All authors
Claude Skills by ModernNomad-98
github.com/ModernNomad-98212 skills1 installs222 views
- Model Poisoning ReviewerReview the integrity of the data and pipelines that shape a model's behavior against data and model poisoning (OWASP LLM05) — training and fine-tuning datasets (provenance, curation, who can contribute), RLHF/feedback loops (can attackers mass-signal bad behavior into the next update), the RAG/embedding INGESTION path (untrusted content indexed as ground truth, poisoned documents crafted to rank for targeted queries), and backdoor/trigger-phrase risk. Produces severity-ranked findings each wi...Votes: 0GitHub stars: 4
- Multi Framework CrosswalkMaintain the control crosswalk between compliance-control-foundation and framework projections: map each control to ISO 27001 Annex A, SOC 2 Trust Services Criteria, ISO 42001 Annex A, and optionally NIST AI RMF functions. Pin editions and label FULL/PARTIAL/NONE design coverage; do not claim operated satisfaction without separate organizational evidence. Verify every reference against framework text in hand and mark unavailable cells unverified. Use to map one control set across frameworks o...Votes: 0GitHub stars: 4
- Multi Tenant Data ArchitectDesign the tenant-scoped data layer — choose a scoping strategy per store, define server-validated tenant-context propagation from request to query, map ownership and shared data, plan tenant indexing and migration with verification and rollback, and output an isolation test matrix. A client tenant selector may be used for an authorized multi-tenant principal only after server-side membership validation; data queries use the resulting trusted context. Use when designing multi-tenant storage, ...Votes: 0GitHub stars: 4
- Multi Tenant Security TesterMANUAL-ONLY; never auto-invoke. Design and specify an executable negative-test suite that PROVES tenant isolation and object-level authorization hold — cross-tenant reads/writes, IDOR by-id enumeration, privilege escalation, wrong-role and wrong-tenant access, and service-role/background-job bypasses — with a per-surface test matrix, seeded two-tenant fixtures, and pass = the forbidden action is denied. Use when asked to write or plan tenant-isolation / authorization security tests, to turn i...Votes: 0GitHub stars: 4
- N Plus One DetectorMANUAL-ONLY; never auto-invoke. Detect and design out chatty data-access patterns — the N+1 (one query per row), repeated identical queries in one request, serial awaited calls in loops, and over-fetching. Detection is evidence-first: per-request query counts and logs, ORM instrumentation, static cues (lazy relation touched inside iteration); the fix is pattern-matched — eager/preload, batched IN-key or dataloader-style loads memoized per request scope, joins or denormalization with prices st...Votes: 0GitHub stars: 4
- Notification Webhook Ux DesignerDesign the human-facing UX around outbound notifications and webhooks. For END USERS — the notification model across channels (in-app, email, push), per-category preferences, digest-vs-realtime batching for noise control, read/unread state, quiet hours, and opt-out that truly stops the messages (security/transactional still send). For DEVELOPER integrators of your webhooks — the management surface: register/edit endpoints, pick event types, a delivery log with payloads + status, test-send, re...Votes: 0GitHub stars: 4
- Observability OperatorMANUAL-ONLY; never auto-invoke. Operate the observability stack hands-on — instrument services (structured logs with correlation IDs, tenant context, redaction before emission; metrics; traces), wire truthful health checks with timeouts, create or edit dashboards and alert rules (every alert carries severity, owner, runbook link, and a justified threshold), verify telemetry flows by running real queries, and manage noise (dedup, tuning, silences only with owner + expiry). Implements slo-relia...Votes: 0GitHub stars: 4
- Offline First Sync ArchitectDesign the client offline data layer for a multi-tenant SaaS: durable write queue, optimistic projection with rejection handling that preserves conflicted unsynced edits, explicit conflict detection and resolution, local persistence, background sync, and integrity-checked reconciliation. Produces the sync-engine design, conflict policy, local-store and queue schema, and reconciliation contract. Use for offline/flaky-network behavior, reconnect conflicts, or lost/duplicated optimistic writes. ...Votes: 0GitHub stars: 4
