Claude Skills by ModernNomad-98

Review the integrity of the data and pipelines that shape a model's behavior against data and model poisoning (OWASP LLM04) — training and fine-tuning datasets (provenance, curation, who can contribute), RLHF/feedback loops (can attackers mass-signal bad behavior into the next update), the RAG/embedding INGESTION path (untrusted content indexed as ground truth, poisoned documents crafted to rank for targeted queries), and backdoor/trigger-phrase risk. Produces severity-ranked findings each wi...

Maintain the control crosswalk — the do-the-work-once engine between compliance-control-foundation and the framework projections: one row per control mapping it to ISO 27001:2022 Annex A, SOC 2 TSC, and ISO 42001:2023 Annex A references, plus optionally its NIST AI RMF function — with edition pinning and FULL/PARTIAL satisfaction honesty. Published crosswalks put cross-framework overlap at roughly 60–80% — an industry estimate, never a standard-derived figure. Every cell is a CLAIM verified a...

Design the tenant-scoped data layer — choose and justify the scoping strategy per store (shared tables with tenant key, schema-per-tenant, database-per-tenant, or mixed), define the tenant-context propagation contract from request to query (server-derived, never client-supplied), map data ownership, handle shared/reference data, plan indexing and partitioning by tenant, and produce a tenant data migration plan with verification and rollback. Also outputs a data-layer isolation test matrix. Us...

Design and specify an executable negative-test suite that PROVES tenant isolation and object-level authorization hold — cross-tenant reads/writes, IDOR by-id enumeration, privilege escalation, wrong-role and wrong-tenant access, and service-role/background-job bypasses — with a per-surface test matrix, seeded two-tenant fixtures, and pass = the forbidden action is denied. Use when asked to write or plan tenant-isolation / authorization security tests, to turn isolation-review or threat-model ...

Detect and design out chatty data-access patterns — the N+1 (one query per row), repeated identical queries in one request, serial awaited calls in loops, and over-fetching. Detection is evidence-first: per-request query counts and logs, ORM instrumentation, static cues (lazy relation touched inside iteration); the fix is pattern-matched — eager/preload, batched IN-key or dataloader-style loads memoized per request scope, joins or denormalization with prices stated — plus the regression guard...

Design the human-facing UX around outbound notifications and webhooks. For END USERS — the notification model across channels (in-app, email, push), per-category preferences, digest-vs-realtime batching for noise control, read/unread state, quiet hours, and opt-out that truly stops the messages (security/transactional still send). For DEVELOPER integrators of your webhooks — the management surface: register/edit endpoints, pick event types, a delivery log with payloads + status, test-send, re...

MANUAL-ONLY; never auto-invoke. Operate the observability stack hands-on — instrument services (structured logs with correlation IDs, tenant context, redaction before emission; metrics; traces), wire truthful health checks with timeouts, create or edit dashboards and alert rules (every alert carries severity, owner, runbook link, and a justified threshold), verify telemetry flows by running real queries, and manage noise (dedup, tuning, silences only with owner + expiry). Implements slo-relia...

Design the client OFFLINE data layer for a multi-tenant SaaS — write-while-offline queue, optimistic apply + rollback on server reject, conflict detection/resolution (last-write-wins / field-merge / CRDT / manual), local persistence (IndexedDB/SQLite), background sync when connectivity returns, and online↔offline reconciliation with integrity. Produces the sync-engine design, the conflict-resolution policy, the local-store + queue schema, and the reconciliation contract. Use when the app must...

Design ONBOARDING documentation for someone JOINING a team/codebase — the first-day and first-week path, verified environment setup, an architecture/orientation tour (the mental model, not every detail), how-we-work (processes, tools, comms, rituals), key concepts and a glossary, a who-owns-what/who-to-ask map, a real first-task that produces an early win, and a plan to keep onboarding current (the docs that rot fastest). Audience is a new joiner ramping to productivity, not an external contr...

Decide which workloads must leave the operational (transactional) store and how — classify queries by shape (OLTP point reads/writes vs OLAP scans/aggregations), find what is actually hurting the transactional path (long scans, lock pressure, dashboard fan-out, export jobs), choose the offload mechanism per workload (read replica, CDC into a warehouse/lake, materialized/pre-aggregated views, or a cache) against each consumer''s stated freshness tolerance, and produce the split boundary with a...

