Claude Skills by Nmor

Production form accessibility — labels, errors, autocomplete, validation timing, multi-step flows, file inputs, date pickers, and the WCAG 2.2 Redundant Entry + Accessible Authentication SCs.

REST API design patterns including resource naming, status codes, pagination, filtering, error responses, versioning, and rate limiting for production APIs. Also lazy-loads api-versioning.md / contract-testing.md / schema-evolution.md / deprecation-lifecycle.md content migrated from rules/common/ on 2026-06-02.

AWS Lambda + API Gateway + Step Functions + EventBridge + SQS/SNS patterns. Cold-start mitigation, async webhook backpressure, idempotency, fan-out via SNS topics, retry/DLQ design, and Serverless Framework / SAM / CDK conventions. Auto-fires for `serverless.yml`, `template.yaml` (SAM), and `handlers/*.ts`.

Backend architecture patterns, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes.

Bash + shell scripting discipline — strict header (set -euo pipefail; IFS), naming conventions (kebab-case scripts, snake_case functions/vars, SCREAMING_SNAKE_CASE constants), always-quoted variables, defaults via ${var:-default}, getopts for arguments, structured logging to stderr, cleanup via trap, no backticks (use $(cmd)), no eval with user input, no rm -rf on unset vars, ShellCheck strict + shfmt format-check enforced. Auto-fires on shell scripts.

Double-entry bookkeeping patterns for engineering teams — chart of accounts, journal entries, ledger reconciliation, immutable accounting events, and the database schema patterns that produce auditable, restatable books for SaaS, marketplace, and fintech systems.

Create a short launch video, poster and share copy from a project or website when the user asks to brag about it or make a product demo video.

Patterns for integrating business calendar providers (Google Workspace, Microsoft 365, Zoho Workplace, business CalDAV). OAuth flow, push subscriptions, echo suppression, etag concurrency, and write-back via the outbox pattern.

CI + hooks discipline — ci-test-memory-tuning (test-suite memory budget vs runner OS headroom; OOM vs worker-thrash diagnostic), github-actions-gotchas (named pitfalls: bash -e + pipefail, 21K char expression limit, SHA-pin actions, runner OOM, workerIdleMemoryLimit thrash, pull_request vs pull_request_target), hooks (lifecycle: SessionStart / PreToolUse / PostToolUse / PreCompact / Stop / SessionEnd). Auto-fires on CI workflow files + hook scripts.

ClickHouse database patterns, query optimization, analytics, and data engineering best practices for high-performance analytical workloads.

Principal-level clinical data interoperability — FHIR R5, USCDI v4, HL7 v2 / CDA / CCDA, SMART on FHIR + SMART Health Cards / Links, ICD-10 / SNOMED-CT / LOINC / RxNorm / CPT terminologies, DICOM imaging, telehealth, mHealth (HealthKit / Health Connect). Sister to hipaa-compliance (regulation) and security (cryptography).

Principal-level cloud architecture — Well-Architected Framework pillars (operational excellence, security, reliability, performance, cost optimisation, sustainability), region/AZ/zone topology, compute and storage selection, multi-region patterns, and the disciplined decisions that turn cloud capability into resilient, cost-aware, secure systems instead of a sprawling spend graph.

Use the codebase knowledge graph for structural code queries. Triggers on: explore the codebase, understand the architecture, what functions exist, show me the structure, who calls this function, what does X call, trace the call chain, find callers of, show dependencies, impact analysis, dead code, unused functions, high fan-out, refactor candidates, code quality audit, graph query syntax, Cypher query examples, edge types, how to use search_graph.

Universal coding-quality discipline that fires on every code file — coding-style, patterns, reuse-first (rule of three), proper-fixes-first (no symptom-only patches), no-silent-drops (no orphan TODOs / suppression directives), no-silent-failures (every failure surfaces), no-discards (every value bound), no-ambient-globals (DI everywhere), no-local-fs, error-codes (stable codes), error-handling-with-context (operation + ids), log-levels (canonical FATAL/ERROR/WARN/INFO/DEBUG/TRACE), semver (Co...

Principal-level communication methodology — Pyramid Principle, audience analysis, written + verbal + visual modes, executive presence, narrative structure, presentations + memos + slack + email, difficult conversations, listening discipline, cross-cultural delivery, and the patterns that turn knowing the answer into the answer landing.

