Claude Skills by ModernNomad-98

Design the operating-effectiveness evidence program SOC 2 Type 2 demands and ISO surveillance audits reuse — evidence OVER TIME, not point-in-time. Per control (from compliance-control-foundation): evidence type, cadence matched to control operating frequency, population for auditor sampling, named collector, retention, and audit-window coverage with a hole map. Formalizes the Phase 5 evidence pack (screenshot-evidence-planner, manual-test-case-creator), audit-log-architect trails, and agent-...

Run ONE parameterized compliance gap audit — current state vs the chosen framework(s): ISO 27001:2022, ISO 42001:2023, SOC 2 (TSC), optionally a NIST AI RMF profile — never a per-framework fork. Consumes the compliance-control-foundation catalog, multi-framework-crosswalk rows, the SoA, and compliance-evidence-collector coverage; verdicts per requirement: MET / PARTIAL / GAP / UNVERIFIABLE from cited evidence — missing evidence is never MET (agent-governance-audit discipline, org-wide). Outpu...

Design the CI gate that FAILS any PR touching "important" paths without a matching context-map/notes update, plus the update protocol that keeps the map honest: every update stamps date + commit SHA scanned, status moves only on cited evidence, and an unresolved risk note is never deleted — only replaced by proof. Deliverables: important-paths list, co-update rule with a declared (never silent) no-change-needed escape hatch, check logic + failure message, protocol doc. The WRITE-BACK half of ...

Design a CONTRIBUTING guide that takes a contributor from zero to a merged change — environment setup, the contribution workflow (fork/branch/PR or the project's flow), coding standards and commit/PR conventions, how to run tests and checks locally, the review and merge process, honest expectation-setting (response times, what gets accepted), code-of-conduct and licensing/DCO-CLA pointers, and lowering the first-contribution barrier (good-first-issues, where to ask). Designs contribution guid...

Identify, negotiate, and track the cross-team dependencies an effort needs — map what you need from other teams AND what they need from you, surface each dependency EARLY (before it's a blocker), negotiate a CONCRETE commitment (specific deliverable, interface/contract, date, owner on both sides) rather than a vague "we'll help", de-risk it (fallbacks if it slips, decoupling via a stubbed interface, parallel paths), account for the reality that other teams have their own priorities (align inc...

Design a SAFE dynamic-testing (DAST) harness against a RUNNING application — the safety harness is the deliverable, not an attack method. Mandates EXPLICIT WRITTEN AUTHORIZATION before any run (scope, target, window, blast radius recorded — composes human-approval-boundary); staging/non-production targets only unless prod is explicitly authorized; rate/impact limits so it never DoS-es the target; no destructive probes without separate sign-off; data-handling; and the run/result contract. Fail...

Author the operator-executable runbook for a DATA move — backfill, re-shard, store cutover, tenant move, CDC initial load — that a stranger can run under pressure: preconditions gated on verified backups and dry-run evidence, batching with throttles and pause/resume, per-batch and per-stage verification queries (counts, checksums, sampled equality) with expected outputs, explicit abort criteria naming the safe halt state, rollback per stage composed from rollback-runbook-author conventions, a...

Design OLTP partitioning and sharding for WRITE/size scale in a multi-tenant SaaS — shard-key selection (tenant-as-shard-key and its hot-tenant limit), range/hash/list partitioning of large tables, resharding/rebalancing a hot tenant, and the cross-shard query/transaction costs you inherit — all gated behind the DON''T-SHARD-PREMATURELY rule: a single well-indexed primary plus read replicas serves a very large SaaS, so shard ONLY on evidence of a real write or size ceiling. Use when a primary...

Design data-quality monitoring for production pipelines and stores — checks across the six dimensions (freshness, completeness/volume, uniqueness, validity, consistency/referential integrity, distribution drift), placed at the right pipeline stage (ingest, transform, serving), each with severity, an owner, and a failure action (block, quarantine to a reviewable location, or alert-and-pass — never silent auto-fix), plus per-dataset quality SLAs and incident routing. Produces the monitor spec a...

Facilitate a technical DESIGN REVIEW — prepare it (circulate the design/spec ahead, state the decision the review must reach, invite the right reviewers including the skeptics and cross-cutting owners), structure the discussion (surface assumptions, probe the risky parts and cross-cutting concerns, weigh alternatives, keep it about the design not the person), actively elicit dissent and the strongest objection, drive to an EXPLICIT outcome (approved / approved-with-changes / needs-rework / bl...