Design pagination for list endpoints and their UIs — cursor (keyset) vs offset chosen with drift and deep-page costs stated, the opaque cursor's contents defined (sort key + deterministic tiebreaker + direction) with a stability contract, a total ordering mandated so rows never repeat or vanish under concurrent writes, default and max page sizes set, end-of-results signaled honestly (null next cursor, no guessed total), the tenant/permission predicate kept INSIDE the cursor so paging cannot c...

Design the harness that MEASURES performance as release evidence — what to measure per surface (endpoint percentiles, query timings, frontend metrics on a device class, job durations), an environment contract (prod-like data volume and tenant shape, pinned hardware, declared cache state), baselines plus variance-respecting regression detection (repeat runs, noise bands — never two single runs diffed), thresholds CONSUMED from latency-budget-architect and slo-reliability-architect (the harness...

Design the handoff artifact/protocol for MULTI-STAGE sequenced work where each stage carries its binding decisions forward as evidence — so a later stage (or a fresh agent/session) continues without re-deriving or contradicting what was decided. The discipline: a decision-ID register carried across stages (each decision''s ID, whether it still binds), per-stage changed-files AND NOT-touched lists, proven-invocation sections with tell-tale output (evidence the stage did what it claims), and de...

Design the end-to-end lifecycle for personal data across the WHOLE estate — PII inventory and classification mapped to every store it lands in (operational tables, analytics, logs, caches, search indexes, vector stores, backups, third-party processors), minimization at collection (purpose stated per field), retention schedules per class with enforcement mechanics, deletion/erasure design that PROPAGATES to derived copies and states the backup policy honestly, anonymization vs pseudonymization...

Turn pricing plans into enforceable entitlements — map plan × feature × limit into an entitlement matrix (boolean features, numeric limits, usage-metered quotas), define one resolution point and a uniform enforcement-point map (UI, API, command paths, background jobs, integrations), specify metering hooks for usage-based limits, and design plan-transition behavior (trial expiry, upgrade, downgrade while over the new limit, cancellation, payment-failure grace) with grandfathering, staged rollo...

MANUAL-ONLY; never auto-invoke. Implement and run Playwright E2E tests for CRITICAL user journeys — resilient user-facing locators (getByRole/getByLabel, testid last), web-first auto-retrying assertions, zero arbitrary sleeps or networkidle waits, project-level auth-state setup, deterministic test data, and trace/screenshot artifacts on failure wired for CI. Each journey names why a cheaper layer was insufficient; E2E stays a small, stable suite, not a UI-tree crawler. Use when asked to write...

Produce a principal-level analysis of a subsystem or codebase area that connects code-level findings upward to architecture, data ownership, security posture, tenant isolation, reliability, performance, operating cost, and maintainability — and outputs an executive summary, architecture map, risk register with evidence, tradeoffs, a small-step remediation sequence, and a validation plan. Use when asked for a strategic or "principal-level" read on a subsystem, why an area is slow/fragile/expen...

Pick and apply the RIGHT prioritization framework for a decision instead of defaulting to one — match the situation to a frame (RICE, WSJF/cost-of-delay, value-vs-effort/ICE, Kano, opportunity scoring, MoSCoW), surface the inputs each frame needs and how reliable they are, guard against false rigor (a precise RICE score built from guessed numbers), handle must-do and incomparable items OUTSIDE the score, and produce a ranked list with the frame's assumptions and sensitivity made explicit. Own...

Design the INSTRUMENTATION for product analytics — where/how the analytics events (defined by event-schema-architect) fire: client-side vs server-side capture and when server-side is more trustworthy, the capture points, identity/session, consent and privacy (opt-out, consent-gated capture, PII minimization at the source, regional rules), capture reliability, tracking QA (does the event fire with the right properties), avoiding double-counting, and the debug/verification workflow. This is USE...

Write a product specification for a feature — the problem and the user/job it serves, goals and explicit non-goals, scenarios and key flows, functional requirements with TESTABLE acceptance criteria, edge-case behavior, dependencies, rollout intent and success metrics, and open questions. Captures WHAT to build and WHY from the user''s perspective, at a level engineering and design can act on. Distinct from an ADR: a product spec describes a user-facing feature and how we know it is done; an ...

