Claude Skills by kensaurus

Polish an existing React Native screen to feel intentional, native, and human-crafted. Use for "this screen looks off", "feels clunky on iOS", "Android version looks wrong", "jank when scrolling", "button is unreachable", or any RN-specific UX polish pass.

Pass/fail health check across every Mushi Mushi pipeline component — CLI credentials, API reachability, edge functions, BYOK key pool, QA cron. Use when "is mushi working", "mushi health check", "check mushi pipeline", "mushi deploy check", "pipeline not responding", or right after setup.

Full end-to-end Mushi Mushi integration smoke test: bug capture → AI triage → story mapping → TDD test generation → approval → execution → PDCA cycle. Use when "test mushi integration", "verify full pipeline", "mushi e2e check", "does mushi work end-to-end", "smoke test mushi", or after deploying changes.

Audit a site for answer-engine / GEO citation readiness (ChatGPT, Perplexity, AI Overviews), then a phased plan. Use when "AEO", "GEO", "show up in ChatGPT/Perplexity", "AI search visibility", "llms.txt", or "am I blocking AI crawlers". Classic SEO meta/sitemap → enhance-web-seo.

Plan-only authenticity / AI-slop audit across prose, UI, code, and IA. Use when "looks like AI slop", "reads like ChatGPT", or "authenticity burndown". One-page UX apply → enhance-web-ux. Visual polish → enhance-web-ui.

Audit App Store and Google Play listings for discoverability and conversion — keywords, localized metadata, screenshots, ratings prompts — then emit a prioritized ASO plan. Use when "optimize our store listing", "improve app downloads", or "ASO". Submission mechanics → plan-mobile-readiness. Plan only.

Audit whether a project can actually recover from data loss — not just whether backups exist — then emit a phased DR plan. Use when "can we recover if the DB dies", "audit our backups", "what's our RPO/RTO", or "disaster recovery". Plan only. Destructive-op gates stay on plan-data-integrity.

Plan-only Capacitor/Ionic native-layer security audit: WebView, token storage, deep links/OAuth, cleartext traffic, exported activities. Use when "is my Capacitor app secure?", "harden my hybrid app", or pre-store hardening. Store readiness → plan-mobile-readiness.

Audit a project for destructive-operation and migration safety gaps, then produce a phased safeguard plan. Use when "is my migration safe", "could I lose data", "my agent might delete prod", or "safe schema changes". Restore drills and RPO/RTO belong to plan-backup-dr. Source transforms → audit-codemod-safety.

Configuration-first dead-code audit — Knip baseline for unused files, exports and deps, plus duplication, debug residue, suppression debt, orphan assets, env and schema drift. Emits a ratchet plan; deletes nothing. Use when "find dead code", "is this code used", "unused exports". Apply → housekeep-dead-code.

Audit dependencies for hallucinated or slopsquatted packages, supply-chain risk, and licensing gaps, then a remediation plan. Use when "check my dependencies", "is this package real", "slopsquatting", "SBOM", or "did the AI hallucinate a package".

Audit documentation against actual code behavior and plan corrections — no rewrites in this pass. Use when asked to "docs drift", "sync docs with code", "audit documentation", "stale README", "onboarding docs broken", "doc sync plan", "phantom docs", or "docs out of date". Why-we-chose-X / ADRs → docs-adr.

Audit silent failures and observability gaps (Sentry/Langfuse), then a phased plan — no implementation. Use when "errors aren't showing in Sentry", "things fail silently", or "empty catch blocks". Apply patterns → backend-error-handling.

Plan-only trust-boundary audit for missing validation, injection, XSS, and forged requests across forms/APIs/webhooks. Use when "validate my inputs", "is my app injection-safe?", "check my forms", or "can someone forge requests?". Apply fixes only after plan approval.

Audit an LLM-powered app for runaway-cost and quota-abuse exposure, then produce a phased guardrail plan. Use when the user says "cap my AI costs", "my LLM bill could blow up", "rate limit my AI", "token budget", "runaway agent loop", or is hardening LLM features before launch.

Plan-only App Store/Google Play submission audit for Capacitor/React Native: manifests, permissions, privacy forms, signing/config, listing prerequisites. Use when "ready for App Store?", "will Google Play reject this?", or "pre-submission check". Native security → plan-capacitor-hardening.