Organize a documentation SET using the Diátaxis framework — sort content into the four modes (tutorials for learning, how-to guides for tasks, reference for information, explanation for understanding), diagnose what each existing doc actually IS versus what it claims to be (the common rot: a "tutorial" that is really reference, a how-to bloated with explanation), place each piece in the right quadrant, structure the doc tree accordingly, and set the maintenance discipline that keeps the modes...

Design the docs-as-code TOOLCHAIN and pipeline — docs living in the repo beside the code, the format and static-site generator, the build/preview/deploy pipeline, versioning docs with the code they describe, review via pull requests, link-checking and prose/style linting in CI, testing that code samples actually run, search, and the docs contribution workflow. This is the ENGINEERING of documentation — the infrastructure that keeps docs building, published, and honest — not their content or o...

Implement against frameworks, libraries, or external services by first identifying the EXACT versions installed in this repo and reading the matching documentation — official docs, local node_modules/vendored docs, changelogs — before writing any code. Summarizes only the syntax relevant to the task, implements, then verifies with the project's tests/build/lint. States uncertainty explicitly when docs for the pinned version are unavailable instead of guessing from training data. Use when impl...

Design the numbered retention index governing every workflow/process doc's LIFECYCLE — each doc gets a retention category, a reason-to-keep, a superseded-by pointer, and a cleanup rule, mirrored by per-doc retention frontmatter, so doc retirement becomes an explicit, approvable operation instead of silent rot or hoarding. Runs the reverse-reference sweep before retiring a doc, stages retirement (mark → redirect → remove) with human approval for deletion, and keeps the index the source of trut...

Model the business domain before any implementation — extract ubiquitous language, actors, workflows, subdomains, bounded contexts, entities, value objects, aggregates, domain services, domain events, and context relationships from requirements, docs, and existing code. Use when starting a new feature or system from prose requirements, when no domain model exists, when naming or entity confusion keeps causing rework, or when asked to map business concepts. Ends at a hard "do not code yet" gat...

Design the non-happy-path UI states for a view or flow — the distinct empty states (first-run vs filtered-to-nothing vs error-emptied, each with its own copy and next action), loading states (skeleton vs spinner vs inline, a delay threshold to avoid flash, optimistic updates with rollback), error states (inline vs toast vs full-page, retry affordance, partial failure, stale-on-error), and the permutations teams forget (offline, refetching/stale, slow, partial data, permission-denied, too-much...

Review error/exception handling through a security lens — fail-closed defaults (a failed check, timeout, or down dependency DENIES, never allows), error-path AUTHORIZATION (authz still enforced on every error/retry/fallback branch), exception-driven logic BYPASS (does an exception skip a check, validation, rollback, or audit write?), and leak-free error responses (no stack traces/secrets/internal detail to callers — generic outside, rich inside). Closes OWASP Top 10:2025 A10 (Mishandling of E...

Design the error model for an API or product surface — a finite, stable taxonomy of error categories with machine-readable codes, an error envelope (code, human message, field-level details, correlation id, retryable flag), an honest client-fault vs server-fault vs retryable split, actionable messages that say what to DO, ONE mapping boundary where exceptions become taxonomy errors, and a disclosure rule that keeps stack traces, internal identifiers, and PII out of what the caller sees. Owns ...

Design how a skill library's evals would actually EXECUTE — the runner left open where the eval convention is structural-only (files exist and parse; nothing runs). Covers harness architecture (fresh, isolated session per case with the library loaded), trigger verification (the expected skill fires; should_not_trigger neighbors stay silent), assertion judging (deterministic checks vs rubric-guided LLM judge), refusal-case semantics, reporting with honest UNRUN status, cost and sampling tiers,...

Design the ANALYTICS event schema and tracking plan for product measurement — the event naming taxonomy (consistent object-action), a typed property schema per event (required/optional, enums), shared global properties (user/session/tenant/timestamp), the identity model (anonymous→identified stitching; user/account/tenant keys), a tracking plan/registry as the source of truth, additive versioning, cross-platform naming consistency, and PII minimization. These are BEHAVIORAL events for MEASURE...

