All authors
Claude Skills by martinholovsky
github.com/martinholovsky43 skills0 installs93 views
- sota-api-designState-of-the-art API design and audit guidance (2026) covering REST/HTTP, GraphQL, gRPC, WebSockets/SSE/realtime, webhooks, versioning/evolution, and API security/operations. Use when designing or building any API surface (endpoints, schemas, protos, realtime channels, webhook senders/receivers) AND when auditing/reviewing existing APIs for correctness, evolvability, security, and operational robustness. Not for browser UI, rendering, or client-framework concerns — use sota-web-frameworks or ...Votes: 0GitHub stars: 22
- Sota ArchitectureState-of-the-art software and system architecture rules (2026) for both building and auditing. Use when designing, building, refactoring, or extending system architecture — boundaries, DDD, hexagonal/clean architecture, event-driven design, CQRS, sagas, messaging, caching, sharding, multi-tenancy, resilience, scalability, 12-factor/cloud-native — AND when auditing existing architecture for quality (design review, anti-patterns like distributed monolith or shared database, reliability/scalabil...Votes: 0GitHub stars: 22
- Sota Async ConcurrencyState-of-the-art rules for writing and auditing asynchronous and concurrent code across runtimes (Python asyncio, JS/Node, Go, Rust, JVM). Use when building anything with async/await, threads, processes, event loops, task groups, channels, or queues — and when auditing existing code for race conditions, deadlocks, leaked tasks, blocked event loops, missing cancellation, or backpressure failures. Not for latency/throughput profiling and optimization — use sota-performance. Trigger keywords: as...Votes: 0GitHub stars: 22
- Sota C CppState-of-the-art C and C++ engineering rules that Claude applies when writing or auditing C/C++. Covers modern idioms (RAII, value semantics, smart pointers, C++23), memory safety (lifetimes, bounds, sanitizers, hardening flags), undefined behavior, security (SEI CERT C/C++, MISRA, integer/buffer/format-string, injection), concurrency (C/C++ memory model, atomics, data races), build/tooling/CI (CMake, clang-tidy, cppcheck, ASan/UBSan/TSan, vcpkg/Conan, supply chain), and performance. Trigger ...Votes: 0GitHub stars: 22
- Sota Cli UxState-of-the-art CLI and developer-tool UX guidance (2026) covering command and flag design, output and interaction (stdout/stderr, --json, TTY detection, exit codes, prompts), runtime behavior and lifecycle (signals, dry-run, idempotency, XDG paths, completions, telemetry), and distribution (packaging, checksums, docs). Use when designing or building any command line tool, subcommand, TUI, or developer tool — in any framework (argparse, click, typer, clap, cobra, oclif, commander) — AND when...Votes: 0GitHub stars: 22
- Sota Cloud InfrastructureState-of-the-art cloud infrastructure architecture (2026). Applies when designing, building, or auditing cloud environments on AWS, GCP, or Azure — account/project structure and landing zones, IAM and workload identity, VPC/network design, DNS/TLS/CDN, compute selection (serverless vs containers vs Kubernetes vs VMs), object storage and backup architecture, cost engineering (FinOps), and disaster recovery. Trigger keywords: cloud, AWS, GCP, Azure, Kubernetes, EKS, GKE, AKS, VPC, subnet, IAM, ...Votes: 0GitHub stars: 22
- Sota Code SecuritySecure coding and security auditing rules. Use whenever BUILDING or modifying code that crosses a trust boundary — endpoints, handlers, auth/login/signup, sessions, JWT/OAuth, file uploads, payments, multi-tenant features, crypto/secrets handling, parsers, CLI/exec wrappers, LLM agents or tool-calling — AND whenever AUDITING code for security (security review, vulnerability hunt, hardening, OWASP, CWE, secrets leak, "is this code safe") — AND whenever a control is already PRESENT and the ques...Votes: 0GitHub stars: 22
- Sota Confidential ComputingState-of-the-art confidential computing and cryptographic PETs (2026) for BUILDING and AUDITING systems that protect workloads and data in use from the infrastructure they run on — the inverse of sandboxing. Covers TEE selection (AMD SEV-SNP, Intel TDX, ARM CCA realms, SGX enclaves, AWS Nitro Enclaves, NVIDIA confidential GPUs), memory encryption vs attested isolation (TME/TME-MK/MKTME), remote attestation (RATS RFC 9334, evidence appraisal, attest-then-release, RA-TLS, TCB recovery), confide...Votes: 0GitHub stars: 22