- Onboarding Doc DesignerDesign ONBOARDING documentation for someone JOINING a team/codebase — the first-day and first-week path, verified environment setup, an architecture/orientation tour (the mental model, not every detail), how-we-work (processes, tools, comms, rituals), key concepts and a glossary, a who-owns-what/who-to-ask map, a real first-task that produces an early win, and a plan to keep onboarding current (the docs that rot fastest). Audience is a new joiner ramping to productivity, not an external contr...Votes: 0GitHub stars: 4
- Operational Vs Analytical SplitterDecide which workloads must leave the operational (transactional) store and how — classify queries by shape (OLTP point reads/writes vs OLAP scans/aggregations), find what is actually hurting the transactional path (long scans, lock pressure, dashboard fan-out, export jobs), choose the offload mechanism per workload (read replica, CDC into a warehouse/lake, materialized/pre-aggregated views, or a cache) against each consumer''s stated freshness tolerance, and produce the split boundary with a...Votes: 0GitHub stars: 4
- Pagination Cursor DesignerDesign pagination for list endpoints and UIs: choose cursor/keyset or offset with drift and deep-page costs stated, define a versioned integrity-protected cursor holding sort keys, direction and sort/filter fingerprint, require deterministic ordering and a concurrency stability policy, set page-size bounds and honest end signaling, and apply tenant/permission scope server-side from trusted context on every page. Encoded cursor keys are decodable; encrypt if confidential. Choose load-more, num...Votes: 0GitHub stars: 4
- Performance Test HarnessDesign the harness that MEASURES performance as release evidence — what to measure per surface (endpoint percentiles, query timings, frontend metrics on a device class, job durations), an environment contract (prod-like data volume and tenant shape, pinned hardware, declared cache state), repeat-run baselines and noise bands, thresholds CONSUMED from latency-budget-architect and slo-reliability-architect (the harness asserts numbers others set), CI tiers (PR smoke, nightly full, pre-release) ...Votes: 0GitHub stars: 4
- Phased Work Handoff DesignerDesign the handoff artifact/protocol for MULTI-STAGE sequenced work where each stage carries its binding decisions forward as evidence — so a later stage (or a fresh agent/session) continues without re-deriving or contradicting what was decided. The discipline: a decision-ID register carried across stages (each decision''s ID, whether it still binds), per-stage changed-files AND NOT-touched lists, proven-invocation sections with tell-tale output (evidence the stage did what it claims), and de...Votes: 0GitHub stars: 4
- Pii Lifecycle DesignerDesign the end-to-end lifecycle for personal data across the WHOLE estate — PII inventory and classification mapped to every store it lands in (operational tables, analytics, logs, caches, search indexes, vector stores, backups, third-party processors), minimization at collection (purpose stated per field), retention schedules per class with enforcement mechanics, deletion/erasure design that PROPAGATES to derived copies and states the backup policy honestly, anonymization vs pseudonymization...Votes: 0GitHub stars: 4
- Plan Entitlement ArchitectTurn pricing plans into enforceable entitlements — map plan × feature × limit into an entitlement matrix (boolean features, numeric limits, usage-metered quotas), define one resolution point and a uniform enforcement-point map (UI, API, command paths, background jobs, integrations), specify metering hooks for usage-based limits, and design plan-transition behavior (trial expiry, upgrade, downgrade while over the new limit, cancellation, payment-failure grace) with grandfathering, staged rollo...Votes: 0GitHub stars: 4
- Playwright E2e EngineerMANUAL-ONLY; never auto-invoke. Implement and run Playwright E2E tests for CRITICAL user journeys — resilient user-facing locators (getByRole/getByLabel, testid last), web-first auto-retrying assertions, zero arbitrary sleeps or networkidle waits, project-level auth-state setup, deterministic test data, and trace/screenshot artifacts on failure wired for CI. Each journey names why a cheaper layer was insufficient; E2E stays a small, stable suite, not a UI-tree crawler. Use when asked to write...Votes: 0GitHub stars: 4
- Principal Code AnalystProduce a principal-level analysis of a subsystem or codebase area that connects code-level findings upward to architecture, data ownership, security posture, tenant isolation, reliability, performance, operating cost, and maintainability — and outputs an executive summary, architecture map, risk register with evidence, tradeoffs, a small-step remediation sequence, and a validation plan. Use when asked for a strategic or "principal-level" read on a subsystem, why an area is slow/fragile/expen...Votes: 0GitHub stars: 4