Design the ROLLOUT STRATEGY for shipping a change safely behind a flag — classify the flag by purpose (release, ops/kill-switch, experiment, permission — release flags stay separate from permanent entitlements), plan progressive delivery (internal → canary/% → cohorts → GA), define sticky targeting, set guardrail metrics with auto-rollback criteria and a tested kill switch, choose the fail-safe default when the flag service is down, and manage the lifecycle so release flags are removed after ...

Design file/object storage and upload flows for a multi-tenant SaaS — direct-to-storage vs proxied upload, short-lived signed URLs scoped to one object + verb + expiry, tenancy by bucket/path-prefix, size/type/CONTENT validation (magic-byte, not just extension), malware scanning, image/derivative processing off the request path, retention/lifecycle, CDN + cache-control, and storage-cost posture. Produces the upload-flow design, the storage-tenancy + signed-URL contract, the validation/scan pi...

Drive a flaky (intermittently failing) test to its root cause and proven stability through the fixed sequence CLASSIFY (ordering, shared state, timing/race, environment, infrastructure, or real intermittent product bug) → REPRODUCE deterministically (repeat runs, order shuffling, parallel stress, seed/timezone control) → FIX ONE CAUSE → PROVE stability with repeated runs and real counts. Never fixes by adding retries, sleeps, or looser assertions; distinguishes test bugs from product bugs (a ...

Track the editions of external standards the library''s framework-mapping skills cite — OWASP Top 10 / LLM / Agentic, ISO 27001/42001, SOC 2, NIST AI RMF and similar — by maintaining an edition register (framework → cited edition → where cited), detecting when a NEW edition ships, and producing a DELTA report of what changed. Pins currency without touching any mapping: it reports drift, it does not update. The delta it produces feeds framework-mapping-refresher, which proposes the specific ed...

Given an edition delta (from framework-edition-tracker), propose the SPECIFIC updates to every affected skill description, reference file, and coverage map — locate each site that cites or maps the old edition, propose the concrete change per site (renamed category, added/removed control, restructured mapping, updated edition string), surface any new coverage GAP the edition introduces, and flag the whole set for HUMAN REVIEW before anything lands. Proposes; never auto-applies. Downstream of ...

Design the frontend's share of performance — metrics in the loading/interactivity/visual-stability family (largest-paint, interaction latency, layout shift) pinned to a device/network class, bundle strategy (route code splitting, lazy loading, weight audit BEFORE micro-tuning — deletions first), asset strategy (image priority, fonts without invisible-text or reflow), rendering path (SSR/hydration cost honestly counted, long tasks), runtime fixes (re-render storms, unvirtualized lists, layout ...

Audit an ENTIRE repository with inventory-first discipline — enumerate every directory, language, entry point, dependency manifest, CI/CD pipeline, and doc before forming any finding, so nothing is judged by its most interesting-looking files. Covers architecture, security, code quality, tests, dependencies, CI/CD, deployment, documentation, and operational readiness, and separates every result into confirmed findings, likely findings, hypotheses, and missing information. Use for whole-repo h...

Define product funnels and conversion/retention measurement rigorously — the ordered funnel steps grounded in the analytics event schema, the counting model (unique users vs sessions vs events) with an honest denominator, the conversion window (how long a user has to complete), strict-order vs any-order steps, attribution (first/last touch), drop-off and segmentation analysis, and cohort/retention curves — while keeping one metric to one definition so numbers stop drifting, and separating WHE...

Author the reusable operator prompt template gating a RECURRING class of risky operations (migrations, production grants, backfills): operator-filled placeholders (<owner>/<repo>, <tenant-id> — never live identifiers; credentials as env-var names), hard rules with required inputs, stop conditions with safe halt states, backup-then-verify gating (verified backup BEFORE; expected deltas AFTER), per-phase smoke expectations, a required per-run report path, and ETA ranges calibrated from a deploy...

Review whether a system can scale OUT (add nodes) rather than only up — a can-it-scale-horizontally lens: statelessness / session and in-memory-state externalization, connection pooling and connection-count ceilings, sticky-session and in-process-singleton / local-cache / local-cron / local-filesystem smells, autoscaling + load-balancer + health-check config, and graceful shutdown/draining so scale-in does not drop work. Produces a scale-out readiness verdict with component/file findings rank...