- Sota CopywritingState-of-the-art marketing copywriting and content guidance (2026) covering positioning and value propositions, headlines and landing-page copy, CTAs and social proof, SEO content (search intent, E-E-A-T, Google spam policies), and the accuracy/legal layer — claim substantiation, FTC Endorsement Guides (2023) and the Consumer Reviews Rule (2024), testimonial consent, dark-pattern avoidance, and email-marketing law (CAN-SPAM, GDPR consent). Use when writing or reviewing ANY outward-facing cont...Votes: 0GitHub stars: 22
- Sota Data EngineeringState-of-the-art data engineering rules (2026) for building and auditing data pipelines and analytics infrastructure. Covers architecture and modeling (ELT, lakehouse vs warehouse, dimensional models, medallion layering), pipeline and orchestration discipline (idempotency, incremental loads, backfills, dbt-style transformations), streaming and CDC (Kafka, exactly-once reality, schema evolution, Debezium-style capture), data quality and contracts, columnar storage and table-format performance ...Votes: 0GitHub stars: 22
- Sota DatabasesState-of-the-art database engineering rules (2026) for designing, building, and auditing data layers. Covers engine selection, schema modeling, migrations, query and index craft, transactions and concurrency, reliability and scale, security, and vector/AI workloads. Use when designing a new data layer, writing or reviewing schemas/migrations/queries, debugging slow or contended database workloads, or auditing an existing database for correctness, performance, and security. Not for ETL or stre...Votes: 0GitHub stars: 22
- Sota Detection EngineeringState-of-the-art detection engineering, SOC, threat hunting, and incident response (2026). Use when BUILDING detective controls or SOC capability — Sigma/YARA/Falco/Tetragon/Suricata rules, detection-as-code, MITRE ATT&CK coverage, SIEM detections, alert triage and SOAR, threat hunts, threat-intel, deception, IR playbooks, or adversary emulation — AND when AUDITING detection & IR posture (can we detect this? does this alert fire?). Owns DETECTIVE controls, SOC workflow, hunting, and IR (sota-...Votes: 0GitHub stars: 22
- Sota DevsecopsState-of-the-art DevSecOps and software supply chain security (2026). Applies when building or auditing CI/CD pipelines, GitHub Actions workflows, supply chain controls, SBOM generation, SAST/secret-scanning gates, dependency management, container builds, container/artifact registries, IaC (Terraform), GitOps, deployment strategy, and a pre-commit hook that passes locally but fails in CI. Trigger keywords: CI/CD, pipeline, GitHub Actions, supply chain, SBOM, SAST, dependency, container build,...Votes: 0GitHub stars: 22
- Sota Docs WorkflowState-of-the-art documentation and engineering-collaboration guidance (2026) covering documentation architecture (Diátaxis, docs-as-code, READMEs, runbooks, onboarding, AI-readable docs), API/reference docs and changelogs, and the team workflow around code: pull requests, code review conduct, commit discipline, branching, and releases. Use when writing or structuring any documentation AND when auditing docs quality, and when designing or auditing collaboration workflow. Not for in-product UI ...Votes: 0GitHub stars: 22
- Sota DotnetState-of-the-art C# / .NET engineering rules (.NET LTS releases, modern C#) that Claude applies when writing or auditing .NET code. Covers modern idioms (records, nullable reference types, pattern matching, spans, file-scoped namespaces), API/null/immutability/`IDisposable` design, async/await & concurrency (ConfigureAwait, channels, cancellation, TPL), security (OWASP .NET, deserialization — BinaryFormatter removed in .NET 9, EF/Dapper SQL injection, ASP.NET Core auth, Data Protection, crypt...Votes: 0GitHub stars: 22
- Sota Frontend DesignState-of-the-art web design, UI/UX, and motion engineering standards (2026). Use when building OR auditing/reviewing user interfaces: components, pages, design systems, stylesheets, themes, forms, navigation, animations, or accessibility. Covers typography, color (OKLCH, dark mode), spacing/layout (grid, container queries, subgrid), design tokens and component APIs, UX patterns (forms, loading/empty/error states, destructive actions), WCAG 2.2 AA accessibility, motion design, and responsive/m...Votes: 0GitHub stars: 22
- Sota GolangState-of-the-art Go engineering rules (supported Go releases) that Claude applies when writing new Go code or auditing existing Go code. Covers error handling, interface/package design, goroutine and channel correctness, net/http hardening, security (SQL, exec, path traversal, CSPRNG, TLS, supply chain), performance (pprof, allocations, GC, PGO), and tooling/CI. Trigger keywords - Go, golang, goroutine, channel, go.mod, errgroup, context.Context, pprof, govulncheck, net/http, slog. Use for BO...Votes: 0GitHub stars: 22