Design the profiling methodology that answers "where does the time (or memory) actually go" — profiler class per layer (sampling vs instrumenting CPU, allocation/heap, off-CPU/blocking-IO, distributed trace for cross-service attribution), measurement conditions that make results meaningful (warm vs cold, representative load and data volume, stated profiler overhead budget), the hypothesis-driven narrowing loop from symptom to attributed code path, baseline-profile conventions for differential...

The beginner-facing front door: take a non-developer from vague idea to shipped product with no jargon to learn. Detects the project''s current stage (from docs/project-state.md + the repo), routes to the owning stage skill BY NAME, turns each technical decision into one plain-language business question, and records every dated decision — keeping the human as the approval/merge gate on every irreversible step (composing, never relaxing, ai-sdlc-operating-model''s stage-gate map and the approv...

Assemble a promotion case/packet for an engineer — evidence of impact ALREADY delivered, mapped to the target level's expectations. Inventory concrete accomplishments with measurable impact and scope of influence, map each to the leveling rubric's dimensions (scope, technical depth, leadership/influence, impact) so every dimension is covered, show the SUSTAINED pattern of operating at the level (not one heroic project), do an honest gap analysis against the target level, gather corroborating ...

MANUAL-ONLY; never auto-invoke. Design the layered defense against prompt injection (OWASP LLM01) for an LLM feature or agent — establish trust zones (trusted rules vs untrusted user input, retrieved docs, webpages, tickets, emails, logs, tool/model outputs), enforce that untrusted content can never change instructions/tool permissions/identity/access policy/execution plan, spec content/instruction separation, gate every side-effecting action behind deterministic authorization outside the mod...

Design the test-automation architecture that implements a QA strategy — tool/runner selection per layer with rationale, test project structure and naming, fixture/helper/factory layers, auth-state handling, parallelization and isolation rules, reporting/artifact conventions, CI pipeline placement (what runs on PR vs merge vs nightly, sharding, retry policy), and the flake-management policy. Produces the automation blueprint and migration steps from the current setup — it does not write the in...

Define the product- or repo-level QA strategy — a risk inventory ranked by business/security impact, the test-layer split (what gets unit, integration, contract, E2E, manual coverage and WHY), ownership per layer, environment and test-data posture, required evidence per change class, and CI gate placement. QA starts from risk, and every layer choice picks the cheapest reliable layer for that risk. Use when asked how a product should be tested overall, to define or overhaul a test strategy, to...

Read ONE query''s execution plan and turn it into a ranked tuning verdict — capture the plan with actual runtime statistics where safe (EXPLAIN-style, tool-agnostic), interpret operators (scans vs index access, join strategy, sort/spill, row-estimate vs actual divergence as the diagnostic core), name the dominant cost node, and rank fixes by evidence: statistics refresh, query rewrite, index add/change (write-amplification and storage price stated), or schema adjustment — each with a re-verif...

Design or review the security of a RAG / retrieval pipeline and its vector store (OWASP LLM08) — enforce authorization AT RETRIEVAL TIME so a query only ever returns documents the calling user and tenant may see (never post-retrieval filtering), scope every vector index/namespace by tenant, carry document-level ACLs into the query filter, and address embedding-specific risks (inversion, membership inference, poisoned documents, stale-permission re-embedding). Composes tenant-isolation-reviewe...

Craft or overhaul a README so a newcomer can understand, evaluate, and start using a project in minutes — the above-the-fold what/why/who in the first screen, a quickstart that actually runs, install and minimal usage, and links OUT to deeper docs (the README is the entry point, not the manual). Orders by reader need, resists dumping the whole manual inline, and keeps it maintainable. Use when writing or overhauling a README, when a project's front door does not explain what it is or how to s...

Design real-time client delivery for a multi-tenant SaaS — WebSocket / SSE / database-change subscriptions / presence: the channel/topic model, authorize-at-subscribe-time (the per-tenant AND per-user leak boundary, re-checked as authority changes — never trusting a client-named channel), fan-out, scaling stateful connections across nodes, backpressure and slow-consumer handling, reconnect with replay/resume, and presence/typing state. Produces the channel taxonomy, the subscribe-time authori...