Adversarially review the human-approval layer of an agent system for trust exploitation (OWASP Agentic ASI09) — consent fatigue (approval floods that train rubber-stamping; rate/latency as the signals), deceptive, over-polished justifications making a dangerous action look routine, self-reported summaries diverging from the actual action (approvers must see the real diff/blast radius, not the agent''s story), dangerous steps bundled in innocuous batches, urgency manipulation, and automation b...

Stop and obtain explicit human approval before work touches schema changes or destructive migrations, RLS or security policy, production data, secrets, deployments or releases, billing, git history rewrites, broad multi-file refactors, or any behavior whose security impact is unclear. Use when a task is about to cross one of those boundaries, or when ambiguity would change what gets built. Produces a structured approval request (action, blast radius, reversibility, options) and halts until an...

Review infrastructure-as-code changes (Terraform, Bicep, CloudFormation, CDK, Pulumi) for deploy safety and security posture — destructive operations hiding in innocent diffs (replace/delete of stateful resources), state/backend safety, public exposure, over-broad IAM/RBAC widening, missing encryption, secrets in code or captured in state, tenant-isolation impact, drift from documented architecture, module pinning, and tagging/cost impact. Review-only: severity-ranked findings with file:line ...

Author incident response runbooks a responder who didn''t write them can execute at 3am — a SEV1–SEV4 ladder with one-minute criteria (ambiguity classifies up), roles (incident commander, comms, ops — small-org collapse stated), triage from page to decision point, containment invoking the rollback runbook by reference (rollback-runbook-author), tenant-aware comms templates per severity (never leaking other tenants'' data), evidence capture DURING the incident, SLI-verified resolution, and a b...

Design integration tests — the layer BETWEEN unit and E2E — that exercise modules through REAL service, command, database, auth, and permission boundaries with no browser. Every suite names exactly which boundaries are real and which seams stay faked (third-party APIs, clocks, email), with rationale per seam; defines the seeded-data and transaction/cleanup strategy, auth-context minting through real code paths, and per-boundary negative cases. Produces implementable specs and hands implementa...

Review the security of agent-to-agent and agent-to-MCP-server communication (OWASP Agentic ASI07) — mutual authentication (can a rogue process claim to be another agent or MCP server), message integrity, replay protection, confidentiality of sensitive payloads, topology allowlists (who may talk to whom), and spoofed tool results. Enforces authenticated ≠ trusted: a peer agent''s message is untrusted INPUT even on a secure channel — never instructions that change goals, identity, or permission...

Design a second mandatory data-scoping axis BELOW the tenant (location / site / region / org-unit / business-unit) for a multi-tenant SaaS — the per-user scope-grant model, the composite row-filter predicate on every scoped table (tenant_id AND scope), which roles are scope-restricted vs tenant-wide, server-derived propagation through app and edge layers, and the migration to add the axis to a live per-tenant schema. Presupposes the tenant boundary; this is a sub-tenant dimension inside ONE t...

Design ISO/IEC 27001:2022 certification readiness — the ISMS per clauses 4–10 (context incl. the Amd 1:2024 climate-relevance check, leadership, risk assessment/treatment incl. the 6.1.3 process behind the SoA, support and documented information, operation, performance evaluation incl. internal audit and management review cadence, improvement) plus Annex A selection across the four themes (A.5 Organizational, A.6 People, A.7 Physical, A.8 Technological — public control counts are secondary-so...

Design ISO/IEC 42001:2023 certification readiness — the AI management system (AIMS) per harmonized clauses 4–10 plus the AI-specific machinery: AI risk assessment (6.1.2/8.2), AI risk treatment (6.1.3/8.3), and AI system impact assessment (6.1.4/8.4 — impact on individuals and societies, distinct from org risk), with Annex A control-objective selection (public Annex A counts CONFLICT across sources and are never stated; use the licensed text). Net-new is mostly management-system artifacts; AI...

Author the pre-work, evidence-cited guide a parallel agent lane needs BEFORE its first task: the lane''s slice of the request lifecycle, the contracts it may rely on and must honor, a step-by-step recipe for its repeating unit of work, a per-unit checklist, and an explicit "what this lane must NOT do" boundary — every load-bearing claim cited to source files/PRs or labeled unverified, so the implementing agent starts from distilled verified knowledge instead of re-deriving it. One guide per l...