- Sota Identity AccessState-of-the-art identity and access management engineering (2026) for BUILDING/configuring identity infrastructure AND AUDITING it — federation, IdPs, authorization models, the joiner-mover-leaver lifecycle, privileged/break-glass access, workload identity, MFA/passkeys, and assurance levels; audits cover orphaned accounts, over-privileged roles, weak MFA, long-lived tokens, and SAML misconfig. Owns identity INFRASTRUCTURE and access-management DESIGN, not app-level login/session/JWT mechani...Votes: 0GitHub stars: 22
- Sota Javascript TypescriptState-of-the-art JavaScript and TypeScript engineering (2026) for both writing and auditing code. Covers strict TypeScript configuration and type design, language idioms and pitfalls, async patterns, Node.js backends, JS/TS-specific security (XSS, prototype pollution, supply chain, injection), frontend/React and Node performance, and testing/tooling. Use whenever building, reviewing, refactoring, or security-auditing code involving JavaScript, TypeScript, Node, npm, React, frontend code, tsco...Votes: 0GitHub stars: 22
- Sota JvmState-of-the-art JVM engineering rules for Java and Kotlin that Claude applies when writing or auditing JVM code. Java LTS releases (virtual threads final since 21; structured concurrency still preview), modern Kotlin. Covers modern idioms (records, sealed types, pattern matching, Kotlin null-safety/coroutines), API/null/immutability design, concurrency (virtual threads, JMM, java.util.concurrent, coroutines), security (deserialization/gadget chains, XXE, JNDI/Log4Shell-class, injection, JCA ...Votes: 0GitHub stars: 22
- Sota KubernetesState-of-the-art Kubernetes platform security and operations (2026) for cloud-managed (EKS/GKE/AKS) and self-hosted clusters (kubeadm, k3s/k0s, Talos). Use when building, operating, hardening, or auditing the cluster PLATFORM layer: control plane and etcd, API server/kubelet, RBAC, admission control and policy-as-code, GitOps controllers, operators/CRDs/admission webhooks, Helm/Kustomize supply chain, multi-tenancy, cluster lifecycle/upgrades/CVE response, and audit logging. Trigger keywords:...Votes: 0GitHub stars: 22
- Sota Llm EngineeringState-of-the-art LLM application engineering rules for BUILDING and AUDITING LLM-powered features. Claude should use this skill whenever it is building, modifying, or reviewing anything that calls a language model — chat features, RAG pipelines, agents and tool use, structured extraction, classification, summarization, embeddings/vector search, evals and regression gates, prompt or context engineering, model selection/routing, fine-tuning decisions, or LLM cost/latency/observability work. Tri...Votes: 0GitHub stars: 22
- Sota Ml EngineeringState-of-the-art ML engineering / MLOps rules (2026) for BUILDING and AUDITING production machine-learning systems — the training→serving→monitoring lifecycle of classical/predictive ML. Distinct from LLM apps (prompts/RAG/agents → sota-llm-engineering). Covers ML system architecture (feature stores, model registry, reproducibility), data & features (leakage, train/serve skew, versioning), training & experiment tracking, evaluation (ML Test Score, slices, regression gates), deployment/serving...Votes: 0GitHub stars: 22
- Sota MobileState-of-the-art mobile engineering for building and auditing iOS and Android applications. Use when the task involves mobile apps in any form — native (Swift, SwiftUI, Kotlin, Jetpack Compose), cross-platform (React Native, Flutter, Kotlin Multiplatform), app store submission and review (App Store, Google Play, privacy manifests, data safety), push notifications (APNs, FCM), offline-first architecture and sync, mobile security (Keychain, Keystore, certificate pinning, app attestation, OWASP ...Votes: 0GitHub stars: 22
- Sota Network SecurityState-of-the-art network security as a discipline (2026) for BOTH designing/building secure networks AND auditing segmentation and exposure. Use for zero-trust architecture, network segmentation and blast-radius control, Kubernetes NetworkPolicy/CiliumNetworkPolicy depth, service mesh and mTLS, edge/ingress/egress security (WAF, egress allowlisting, metadata-endpoint blocking), DNS/TLS/PKI transport and certificate lifecycle, and remote access (WireGuard, ZTNA, bastion vs identity-aware proxy...Votes: 0GitHub stars: 22
- Sota ObservabilityState-of-the-art observability and reliability engineering (2026). Use when instrumenting code (structured logging, metrics, distributed tracing with OpenTelemetry, SLOs, alerting, health endpoints) or auditing an existing codebase's observability posture (can on-call answer "why is this request slow?" and "what broke at 3am?"). Not for security detections, SIEM, or threat hunting — use sota-detection-engineering. Triggers: logging, metrics, tracing, monitoring, alerting, SLO, SLI, error budg...Votes: 0GitHub stars: 22