Curate WHAT belongs in the regression suite and at which tier — promotion criteria (every fixed bug gets a regression test; which tests earn smoke-tier status), retirement/demotion with written rationale (dead features, duplicated coverage, negative-value tests — never silent deletion), tier design (smoke/PR/full/nightly) against runtime budgets, duplicate-coverage detection, the quarantine registry (owner + ticket + expiry, enforced), and per-test ownership. Produces a curation decision list...

Run the ship/no-ship gate for a specific release on EVIDENCE, not vibes — every dimension is answered by a verifiable artifact or recorded as MISSING: CI check states on the release commit (run links), artifact provenance, test signal meaningful for THIS change, migration review (secure-migration-reviewer), a rollback path naming its primitive and rehearsal status (rollback-runbook-author''s artifact), flag defaults, docs, observability readiness, and approvals per change class. Unknown on a ...

Facilitate the elicitation of product requirements from stakeholders BEFORE a spec exists — run structured discovery (users and jobs-to-be-done, current workarounds, what "done" means), separate the problem from the solutions stakeholders arrive holding, surface the implicit (assumptions, constraints, non-goals, edge cases, compliance obligations), and expose and reconcile conflicts between stakeholders. Uses real questioning technique (open questions, concrete examples, five-whys) and produc...

Keep a change small, scoped, and reviewable while implementing it — one intent per branch or PR, no drive-by edits, no opportunistic refactors, no generated noise or secrets staged. Stages only the intended files by explicit path and verifies the staged set matches the declared intent before commit. Use when implementing any code change, preparing a commit or PR, or when a working diff has grown beyond its stated purpose.

Machine-classify a change''s touched files into impact classes that select validation DEPTH — docs-only fast path, fast tier, or full tier — with a classifier that FAILS CLOSED: unmatched, ambiguous, or error cases escalate to full, never down. Ships tier check bundles, an explicit docs-only definition PLUS a "never docs-only" list (workflows, scripts, schema/migrations, auth/RLS, lockfiles, agent-instruction files), forced-full lists for high-risk surfaces, and diffable rules; aggregation is...

Audit and (where asked) author row-level-security policies for a tenant-scoped database — inspect SELECT/INSERT/UPDATE/DELETE policies per table for missing tenant scope, deny-by-default gaps, policy recursion, unsafe SECURITY DEFINER helpers, over-broad GRANTs, service-role/superuser leakage, and frontend-derived (client-supplied) tenant scope, and ALWAYS deliver a negative-test plan proving wrong-tenant/wrong-role/missing-auth access is denied per command. Use when asked to review, write, o...

Translate a directional, uncertainty-aware roadmap into what a team can actually COMMIT to — the binding delivery promises stakeholders will hold you to. Separate commit-able (high-confidence, capacity-backed, dependency-clear) from aspirational, ground commitments in real capacity (velocity evidence minus maintenance/interrupts, with a buffer), fold in cross-team dependencies and risk, translate outcomes into concrete deliverables with honest date RANGES, and manage the gap explicitly (what'...

Plan a product roadmap when the future is genuinely uncertain — organize by horizon (now/next/later, or committed/planned/exploratory) instead of a false-precision Gantt of dated features, let confidence decay with distance, sequence by dependency AND by learning (retire the most uncertainty first), frame around outcomes/themes not a feature checklist, reconcile ambition against real capacity with slack, and communicate without over-promising. Produces a horizon-based roadmap with confidence ...

Design the rollback STRATEGY for a change and author the rollback RUNBOOK a stranger can execute under pressure — roll-back-vs-fix-forward criteria with a time-box, the primitive per layer (artifact redeploy, blue/green flip, canary abort, flag kill, config revert), migration reversibility composed from secure-migration-reviewer (never re-derived), numbered steps with one observable verification each, bad-window data repair, comms, and a rehearsal requirement with staleness triggers. Absorbs ...

Build the cost model for a multi-tenant SaaS — enumerate cost drivers (compute, storage, database, AI tokens, seats, third-party providers, support load), attribute costs to tenants and plans via tenant-tagged usage, compute unit economics (cost per tenant, per seat, per plan tier vs revenue), identify unbounded and variable-cost exposure (AI, egress, storage) and noisy-neighbor risk, and define cost guardrails (quotas, alerts, degradation ladders, per-tenant kill criteria) with a staged roll...