- Prioritization Frame PickerPick a prioritization framework for a decision — match the situation to a frame (RICE, WSJF/cost-of-delay, value-vs-effort/ICE, Kano, opportunity scoring, MoSCoW), surface its inputs and reliability, guard against false rigor, handle must-do and incomparable items outside the score, and produce a ranked list or honest categories/groups with assumptions and applicable uncertainty explicit. Owns the prioritization method; sequencing over time is roadmap-under-uncertainty-planner's. Use when a b...Votes: 0GitHub stars: 4
- Product Analytics InstrumenterDesign the INSTRUMENTATION for product analytics — where/how the analytics events (defined by event-schema-architect) fire: client-side vs server-side capture and when server-side is more trustworthy, the capture points, identity/session, consent and privacy (opt-out, consent-gated capture, PII minimization at the source, regional rules), capture reliability, tracking QA (does the event fire with the right properties), avoiding double-counting, and the debug/verification workflow. This is USE...Votes: 0GitHub stars: 4
- Product Spec WriterWrite a product specification for a feature — the problem and the user/job it serves, goals and explicit non-goals, scenarios and key flows, functional requirements with TESTABLE acceptance criteria, edge-case behavior, dependencies, rollout intent and success metrics, and open questions. Captures WHAT to build and WHY from the user''s perspective, at a level engineering and design can act on. Use when requirements are understood and need to become a spec, when writing a PRD/feature spec, or ...Votes: 0GitHub stars: 4
- Profiling Methodology DesignerDesign the profiling methodology that answers "where does the time (or memory) actually go" — profiler class per layer (sampling vs instrumenting CPU, allocation/heap, off-CPU/blocking-IO, distributed trace for cross-service attribution), measurement conditions that make results meaningful (warm vs cold, representative load and data volume, stated profiler overhead budget), the hypothesis-driven narrowing loop from symptom to attributed code path, baseline-profile conventions for differential...Votes: 0GitHub stars: 4
- Project OrchestratorThe beginner-facing front door: take a non-developer from vague idea to shipped product with no jargon to learn. Detects the project''s current stage (from docs/project-state.md + the repo), routes to the owning stage skill BY NAME, turns each technical decision into one plain-language business question, and records every dated decision — keeping the human as the approval/merge gate on every irreversible step (composing, never relaxing, ai-sdlc-operating-model''s stage-gate map and the approv...Votes: 0GitHub stars: 4
- Promotion Packet WriterAssemble a promotion case/packet for an engineer — evidence of impact ALREADY delivered, mapped to the target level's expectations. Inventory concrete accomplishments with measurable impact and scope of influence, map each to the leveling rubric's dimensions (scope, technical depth, leadership/influence, impact) so every dimension is covered, show the SUSTAINED pattern of operating at the level (not one heroic project), do an honest gap analysis against the target level, gather corroborating ...Votes: 0GitHub stars: 4
- Prompt Injection DefenderMANUAL-ONLY; never auto-invoke. Design the layered defense against prompt injection (OWASP LLM01) for an LLM feature or agent — establish trust zones (trusted rules vs untrusted user input, retrieved docs, emails, tool/model outputs, images, audio, file metadata), enforce that untrusted content can never change instructions/tool permissions/identity/access policy/execution plan, spec content/instruction separation, gate every side-effecting action behind deterministic authorization outside th...Votes: 0GitHub stars: 4
- Qa Automation ArchitectDesign the test-automation architecture that implements a QA strategy — tool/runner selection per layer with rationale, test project structure and naming, fixture/helper/factory layers, auth-state handling, parallelization and isolation rules, reporting/artifact conventions, CI pipeline placement (what runs on PR vs merge vs nightly, sharding, retry policy), and the flake-management policy. Produces the automation blueprint and migration steps from the current setup — it does not write the in...Votes: 0GitHub stars: 4