- Sota PerformanceState-of-the-art performance engineering for building fast systems and auditing existing code for bottlenecks. Use when the task involves performance, optimization, latency, profiling, slow code, memory usage, caching, or throughput — designing latency budgets, fixing N+1 and accidental-quadratic patterns, tuning allocation/GC pressure, network and I/O efficiency, cache architecture, Core Web Vitals, or setting up benchmarks and regression gates. Not for concurrency correctness (races, deadlo...Votes: 0GitHub stars: 22
- Sota PhpState-of-the-art PHP engineering (supported PHP branches) for both writing new PHP and auditing existing PHP code. Covers strict_types and modern idioms (enums, readonly, match, fibers, property hooks), OWASP-grade security (SQL injection, XSS, file uploads, LFI/RFI, unserialize/Phar object injection, sessions, password hashing, sodium, SSRF), framework-neutral web hardening, Composer supply chain and static analysis (PHPStan/Psalm levels, baselines), and runtime performance (OPcache, preload...Votes: 0GitHub stars: 22
- Sota Privacy ComplianceState-of-the-art privacy and compliance engineering guidance for building privacy-respecting systems and auditing existing code for privacy/compliance gaps. Use when work involves privacy, GDPR, PII, personal data, consent, data retention, deletion, DSAR (data subject access requests), SOC 2, ISO 27001, HIPAA, PCI DSS, compliance evidence, data residency/sovereignty, data classification, anonymization/pseudonymization, breach notification, or EU AI Act obligations — whether designing new data...Votes: 0GitHub stars: 22
- Sota PythonState-of-the-art Python engineering for both writing new Python and auditing existing Python code. Covers uv-based tooling and project setup, strict typing, idioms and pitfalls, asyncio structured concurrency, security (injection, deserialization, supply chain), performance, and FastAPI/Django/pytest practice. Use whenever the task involves Python source, pyproject.toml, requirements files, or Python tooling — building features, scaffolding projects, reviewing PRs, or hunting bugs/vulnerabili...Votes: 0GitHub stars: 22
- Sota RubyState-of-the-art Ruby engineering rules (supported Ruby releases) that Claude applies when writing or auditing Ruby. Covers modern idioms (frozen string literals, pattern matching, Data/Struct, RBS/Sorbet/Steep typing), security (SQL injection via ActiveRecord/Sequel, ERB/XSS escaping, mass assignment, CSRF, Marshal/YAML deserialization, command injection, ReDoS), framework-neutral web hardening (Rails/Sinatra/Hanami as neutral examples), supply chain and tooling (Bundler lockfile and checksu...Votes: 0GitHub stars: 22
- Sota RustState-of-the-art Rust engineering (2026) for writing and auditing Rust code. Covers idiomatic ownership and API design, error handling and panic policy, unsafe discipline with Miri, async/tokio (cancellation safety, structured concurrency, graceful shutdown), security and supply chain (cargo audit/deny/vet, integer overflow, serde hardening, zeroize), performance (profiling, allocation reduction, release profiles), and tooling/CI (clippy policy, nextest, MSRV, feature hygiene, edition 2024). ...Votes: 0GitHub stars: 22
- Sota SandboxingState-of-the-art sandboxing and isolation engineering (2026). Use when designing isolation for untrusted code, untrusted input parsing, multi-tenant workloads, or AI/agent execution — and when auditing existing systems for isolation gaps. Covers least privilege, defense in depth, isolation boundary selection (VM/microVM/gVisor/container/process/WASM), Linux primitives (namespaces, cgroups v2, seccomp-bpf, Landlock, AppArmor/SELinux, capabilities), Docker/OCI and Kubernetes hardening, privileg...Votes: 0GitHub stars: 22
- Sota Secrets ManagementState-of-the-art secrets management for building and auditing software. Use whenever a task involves creating, storing, injecting, rotating, or scanning for credentials — or reviewing code/infrastructure for secret leaks and misuse. BUILD mode: implementing secrets handling; AUDIT mode: sweeping a repo for leaked, hardcoded, or mishandled secrets. Trigger keywords: secret, secrets management, credential, API key, token, password, private key, signing key, JWT secret, TLS key, SSH key, databas...Votes: 0GitHub stars: 22