Design the end-to-end structure of a multi-tenant SaaS platform — control-plane/data-plane split, per-component tenancy deployment model (pooled, siloed, or mixed), identity architecture, platform capability inventory (onboarding, billing, audit, support, feature flags, analytics), and an incremental rollout/rollback plan — grounded in inspection of the current system first. Use when asked how to structure a SaaS product for multiple tenants, whether to pool or isolate tenants, what belongs i...

Design HOW a SAST suite is RUN over a repository — category-level analyzer selection (not a named vendor), ruleset/config management, baseline + diff-scanning (gate NEW-since-baseline on PRs vs full scans), incremental-vs-full strategy, a GOVERNED false-positive suppression list (never silent inline muting), and CI integration. Designs the RUNNING of SAST and feeds the whole-repo aggregator (security-scan-orchestrator, in-batch); the INTERPRETATION of findings (true/false-positive, ranking, t...

Plan how a live store's schema changes without breaking deployed readers and writers — the expand → migrate → contract sequence (additive first, dual-read/dual-write windows, backfill, contraction only after verified cutover), per-stage compatibility guarantees (old code × new schema, new code × old schema), consumer impact across ORM models, event payloads, and analytics extracts, a deprecation register for columns still physically present, and verification gates per stage. Produces the stag...

Record every granted human approval as a durable, append-style register entry — Status, Reason, Scope allowed, Scope FORBIDDEN, Evidence — so authorization survives the approving conversation and is cited from the repo, never re-argued from memory. Covers placement, entry lifecycle (supersede, never rewrite), and the deny-by-default citation rule: an action is authorized only if an ACTIVE entry''s allowed scope covers it as worded. Use when an approval was just granted and must be recorded, w...

Design the screenshot/visual-evidence policy for testing and releases — WHICH checkpoints require captures (risk-worthy states, not everything), a deterministic NAMING convention, mandatory MASKING of sensitive data (PII, tokens, tenant identifiers) before storage, required METADATA (build, environment, persona, viewport, timestamp, case id), STORAGE location/retention/access rules, and how evidence links to test cases, PRs, and closeout reports. Also sets capture-quality rules (deterministic...

Design search/discovery for a multi-tenant SaaS — in-database full-text (tsvector / trigram) vs a dedicated search engine chosen by scale and relevance need; the indexing pipeline and its freshness lag; relevance/ranking; the per-tenant search-isolation boundary (every query AND every index scoped so results never cross tenants — the search leak); and the faceting/pagination seam. Produces the engine decision, indexing + freshness plan, ranking model, and the tenant-isolation contract. Use wh...

MANUAL-ONLY; never auto-invoke. Harden how an application handles secrets and identity — move hardcoded credentials/tokens/keys into a secret manager or server-only env, classify each variable as public vs server-only (and catch client-bundle exposure like VITE_/NEXT_PUBLIC_ leaks), enforce least-privilege service accounts, add rotation and revocation, and tighten session/token handling (expiry, refresh, storage flags) — with tests proving a secret is unreachable from the client and a rotated...

Review a database migration for security and deploy safety before it ships — privilege and GRANT changes, RLS/policy enablement gaps (a new tenant table with no policy), unsafe defaults, destructive or irreversible operations (DROP, non-nullable-without-default, type narrowing), data backfills that bypass tenant scope, lock/downtime risk, and forward/rollback safety with deploy-order coupling to code. Produces severity-ranked findings with evidence, a rollback assessment, and required negativ...

Design the security-event detection and alerting layer — DETECTION coverage (what must be logged: authn failures/anomalies, access-control denials, privilege/config changes, injection/abuse signals, sensitive-data access), ALERTING rules (alert vs ticket, thresholds justified against baselines, correlation, noise control), and response WIRING (every alert has an owner, severity, escalation, runbook link). Closes OWASP Top 10:2025 A09 (Security Logging and Alerting Failures). Use when designin...

Security-focused review of an ACTUAL diff (PR, branch delta, or staged/working changes) — hunts authn/authz gaps, missing object-level and tenant-scope checks, injection, unsafe deserialization, secrets in code/config/logs, SSRF, mass assignment, and unsafe security-relevant changes introduced by the change. Reports severity-ranked findings, each with file:line evidence, an exploit path or abuse scenario for high-severity claims, and remediation; requires tenant-isolation and object-level aut...