Plan-only performance audit across web/mobile/backend/data; measures first and emits a burndown, no fixes. Use when "performance audit plan", "perf burndown", "measure before optimize", or "N+1 audit plan". Apply runtime fixes → audit-performance. JS bundle-only → audit-bundle-size.

Plan-only audit mapping real personal-data flows to the privacy policy, GDPR, Japan APPI, and store labels. Use when "privacy compliance", "what data do we collect?", "App Store privacy labels", or a consumer launch. Analytics consent instrumentation → audit-analytics.

Audit a Supabase/Postgres project for Row-Level Security and access-control gaps, then produce a phased remediation plan. Use when "RLS", "is my Supabase secure", "anyone can read my data", "lock down my tables". App-layer session/route gates → audit-auth-flows.

Audit the working tree and git history for exposed credentials and mis-scoped keys, then a rotate-vs-relocate plan. Use when "hardcoded secrets", "did I commit a key", "secret scan", "is my .env safe", or "rotate keys". Do not fire for "RLS audit" or generic "security burndown".

OWASP Top 10 + Supabase-first hardening burndown. Use when "security audit plan", "OWASP audit", "hardening plan", or "security burndown". App-layer auth flows → audit-auth-flows. Table RLS → plan-rls-audit. Key rotation → plan-secrets-audit. App LLM attacks → audit-llm-security.

Exhaustive audit for stubs, dead buttons, fake components, unwired handlers, and dead links — then a wiring plan, no implementation. Use when "find dead buttons", "stub checker", "fake components", "unwired handlers", or "dead links". Live QA → test-qa.

User-story-driven test coverage audit and plan — no test writing in this pass. Use when "test coverage plan", "coverage audit", "traceability matrix", "fake-green tests", "uncovered user stories", "plan tests for critical flows", or "whats not tested". Mutation score / assertion theater → test-mutation.

Non-destructive UI/UX and design-system audit that emits a unification burndown — no code until each phase is approved. Use when "audit UI without fixing", "UI burndown", or "IA audit before redesign". Apply-now token cleanup → housekeep-design. Per-page heuristics → audit-ux.

Browser-session guardrail for Playwright CLI: use headed, named, isolated sessions; prevent parallel collisions and recover stalls without scripted shortcuts. Read before browser work or when automation freezes. Product QA behavior remains with the calling test/audit skill.

Research current best practices with Context7, Firecrawl, and official docs before a non-trivial change. Use when /research, look up current docs, what does the industry recommend, or before implementing anything unfamiliar. Produce a gap analysis and file-mapped plan; do not implement until asked.

Headed exploratory QA of a live app as guest then logged-in, followed by a diff; uses junk input and navigation abuse. Use when "monkey test", "wander like a confused user", or "guest vs logged in". CRUD stories → test-qa. Hostile sweep → test-red-team. This-diff fix loop → test-playwright.

Design and run a k6/Artillery load profile that measures throughput, latency percentiles, error rate, and the breaking point under concurrent traffic. Use when "load test this", "will it handle launch traffic", or "find the breaking point". Resilience-by-reading-code → audit-resilience. Never hit prod unsigned.

Set up and run mutation testing (StrykerJS / mutmut) to measure whether tests assert behavior, not just execute lines. Use when "add mutation testing", "are our tests real", "can our test suite be gamed", or after an agent bulk-generated tests. Coverage plan → plan-test-coverage. Writing tests → test-unit.

Close the PDCA loop on this session's diff. Headed playwright-cli, fix as you go. Use when "test my changes", "PDCA this". Pixel diffs → test-visual-regression. Story CRUD → test-qa. Monkey / guest vs logged-in → test-exploratory.

Generic web-app CRUD/story QA fallback when no project-specific skill applies. Use when "QA the app", "test CRUD", or "smoke test". Native → mobile-emulator-test. Identity wander → test-exploratory. Dead controls → plan-stub-checker. Pixel diffs → test-visual-regression.

Adversarial red-team of a running web, React Native, or Capacitor hybrid app. Use when asked to "red team this app", "attack my app", "break it", "find all the defects", "adversarial test", "pre-launch hardening", "pentest the app", or "full app QA". Naive monkey / guest vs logged-in wander → test-exploratory.