- Qa Strategy ArchitectDefine the product- or repo-level QA strategy — a risk inventory ranked by business/security impact, the test-layer split (what gets unit, integration, contract, E2E, manual coverage and WHY), ownership per layer, environment and test-data posture, required evidence per change class, and CI gate placement. QA starts from risk, and every layer choice picks the cheapest reliable layer for that risk. Use when asked how a product should be tested overall, to define or overhaul a test strategy, to...Votes: 0GitHub stars: 4
- Query Plan ReaderMANUAL-ONLY; never auto-invoke. Read ONE query's execution plan and turn it into a ranked tuning verdict — capture the plan with actual runtime statistics where safe (EXPLAIN-style, tool-agnostic), interpret operators (scans vs index access, join strategy, sort/spill, row-estimate vs actual divergence as the diagnostic core), name the dominant cost node, and rank fixes by evidence: statistics refresh, query rewrite, index add/change (write-amplification and storage price stated), or schema ad...Votes: 0GitHub stars: 4
- Rag Security ArchitectDesign or review the security of a RAG retrieval pipeline and vector store (OWASP LLM09) — enforce authorization AT RETRIEVAL TIME so a query returns only documents the calling user and tenant may see, scope every index/namespace by tenant, carry document ACLs into the query filter, and address embedding inversion, membership inference, poisoned documents, and stale permission metadata. Compose tenant-isolation-reviewer and multi-tenant-data-architect for tenant scoping. Use for RAG retrieval...Votes: 0GitHub stars: 4
- Readme CraftsmanCraft or overhaul a README so a newcomer can understand, evaluate, and start using a project in minutes — the above-the-fold what/why/who in the first screen, a quickstart that actually runs, install and minimal usage, and links OUT to deeper docs (the README is the entry point, not the manual). Orders by reader need, resists dumping the whole manual inline, and keeps it maintainable. Use when writing or overhauling a README, when a project's front door does not explain what it is or how to s...Votes: 0GitHub stars: 4
- Realtime Subscription ArchitectDesign real-time client delivery for a multi-tenant SaaS — WebSocket / SSE / database-change subscriptions / presence: the channel/topic model, authorize-at-subscribe-time (the per-tenant AND per-user leak boundary, re-checked as authority changes — never trusting a client-named channel), fan-out, scaling stateful connections across nodes, backpressure and slow-consumer handling, reconnect with replay/resume, and presence/typing state. Produces the channel taxonomy, the subscribe-time authori...Votes: 0GitHub stars: 4
- Regression Suite CuratorCurate WHAT belongs in the regression suite and at which tier — promote fixed bugs at or above the chosen severity threshold and decide which tests earn smoke-tier status; document retirement/demotion for dead features, duplicated coverage or negative-value tests; fit smoke/PR/full/nightly tiers to runtime budgets; detect duplicate coverage; enforce quarantine owner, ticket and expiry; assign per-test ownership. Produces evidenced curation decisions; permanent security regression tests retire...Votes: 0GitHub stars: 4
- Release Readiness ReviewerRun the ship/no-ship gate for a specific release on EVIDENCE — every blocking dimension cites an artifact or is MISSING: CI on the exact candidate or shipping tree, artifact provenance, change-relevant tests, migration review, rollback path and rehearsal, flag defaults, docs, observability, and approvals. For auto-deploy-on-merge, gate the exact PR or merge-queue candidate before merge and verify the final commit afterward. Unknown on a blocking item is No-Go with the evidence that would flip...Votes: 0GitHub stars: 4
- Requirements Gathering FacilitatorFacilitate the elicitation of product requirements from stakeholders BEFORE a spec exists — run structured discovery (users and jobs-to-be-done, current workarounds, what "done" means), separate the problem from the solutions stakeholders arrive holding, surface the implicit (assumptions, constraints, non-goals, edge cases, compliance obligations), and expose and reconcile conflicts between stakeholders. Produces a structured requirements brief that FEEDS product-spec-writer. Use when require...Votes: 0GitHub stars: 4