- Sota Security ComplianceState-of-the-art security & compliance engineering (2026) for the cybersecurity control frameworks and product-security regulations that drive architecture, code, and CI gates — not the organizational policy binder. Use when work must satisfy or be audited against NIST CSF 2.0, SP 800-53, SP 800-171 / CMMC, the Secure Software Development Framework (SSDF, SP 800-218), FedRAMP, the EU Cyber Resilience Act (CRA), or ISA/IEC 62443 (OT/ICS/embedded). Covers control-framework-as-code crosswalks (c...Votes: 0GitHub stars: 22
- Sota Shell ScriptingState-of-the-art shell scripting (bash and PowerShell, defensive) for writing and auditing shell scripts, CI scripts, init/deploy scripts, container entrypoints, and Makefile recipes — and equally for the ad-hoc commands you run yourself: a grep/find/rg sweep whose result you are about to report, a one-liner pasted from a checklist, a pipeline whose exit status or empty output you are about to believe. Use when creating, modifying, reviewing or hardening shell code, AND before trusting any co...Votes: 0GitHub stars: 22
- Sota TestingState-of-the-art software testing strategy and practice (2026) for designing test strategy, writing unit/integration/e2e tests, or auditing test suites. Covers suite shape (pyramid/trophy/honeycomb), test design quality (behavior-first, AAA, determinism, smells), test doubles (mocks/fakes/stubs), test data (builders over fixtures), real-dependency integration (Testcontainers-style), contract testing (Pact/consumer-driven), e2e/UI strategy (selectors, auto-waiting, flake economics), property-b...Votes: 0GitHub stars: 22
- Sota Threat ModelingState-of-the-art threat modeling for both designing new systems and auditing existing ones. Use when designing a feature, service, integration, or architecture that touches untrusted input, new trust boundaries, sensitive data, or third-party dependencies (BUILD mode), and when reviewing, auditing, or pen-test-scoping an existing codebase to reconstruct its implicit threat model and find gaps (AUDIT mode). Not for code-level vulnerability review — use sota-code-security. Trigger keywords: thr...Votes: 0GitHub stars: 22
- Sota Ux WritingState-of-the-art UX writing and product-copy guidance (2026) covering voice and tone systems, plain language (ISO 24495-1), microcopy (buttons, labels, empty states, onboarding, notifications), error and feedback message craft, and the accessibility and localization of interface language (WCAG 2.2 language criteria, alt text, ICU pluralization, i18n-safe strings). Use when writing or reviewing ANY user-facing interface text — web, mobile, desktop, or CLI products — AND when auditing existing ...Votes: 0GitHub stars: 22
- Sota Web FrameworksState-of-the-art engineering rules (2026) for the JavaScript SSR meta-frameworks: React 19 + Next.js (App Router, React Server Components, Server Actions) and Vue 3 + Nuxt 4 (Nitro server routes, composables) — plus the cross-cutting concerns of server rendering: hydration correctness, SSR state serialization, the server/client trust boundary, and framework-specific security and CVEs. Use when building or auditing any React/Next or Vue/Nuxt app — components, RSC/client boundaries, Server Acti...Votes: 0GitHub stars: 22
- SotaMaster router for the SOTA engineering skills library. Use this skill whenever the user asks to build, design, implement, refactor, harden, optimize, review, or audit an application, service, or codebase and the request spans more than one domain — or when you are unsure which specific sota-* skill applies. Also use when working on a codebase you do not own: reviewing a pull request or diff, responding to code review, evaluating someone else's patch, or preparing an upstream contribution — in...Votes: 0GitHub stars: 22
- Sota Skill SecuritySecurity for AI agent skills, plugins and instruction bundles (2026) — the supply chain of things that tell an agent what to do. Use when installing, authoring, reviewing, updating or auditing any skill, plugin, ruleset or agent file an agent loads as instructions, including your own; when a repository you do not fully trust contains agent-readable instruction files; and when deciding what an installed skill may reach. Covers provenance and pinning, review-before-install, the instruction trus...Votes: 0GitHub stars: 22
- Sota SwiftState-of-the-art Swift engineering rules (Swift 6 language mode) that Claude applies when writing or auditing Swift on ANY target — server-side services (Vapor, Hummingbird, SwiftNIO), CLIs, libraries, packages and apps. Covers optionals and error handling, value types and API design, Swift 6 data-race safety (Sendable, actors, isolation, cancellation), ARC and retain cycles, unsafe pointers and strict memory safety, security (CryptoKit/swift-crypto, Codable and NSKeyedUnarchiver, SQLKit raw ...Votes: 0GitHub stars: 22