Claude Skills by matteocervelli

Analyze an existing codebase in parallel via 7 specialized mapper subagents. Outputs structured findings to docs/codebase/ for persistent cross-session context. Use when onboarding to a brownfield project or when reactive on-demand file reading is too slow.

Post-deploy observability for production services — structured logging, RED metrics + Prometheus, Grafana dashboards, SLO-based alerting. Use when setting up monitoring or instrumenting a live service. Trigger on "add logging", "metrics", "dashboard", "alerting", "observability", "monitor this service".

Triage, fix, and pre-flight a PR before merge. Checks mergeability, CI, reviews, and bot comments — fixes issues, runs /pre-commit before pushing, then hands off to /pr-merge.

Full validation gate before committing — quality checks, tests, coverage, security scan, changelog, and companion review. Use right before a commit to verify code is ready. Trigger on "pre-commit", "validate before commit", "ready to commit", "run all checks".

On-demand situational awareness — fresh git/PR snapshot plus continuation, distilled into one concrete "next action" suggestion. Use mid-session when you've lost track, after a compaction, or starting a new work block. Trigger on "where was I", "what's next", "progress", "what should I do now", "/progress".

Initialize a new project with full setup — repo structure, docs, quality tools, and CI/CD. Use when starting a brand-new project from scratch. Trigger on "create a new project", "initialize a project", "set up a new repo", "bootstrap a project".

Multi-language code quality validation (Python, JS/TS, Shell, SQL) — formatting, linting, type-checking, complexity analysis with auto language detection. Use when checking code quality or running linters. Trigger on "lint", "type-check", "quality check", "run the linters", "check code quality".

Zero-ceremony atomic task execution. Use for tiny fixes or enhancements (minutes, not hours) that don't warrant SDLC ceremony. Flags: --discuss (disambiguate first), --full (delegate to /pre-commit after execution), --issue N (link commit to GitHub issue).

Query, update, and audit the registry of all Claude Code components (skills, agents, rules, hooks, plugins) with PDCA lifecycle tracking. Use when listing/inspecting components, finding stale ones, or registering new ones. Trigger on "list skills", "component registry", "what skills exist", "stale skills", "/registry".

Plan version scope, verify release integrity (commit↔CHANGELOG, tag↔artifacts), generate changelogs, and run full releases. Use when cutting a release or bumping a version. Trigger on "cut a release", "bump the version", "generate changelog", "release plan", "verify the release".

Dispatch reviews to external companion AIs (Codex, Gemini, Claude) for an independent second opinion on code changes, PR readiness, doc completeness, architecture, or implementation status. Use when you want a fresh-eyes review beyond Claude-native. Trigger on "get a second opinion", "companion review", "review my changes", "review the PR". For Claude-only quality checks use /code-review.

Run security verification — SAST pattern scanning, DAST against a running app, OWASP Top 10 compliance, CVSS assessment, and adversarial code audit. Use before commit/push or when checking code for vulnerabilities. Trigger on "security scan", "is this vulnerable", "OWASP check", "security verify", "scan for vulnerabilities".

Stack-specific security implementation guidance (backend, frontend, database, infrastructure, operations) with auto-detection from your changes. Use when implementing a feature securely or hardening code as you write it. Trigger on "how do I secure this", "security best practices", "is this secure", "harden this". For scanning existing code use /security-verify.

Final-mile orchestrator - commit + push + PR creation. Run after /pre-commit passes. Chains: commit -> push -> /pr-creator (artifact check + PR). Use --issue N to auto-close a GitHub issue on merge. Use --main to ship directly to main with no PR (closes issue + deletes branch).

Convert a working prototype or ad-hoc solution into a permanent, tested, registered skill. Run after something works and you want it to stick.

Write a durable feature spec before touching code. Reads the codebase map, reads related models/migrations to ask technical questions (not generic ones), then produces a structured spec doc in docs/specs/. Designed to pipeline with /implementation --issue N. Use before any feature implementation.

Validate user stories — INVEST scoring, story-to-test coverage mapping, PRP completeness, and development-readiness assessment. Use after writing stories and before starting implementation. Trigger on "validate the stories", "are these stories ready", "INVEST check", "story coverage", "is this ready to build".

Turn a feature idea into INVEST-compliant user stories, epics, PRPs/PRDs, and sprint plans. Use when breaking down a feature for implementation or planning a sprint. Trigger on "write user stories", "break this into stories", "create a PRP", "plan the sprint", "story".

Forensic scan for npm/PyPI supply-chain compromise (Shai-Hulud/TeamPCP campaigns) — checks persistence, hook injection, compromised packages, IOC strings, C2, dead-man switches. Use when auditing a machine or repo for malicious dependencies. Trigger on "supply chain audit", "check for compromised packages", "Shai-Hulud", "scan for malicious deps".

Detect technical debt — duplicated code, dead code, TODOs, and oversized functions across the codebase. Use at the end of a session or when auditing code hygiene. Trigger on "find tech debt", "any dead code", "duplicated code", "code hygiene", "techdebt".

Generate unit test files with structure, fixtures, and mocking patterns for Python (pytest) or JS/TS (Jest), auto-detecting the framework. Use when starting tests for a source file. Trigger on "scaffold tests", "generate test file", "write test boilerplate", "set up tests for".

Audit a live website across 7 dimensions — SEO, performance, links, privacy, accessibility, security, content — with PASS/WARN/FAIL gates. Use when checking a deployed site's health or quality. Trigger on "audit my website", "site health", "check SEO", "is my site accessible", "website-health <url>".