- Reviewable Diff DisciplineMANUAL-ONLY; never auto-invoke. Keep a change small, scoped, and reviewable while implementing it — one intent per branch or pull request (PR), no drive-by edits, no opportunistic refactors, no generated noise or secrets staged. Stages only the intended files by explicit path and verifies the staged set matches the declared intent before commit. Use when implementing any code change, preparing a commit or PR, or when a working diff has grown beyond its stated purpose.Votes: 0GitHub stars: 4
- Risk Tiered Validation SelectorMachine-classify a change''s touched files into impact classes that select validation DEPTH — docs-only fast path, fast tier, or full tier — with a classifier that FAILS CLOSED: unmatched, ambiguous, or error cases escalate to full, never down. Ships tier check bundles, an explicit docs-only definition PLUS a "never docs-only" list (workflows, scripts, schema/migrations, auth/RLS, lockfiles, agent-instruction files), forced-full lists for high-risk surfaces, and diffable rules; aggregation is...Votes: 0GitHub stars: 4
- Rls Policy AuditorAudit and (where asked) author row-level-security policies for a tenant-scoped database — inspect SELECT/INSERT/UPDATE/DELETE policies per table for missing tenant scope, deny-by-default gaps, policy recursion, unsafe SECURITY DEFINER helpers, over-broad GRANTs, service-role/superuser leakage, and frontend-derived (client-supplied) tenant scope, and ALWAYS deliver a negative-test plan proving wrong-tenant/wrong-role/missing-auth access is denied per command. Use when asked to review, write, o...Votes: 0GitHub stars: 4
- Roadmap To Commitments TranslatorTranslate a directional, uncertainty-aware roadmap into what a team can actually COMMIT to — the binding delivery promises stakeholders will hold you to. Separate commit-able (high-confidence, capacity-backed, dependency-clear) from aspirational, ground commitments in real capacity (velocity evidence minus maintenance/interrupts, with a buffer), fold in cross-team dependencies and risk, translate outcomes into concrete deliverables with honest date RANGES, and manage the gap explicitly (what'...Votes: 0GitHub stars: 4
- Roadmap Under Uncertainty PlannerPlan a product roadmap under uncertainty — organize by non-binding horizons (now/next/later), label confidence separately from human delivery commitments, sequence by dependency and learning, frame outcomes rather than a feature checklist, and reconcile ambition against capacity with slack. Produces a roadmap, uncertainty-reduction sequence and re-planning cadence. Consumes prioritization from prioritization-frame-picker; owns sequencing and communication over time. Use when building or reset...Votes: 0GitHub stars: 4
- Rollback Runbook AuthorDesign the rollback STRATEGY for a change and author the rollback RUNBOOK a stranger can execute under pressure — roll-back-vs-fix-forward criteria with a time-box, the primitive per layer (artifact redeploy, blue/green flip, canary abort, flag kill, config revert), migration reversibility composed from secure-migration-reviewer (never re-derived), numbered steps with one observable verification each, bad-window data repair, comms, and a rehearsal requirement with staleness triggers. Absorbs ...Votes: 0GitHub stars: 4
- Saas Cost ArchitectBuild the cost model for a multi-tenant SaaS — enumerate cost drivers (compute, storage, database, AI tokens, seats, third-party providers, support load), attribute costs to tenants and plans via tenant-tagged usage, compute unit economics (cost per tenant, per seat, per plan tier vs revenue), identify unbounded and variable-cost exposure (AI, egress, storage) and noisy-neighbor risk, and define cost guardrails (quotas, alerts, degradation ladders, per-tenant kill criteria) with a staged roll...Votes: 0GitHub stars: 4
- Saas Platform ArchitectDesign the end-to-end structure of a multi-tenant SaaS platform — control-plane/data-plane split, per-component tenancy deployment model (pooled, siloed, or mixed), identity architecture, platform capability inventory (onboarding, billing, audit, support, feature flags, analytics), and an incremental rollout/rollback plan — grounded in inspection of the current system first. Use when asked how to structure a SaaS product for multiple tenants, whether to pool or isolate tenants, what belongs i...Votes: 0GitHub stars: 4
- Sast Orchestration DesignerDesign HOW a SAST suite is RUN over a repository — category-level analyzer selection (not a named vendor), ruleset/config management, baseline + diff-scanning (gate NEW-since-baseline on PRs vs full scans), incremental-vs-full strategy, a GOVERNED false-positive suppression list (never silent inline muting), and CI integration. Designs the RUNNING of SAST and feeds the whole-repo aggregator (security-scan-orchestrator, shipped); the INTERPRETATION of findings (true/false-positive, ranking, th...Votes: 0GitHub stars: 4