Community + governance discipline — code-of-conduct (Contributor Covenant v2.1 adoption; documented enforcement team + reporting paths + retaliation protection; quarterly transparency reports). Auto-fires on community/governance artifacts.

Interactive installer for Everything Claude Code — guides users through selecting and installing skills and rules to user-level or project-level directories, verifies paths, and optionally optimizes installed files.

Instinct-based learning system that observes sessions via hooks, creates atomic instincts with confidence scoring, and evolves them into skills/commands/agents.

Cost optimization patterns for LLM API usage — model routing by task complexity, budget tracking, retry logic, and prompt caching.

Learning hooks for every Council rule — the per-rule "signals to watch" (what observation means a rule is being weakened or missed) and "refinement candidates" (what kind of change that rule accepts). Use when refining, auditing or authoring a Council rule / skill / agent / CLAUDE.md, when running the continuous-learning batch (/learn, /evolve), when deciding whether an observed failure warrants a rule change, or when promoting a workspace pattern to global.

Deep review templates for high-risk architecture, security or delivery decisions, or an explicitly requested full Council review.

Full Council Structure — Core Five Divisions (Architecture/Implementation/Quality/Security/Testing) + Extended Eleven Divisions (Compliance/UX/Ops/Data/Finance/Risk/Strategy/People/ESG/AI-Ethics/Comms) with veto authority + agent rosters + per-division personas (collective experience, core principles, key deliverables, checklists, red flags) + Conversation Rules (order of speaking, research depth, disagreement protocol, escalation to user). Use when authoring/editing agent files, running Coun...

C++ coding standards based on the C++ Core Guidelines (isocpp.github.io). Use when writing, reviewing, or refactoring C++ code to enforce modern, safe, and idiomatic practices.

Use only when writing/updating/fixing C++ tests, configuring GoogleTest/CTest, diagnosing failing or flaky tests, or adding coverage/sanitizers.

C# / .NET discipline — ASP.NET Core idioms, Minimal APIs / MVC controllers, async/await end-to-end (no .Result/.Wait()), records for value types, sealed types where inheritance unneeded, IOptions<T> for config, ILogger<T> structured logging, HttpClientFactory not new HttpClient(), EF Core async + AsNoTracking + projection patterns, IExceptionHandler for global errors, MediatR for CQRS. Auto-fires on C# / .NET project files.

Dart 3.x / Flutter discipline — null safety mandatory; force-unwrap (!) banned outside justified narrow cases; const constructors everywhere possible; Riverpod / BLoC for state; freezed for immutable models + sealed unions; go_router for navigation; structured concurrency via async/await + Stream; Material 3 / Cupertino theming via tokens; analyser at fatal-infos + fatal-warnings. Auto-fires on Dart / Flutter project files.

Database migration best practices for schema changes, data migrations, rollbacks, and zero-downtime deployments across PostgreSQL, MySQL, and common ORMs (Prisma, Drizzle, Django, TypeORM, golang-migrate).

Principal-level datacenter operations — Uptime Institute tier model, BICSI / ANSI-TIA-942 structured cabling, power + cooling + space (PUE / WUE / CUE), physical security, capacity planning, change + incident management, vendor + SLA management, colocation strategy, and the operational discipline that keeps physical infrastructure running through grid events, hardware failures, and growth pressure.

Dependency hygiene — dependency-pinning (lockfiles committed, image digest pins, Actions SHA-pinned), dependency-vulnerabilities (CVE gate: MODERATE+ blocks), dependency-overrides-not-exceptions (fix the tree first via pnpm.overrides), license-allowlist-gate (SPDX allowlist + Trove cross-check), install-allowlist (no silent global installs; publisher allowlist). Auto-fires on manifests + lockfiles across every ecosystem.

Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies, and production readiness checklists for web applications.

Principal-level design system practice — design tokens, multi-platform theming, component API design, accessibility built-in, versioning + governance, contribution model, documentation, and the discipline that turns "one team's component library" into a load-bearing capability for every product surface — including producing high-fidelity, NON-generic ("anti-AI-slop") UIs by building on the real system + curated blocks + design-MCP tooling (shadcn / 21st.dev / Figma).

Human-centred problem solving via Stanford d.school / IDEO five-stage cycle (Empathize → Define → Ideate → Prototype → Test). Activates on UX research, service design, innovation workshops, problem-framing sessions, or when the solution space is unknown and the users are not the designers.