Write unit/integration tests for a named module or change. Use when "write unit tests" or "add tests for this function". Coverage plan → plan-test-coverage. Mutation score → test-mutation. Story QA → test-qa. This-diff Playwright → test-playwright.

Set up Playwright screenshot baselines and CI diffing so UI changes fail pixel-by-pixel instead of by eye. Use when "add visual regression tests", "catch UI regressions", or after audit-responsive / audit-ui-states. Functional clicks stay on test-playwright.

Third-party skill — Emil Kowalski's design-engineering notes (animation craft, Sonner-style components). Use when the user names emil-design-eng or asks for that philosophy. Generic UI build → enhance-web-ui. Motion pass → enhance-motion.

Third-party skill — searchable style catalog, palettes, typography, and UX guidelines via Python scripts. Use when the user names ui-ux-pro-max or asks to look up a palette/font pairing from that catalog. Generic UI review → audit-ux / audit-uiux-design-system.

Third-party skill — Vercel Web Interface Guidelines compliance (focus, forms, animation, copy). Use when the user names Vercel guidelines, web interface guidelines, or /thirdparty-web-interface-guidelines. Generic a11y → audit-accessibility.

Build a feature end to end: spec-tdd → implement → test-unit → playwright → PR. Use when "build a feature" or "implement this end-to-end". Spec/TDD loop only → workflow-spec-tdd. One bug → workflow-fix-and-ship. Plan closure → complete-everything.

Apply behavioral guardrails when writing, editing, refactoring, or debugging code. Use when vibe-coding keeps producing wrong results, or for any task needing "think before coding", "simplicity first", "surgical changes". Adapted from Karpathy's LLM coding observations.

Prove runtimes, installs, tools, services, env names, and repository verification commands work before a long/autonomous run. Use when "preflight the repo", "set up the environment", or tests cannot start. Tests run but fail on code → workflow-green-repo / debug-error.

Plan and execute a disciplined feature-flag rollout for any app. Use when asked to "add a feature flag", "gradual rollout", "staged release", "kill switch", "dark launch", "flag cleanup", "canary release", "rollback plan", "safe feature release", or "deploy without switching on".

Turn raw feedback — bug reports, review comments, Sentry, QA, audit output — into deduplicated durable tickets and drive each to verified closure. Use when "triage this feedback", "turn these reports into tickets", "process the bug backlog", or "close the loop".

Complete one bug-fix lifecycle: triage → reproduce → debug-error → regression fix → test-playwright → workflow-pr; optional deploy verify. Use when "fix this bug and close the ticket", "patch this and ship", or a named production error. Multiple reports → workflow-feedback-to-closure.

Create one conventional commit from an already-scoped change: stage named files/hunks, write the message, commit, never push. Use when "commit these files" or "write a commit message". Whole dirty tree to a merge-ready PR → workflow-release-prep.

Drive an entire repository to a fully green baseline — typecheck, lint, tests, and build all passing from a clean checkout — when the user has explicitly authorized fixing. Use when "make the repo green", "get CI passing", "fix all the failing tests". Ratchet integrity → audit-gate-logic.

Grill the user relentlessly about a plan, decision, or idea — one question at a time — until shared understanding is reached. Use when the user says "grill me", "stress-test this plan", "interview me about this", "poke holes in this", "challenge my thinking", or before committing to a non-trivial design.

Apply repository maintenance: sync README, remove confirmed dead artifacts, and safely update dependencies. Use when "housekeep", "clean up repo", "update README", or "update dependencies". Unused files/exports/deps → plan-dead-code. Parked work → housekeep-backlog. Design drift → housekeep-design.

Full launch preparation sweep for a new app or major release. Use when "prepare for launch", "launch week", "everything before going live", "is the app launch-ready?", "pre-launch sweep", or "ship it to the world". Local working-tree PR prep → workflow-release-prep.

Resolve an in-progress git merge or rebase conflict by tracing each side back to its original intent. Use when the user says "resolve the conflicts", "fix this merge", "the rebase is stuck", or a pull/merge/rebase has left conflict markers in the tree.

First-contact orientation for an unfamiliar codebase. Use when "I'm new to this repo", "orient me", "explain this codebase", "what does this do?", "onboard me", "first day on this project", or "catch me up on the codebase".