- Schema Evolution PlannerPlan how a live store's schema changes without breaking deployed readers and writers — the expand → migrate → contract sequence (additive first, dual-read/dual-write windows, backfill, contraction only after verified cutover), per-stage compatibility guarantees (old code × new schema, new code × old schema), consumer impact across ORM models, event payloads, and analytics extracts, a deprecation register for columns still physically present, and verification gates per stage. Produces the stag...Votes: 0GitHub stars: 4
- Scoped Approval RegisterPreserve granted human approvals as immutable grant records and later lifecycle events, with verbatim scope and evidence. Derive effective authority from the complete history so revoked, expired, consumed, or superseded grants cannot revive. Use when an approval must be recorded, agents re-ask an existing permission, or an authorization needs a citable source. Draft first; persist only within applicable user authorization. Existing current-session grants remain valid without repeat consent. D...Votes: 0GitHub stars: 4
- Screenshot Evidence PlannerDesign the screenshot/visual-evidence policy for testing and releases — WHICH checkpoints require captures (risk-worthy states, not everything), a deterministic NAMING convention, mandatory MASKING of sensitive data (PII, tokens, tenant identifiers) before storage, required METADATA (build, environment, persona, viewport, timestamp, case id), STORAGE location/retention/access rules, and how evidence links to test cases, PRs, and closeout reports. Also sets capture-quality rules (deterministic...Votes: 0GitHub stars: 4
- Search Architecture DesignerDesign search/discovery for a multi-tenant SaaS — in-database full-text (tsvector / trigram) vs a dedicated search engine chosen by scale and relevance need; the indexing pipeline and its freshness lag; relevance/ranking; the per-tenant search-isolation boundary (every query AND every index scoped so results never cross tenants — the search leak); and the faceting/pagination seam. Produces the engine decision, indexing + freshness plan, ranking model, and the tenant-isolation contract. Use wh...Votes: 0GitHub stars: 4
- Secrets Identity HardenerMANUAL-ONLY; never auto-invoke. Harden how an application handles secrets and identity — move hardcoded credentials/tokens/keys into a secret manager or server-only env, classify each variable as public vs server-only (and catch client-bundle exposure like VITE_/NEXT_PUBLIC_ leaks), enforce least-privilege service accounts, add rotation and revocation, and tighten session/token handling (expiry, refresh, storage flags) — with tests proving a secret is unreachable from the client and a rotated...Votes: 0GitHub stars: 4
- Secure Migration ReviewerReview a database migration for security and deploy safety before it ships — privilege/GRANT changes, effective RLS scope for the intended app role, unsafe defaults, destructive or irreversible operations, tenant-scoped backfills, lock/downtime risk, and forward/rollback safety with deploy-order coupling. A new tenant table with RLS enabled but no applicable policy is default-denied, an availability finding rather than exposure. Produces evidenced findings, rollback assessment, and negative t...Votes: 0GitHub stars: 4
- Security Logging Alerting ArchitectDesign the security-event detection and alerting layer — DETECTION coverage (what must be logged: authn failures/anomalies, access-control denials, privilege/config changes, injection/abuse signals, sensitive-data access), ALERTING rules (alert vs ticket, thresholds justified against baselines, correlation, noise control), and response WIRING (every alert has an owner, severity, escalation, runbook link). Addresses the detection and alerting portion of OWASP Top 10:2025 A09 (Security Logging ...Votes: 0GitHub stars: 4
- Security Pr ReviewerSecurity-focused review of an ACTUAL diff (PR, branch delta, or staged/working changes) — hunts authn/authz gaps, missing object-level and tenant-scope checks, injection, unsafe deserialization, secrets in code/config/logs, SSRF, mass assignment, and unsafe security-relevant changes introduced by the change. Reports severity-ranked findings, each with file:line evidence, an exploit path or abuse scenario for high-severity claims, and remediation; requires tenant-isolation and object-level aut...Votes: 0GitHub stars: 4