Decompose an end-to-end latency target into per-hop engineering budgets — map the path (edge → gateway → services → stores → third parties), allocate milliseconds per hop including the overhead nobody budgets (serialization, queue wait, connection setup, retries), do the tail math honestly (percentiles do not add; fan-out exposes a dependency''s tail at 1-(0.99)^N), derive timeouts and retries FROM budgets instead of folklore, keep explicit headroom, and define violation attribution plus the ...

Review a whole library-changing PR end-to-end — skill-adding, skill-modifying, or skill-retiring — as the integration layer above single-skill quality review. Verifies a fresh mechanical-validator run tied to the PR head (stale or merely claimed passes rejected), registration consistency (catalog, README, status tables, decision-log entry, banked-candidate graduation, skill-count arithmetic agreeing everywhere), collision of each added skill against the shipped corpus AND its in-batch sibling...

Review how an application consumes LLM output for improper output handling (OWASP LLM05) — treat every model output as untrusted data and trace it to each sink: HTML/markdown rendering (XSS), SQL/NoSQL/shell/eval execution (injection, RCE), file paths and URLs (traversal, SSRF), tool/function arguments, and stored-then-re-consumed content (second-order). Verify context-correct encoding/escaping, sandboxing for executed generated code — incl. autonomous generate-and-run loops, sandbox escape, ...

Plan the load that makes performance testing mean something — a workload model from production evidence (endpoint mix, write share, arrival patterns, think times) instead of one hammered URL, a tenant mix reproducing multi-tenant reality (many-small plus few-whale tenants; the noisy-neighbor scenario where one tenant''s burst must not degrade the rest, judged per-tenant, not aggregate), data volumes seeded to production shape and skew, test types chosen by the question (load-at-target, stress...

Before any commit, mirror CI locally: read the CI workflow definitions, derive the closest local equivalent of every PR-triggered check, run them, and verify the SAME checks pass on clean mainline FIRST via a separate git worktree (never by flipping a shared checkout). Classify every failure — PR-caused / pre-existing-on-main / CI-infrastructure / cannot-determine-locally; only PR-caused failures block; pre-existing ones are reported, not absorbed. Includes a declared docs-only lightweight pa...

Write full manual test cases executable by ANOTHER tester with zero tribal knowledge — each case has an id, requirement/risk trace, role/persona, environment, preconditions, exact test data, numbered steps with ONE observable expected result per step, screenshot checkpoints referenced to the evidence rules, pass/fail criteria, and cleanup. Cases cover happy, negative, and boundary paths and stay implementation-agnostic (what the user does, not what the code does). Use when asked to write manu...

Review an agent's persistent memory and stored context for poisoning (OWASP Agentic ASI06) — can untrusted content write into long-term memory (auto-summarized conversations, "remember this" injections, tool outputs persisted as facts), does a poisoned entry survive sessions and get trusted as ground truth later, and can memory bleed across tenants/users/sessions. Verifies validation-before-write, per-entry provenance, tenant/user/session scoping, TTL, purge with rollback, and recalled memory...

When the platform auto-deploys every merge to mainline, author the standing governance that makes merge==deploy safe: document that reality (including what does NOT auto-deploy); promote PR-time validation to the AUTHORITATIVE pre-production gate; reclassify post-merge validation as verification, never a gate; record the branch-protection config in-repo with WHO may change it (a human, never agents); state the accepted-risk exposure window; define rollback as revert-PR-then-auto-redeploy (squ...

Design the mobile and responsive viewport craft for a web UI — a content-driven breakpoint strategy (mobile-first; breakpoints where the layout breaks), touch-target sizing and spacing, safe-area/notch handling, the dynamic-viewport-unit fix for the URL-bar resize (the 100vh trap → svh/lvh/dvh), input behavior (right types, no focus-zoom, keyboard occlusion), hover-absence (no hover-only affordances) and gestures, and responsive layout patterns (reflow, wide tables, orientation). Produces a p...

Design what enters and leaves a model''s context window — a curated diet, not open access: context assembled SERVER-SIDE under hard token/size caps; every input passes a CLOSED schema; secrets/PII/raw payloads minimized or carried on a transient never-persisted channel with the persisted-vs-transient split explicit; what the model saw RECONSTRUCTIBLE afterward; exclusions designed and documented, never accidental. The context window is a supply chain — an unverified input is an unverified out...