Claude Skills by luokai0

Expert-level cryptography. Use when working with encryption (AES, RSA), hashing (bcrypt, argon2), digital signatures, TLS, PKI, or key management.

Expert-level DevSecOps. Use when integrating security into CI/CD, SAST/DAST scanning, dependency scanning, container scanning, or shift-left security.

GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks. Exploitation-focused with concrete PoC scenarios.

Expert-level secrets management. Use when working with HashiCorp Vault, AWS Secrets Manager, secret rotation, GitOps secrets, or preventing leakage.

Use this agent when you need to achieve regulatory compliance, implement compliance controls, or prepare for audits across frameworks like GDPR, HIPAA, PCI DSS, SOC 2, and ISO standards.

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists o...

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.

Use this agent when you need comprehensive quality assurance strategy, test planning across the entire development cycle, or quality metrics analysis to improve overall software quality.

Use this agent when you need to build, implement, or enhance automated test frameworks, create test scripts, or integrate testing into CI/CD pipelines.

Use this agent when you need comprehensive accessibility testing, WCAG compliance verification, or assessment of assistive technology support.

Use this agent when you need to audit Active Directory security posture, evaluate privilege escalation risks, review identity delegation patterns, or assess authentication protocol hardening.

Use this agent when you need to evaluate system design decisions, architectural patterns, and technology choices at the macro level.

Use this agent when you need to design and execute controlled failure experiments, validate system resilience before incidents occur, or conduct game day exercises to test your teams incident respo...

Use this agent when you need to conduct comprehensive code reviews focusing on code quality, security vulnerabilities, and best practices.

Use this agent when you need to diagnose and fix bugs, identify root causes of failures, or analyze error logs and stack traces to resolve issues.

Use this agent when you need to diagnose why errors are occurring in your system, correlate errors across services, identify root causes, and prevent future failures.

Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.

Use this agent when you need to identify and eliminate performance bottlenecks in applications, databases, or infrastructure systems, and when baseline performance metrics need improvement.

Use this agent when you need to harden PowerShell automation, secure remoting configuration, enforce least-privilege design, or align scripts with enterprise security baselines and compliance frame...

Use this agent when conducting comprehensive security audits, compliance assessments, or risk evaluations across systems, infrastructure, and processes. Invoke when you need systematic vulnerabilit...

Expert-level Jest and React Testing Library. Use when writing Jest tests, mocking modules, async testing, RTL queries, or testing React components.

Expert-level pytest. Use when writing pytest tests, fixtures, parametrize, conftest.py, pytest-mock, pytest-asyncio, or structuring Python test suites.

Expert-level Cypress. Use when writing Cypress tests, custom commands, intercepts, component testing, or CI/CD integration.

Persistent browser and Electron interaction through `js_repl` for fast iterative UI debugging.

Use when the task requires automating a real browser from the terminal (navigation, form filling, snapshots, screenshots, data extraction, UI-flow debugging) via `playwright-cli` or the bundled wrapper script.

Expert-level Playwright. Use when writing e2e tests, page object model, fixtures, visual regression, API mocking, or CI integration.

Complete browser automation with Playwright. Auto-detects dev servers, writes clean test scripts to /tmp. Test pages, fill forms, take screenshots, check responsive design, validate UX, test login flows, check links, automate any browser task. Use when user wants to test websites, automate browser interactions, validate web functionality, or perform any browser-based testing.

E2E testing with Playwright - Page Objects, cross-browser, CI/CD

Expert-level code review. Use when reviewing code quality, identifying code smells, refactoring, DRY/YAGNI/KISS principles, or writing review feedback.

Simplifies and refines code for clarity, consistency, and maintainability while preserving all functionality. Use when asked to "simplify code", "clean up code", "refactor for clarity", "improve readability", or review recently modified code for elegance. Focuses on project-specific best practices.

Expert-level debugging. Use when debugging complex issues, GDB/lldb/DevTools, stack traces, heap dumps, performance profiles, or production incidents.

Systematically fix all failing tests after business logic changes or refactoring

Comprehensive review of local uncommitted changes using specialized agents with code improvement suggestions

Comprehensive pull request review using specialized agents

Use when implementing any feature or bugfix, before writing implementation code - write the test first, watch it fail, write minimal code to pass; ensures tests actually verify behavior by requiring failure first

Systematically add test coverage for all local code changes using specialized review and development agents. Add tests for uncommitted changes (including untracked files), or if everything is commited, then will cover latest commit.

Use when implementing any feature or bugfix, before writing implementation code

Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation

Use when completing tasks, implementing major features, or before merging to verify work meets requirements

Comprehensive review of local uncommitted changes using specialized agents with code improvement suggestions

Comprehensive pull request review using specialized agents

Perform code reviews following Sentry engineering practices. Use when reviewing pull requests, examining code changes, or providing feedback on code quality. Covers security, performance, testing, and design review.

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

Use when executing implementation plans with independent tasks in the current session

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes

Use when implementing any feature or bugfix, before writing implementation code

Expert-level software testing strategy. Use when designing test suites, working with unit/integration/e2e testing, TDD, BDD, test coverage, mocking, test doubles, property-based testing, or defining testing best practices. Also use when the user mentions 'test strategy', 'TDD', 'BDD', 'test coverage', 'mock', 'unit test vs integration test', 'flaky test', 'test pyramid', or 'how do I test this'.

Use when configuring, running, or fixing PHPStan static analysis in WordPress projects (plugins/themes/sites): phpstan.neon setup, baselines, WordPress-specific typing, and handling third-party plugin classes.

Use when you need a deterministic inspection of a WordPress repository (plugin/theme/block theme/WP core/Gutenberg/full site) including tooling/tests/version hints, and a structured JSON report to guide workflows and guardrails.