, Kibana / Grafana / Eureka / Consul panels. Use when: post-deploy verification, security audit before SOC2, inheriting a system you didn't build, or a bug bounty hints at an exposed introspection panel. Threshold: any of the canonical 40+ admin/debug paths returns...Votes: 0GitHub stars: 2,719
- Detecting Directory ListingProbe a target for directories that return auto-generated index listings instead of denying or serving a specific file — exposes the full file tree under any reachable directory, including files the application never linked to. Use when: post-deploy verification on a static-asset host, security audit before SOC2, or following up on a finding from skill #6 (exposed-files) where a backup-file path returned 200 with HTML body instead of the expected file content (suggests autoindex serving a dir...Votes: 0GitHub stars: 2,719
- Detecting Eval Exec UsageScan a source tree for dynamic-code-execution APIs that an attacker can hijack: Python eval / exec / compile, JavaScript eval / Function() / setTimeout(string), Ruby eval / instance_eval / class_eval, Java ScriptEngine, PHP eval / assert($str), .NET Activator.CreateInstance / Reflection.Emit with dynamic input. Use when: pre-commit gate on any application that parses user-uploaded code (rule engines, formula evaluators, plugin systems), or post-bug-report when "we run user-supplied expression...Votes: 0GitHub stars: 2,719
- Detecting Exposed Secrets FilesProbe a target for accidentally-served secret-bearing files in the web root — .git/, .env, .DS_Store, backup files, database dumps, key files, CI configs, IDE configs. Use when: post-deploy verification on a new release, or SOC2 auditor asked "what's reachable in the web root that shouldn't be," or a bug-bounty report hints at a leaked file. Threshold: any of the canonical 40+ paths returns 200 OR returns a body matching the expected fingerprint of the file type (e.g., .git/HEAD returns conte...Votes: 0GitHub stars: 2,719
- Detecting Insecure DeserializationScan a source tree for unsafe-by-default deserialization APIs: Python pickle.loads / cPickle / shelve / dill, Ruby Marshal.load / YAML.load (pre-3.1 default), Java ObjectInputStream.readObject, PHP unserialize, .NET BinaryFormatter / NetDataContractSerializer, Node.js node-serialize, JavaScript JSON.parse with reviver containing eval. Use when: pre-commit gate on services that accept binary blobs, audit of legacy job-queue code (workers deserializing tasks), post-bug-report when "we accept us...Votes: 0GitHub stars: 2,719
- Detecting Sql Injection PatternsScan a source tree for SQL-injection vulnerable patterns: string concatenation into queries, f-string interpolation in SQL, string-format substitution into raw queries, deprecated cursor methods (cursor.execute with % formatting), Knex / Sequelize raw() with template interpolation, sequelize.query with replacements. Use when: pre-commit code review, post-feature SQL-touching release, inheriting a legacy codebase that predates ORMs, or post-bug-report investigation. Threshold: any source line ...Votes: 0GitHub stars: 2,719
- Detecting Ssl Cert IssuesAudit a target's TLS certificate beyond protocol/expiry — chain ordering, OCSP stapling, revocation status, Certificate Transparency presence, key-usage flags, and over-broad wildcards. Use when: TLS handshake already passes (skill #1 analyzing-tls-config cleared) but you suspect the cert posture is fragile. Auditors flag this during SOC2 readiness when a renewal slipped or an intermediate was rotated. Threshold: missing OCSP stapling on production, fewer than 2 SCTs in the cert, intermediate...Votes: 0GitHub stars: 2,719
- Detecting Weak CryptographyScan a source tree for weak cryptographic primitives: MD5 / SHA-1 used for security purposes, DES / 3DES / RC4 ciphers, ECB block mode, custom-built crypto (XOR loops, hand-rolled HMAC), hardcoded IVs, predictable random (Math.random / java.util.Random for crypto seeds), missing certificate verification (verify=False, rejectUnauthorized: false). Use when: pre-merge gate on crypto-touching code, audit before SOC2 / PCI assessment, post-incident review when "we found a weakness in our token sig...Votes: 0GitHub stars: 2,719
- Fingerprinting Server SoftwareIdentify the server software, framework, and component versions a target is running from its HTTP response signatures — Server header, X-Powered-By, Via, X-AspNet-Version, X-Runtime, X-Drupal-Cache, X-Generator, Set-Cookie name patterns, error-page artwork, HTTP method behavior signatures. Use when: penetration test reconnaissance phase, post-deploy audit of fingerprintable exposure, or before reporting "no obvious version disclosure" to an auditor. Threshold: any version string in a response...Votes: 0GitHub stars: 2,719