Django + Django REST Framework implementation discipline — project layout, model design, DRF serializers/viewsets, service layer, caching, signals, middleware, query performance, AND the full Django security surface (SECURE_* settings, authentication, authorization, SQL-injection and XSS prevention, CSRF, file-upload hardening, API security, security headers, secret handling, security event logging). Use when writing or reviewing any Django models.py, views.py, serializers.py, urls.py, settin...

Django testing discipline — TDD workflow for Django/DRF (RED-GREEN-REFACTOR against models, views, serializers, permissions), pytest-django and factory patterns, database and transaction handling in tests, API client testing, AND the verification gates a Django change must pass before it ships (migrations check, coverage floor, lint/type gates, deployment checks). Use when writing Django tests or verifying a Django change is done.

Docker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration. Also lazy-loads docker-deployment.md / docker-localhost-binding.md content migrated from rules/common/ on 2026-06-02.

Dockerfile + container discipline — multi-stage builds (build → runtime); pinned base image with tag + sha256 digest; non-root USER mandatory; COPY over ADD (except verified tarball); chained apt-get install + cache cleanup in same RUN layer; explicit WORKDIR; exec-form CMD/ENTRYPOINT; layer ordering least-frequent → most-frequent change; EXPOSE documentary; HEALTHCHECK for long-running services; OCI labels (org.opencontainers.image.*); .dockerignore mandatory; Hadolint at strict ruleset; Bui...

DynamoDB single-table design, composite keys, GSI design, conditional writes, BatchWrite/BatchGet chunking, atomic counters, TTL, streams, and cross-tenant isolation patterns. Auto-fires for files importing from `@aws-sdk/lib-dynamodb` or `@aws-sdk/client-dynamodb`.

Playwright E2E testing patterns — Page Object Model, configuration, CI/CD integration, artifact management, flaky test strategies, PLUS the decision-time patterns that come before the first test is written (black-box helper scripts, static-vs-dynamic routing, multi-server orchestration, reconnaissance-then-action, networkidle discipline).

Principal-level patterns for K-12 + higher-ed + corporate-learning platforms — LTI 1.3 / LTI Advantage, xAPI 2.0 (IEEE 9274.1.1-2023), cmi5, SCORM 1.2 + 2004 (4th Ed), OneRoster 1.2, Caliper Analytics 1.2, QTI 3.0, Common Cartridge 1.3, Open Badges 3.0 (W3C VC), AccessForAll 3.0, IRT-based adaptive assessment, UDL 3.0, WCAG 2.2 AAA for learners, proctoring + integrity, learning-analytics ethics. Sister to ferpa-coppa-compliance (regulation), wcag-accessibility (a11y), interaction-design (UX).

Formal evaluation framework for Claude Code sessions implementing eval-driven development (EDD) principles

Principal-level guidance for FERPA (20 USC §1232g), COPPA (15 USC §6501-6506 + 16 CFR Part 312 + 2025 FTC Final Rule), GDPR-K (Art 8), CIPA, state student-privacy laws (SOPIPA, NY Ed Law 2-d, Student Privacy Pledge), and platform compliance for K-12 + higher-ed + edtech. Sister to gdpr-ccpa-compliance, hipaa-compliance (where school-based health), audit-logging, data-retention.

Principal-level financial analyst workflow — earnings model maintenance, ratio analysis, accounting quality assessment, channel checks, sector-relative valuation, and producing the daily/weekly/quarterly analyst output that drives institutional investment decisions.

Principal-level fine-tuning lifecycle — when fine-tuning beats prompting + RAG, dataset curation, instruction tuning vs preference optimisation (SFT / DPO / RLHF), parameter-efficient methods (LoRA / QLoRA / adapters), evaluation, safety re-tuning, deployment, monitoring, and the cost / benefit framework for choosing between fine-tuning, RAG, and base-model usage.

Financial Planning & Analysis patterns for engineering teams supporting finance — budget vs actual variance, rolling forecasts, driver-based models, scenario planning, SaaS metrics (ARR, MRR, NRR, CAC, LTV, payback, magic number, Rule of 40), cohort analysis, and the data pipeline patterns that make FP&A self-serve.

Frontend development patterns for React, React Native, Vue, Next.js, SwiftUI, Flutter, state management, performance optimization, and UI best practices.

GDPR + CCPA/CPRA implementation patterns — lawful basis documentation, data subject rights, consent management, cross-border transfers, breach notification, DPIA, and RoPA. Implementation arm of the gdpr-ccpa.md rule. Also lazy-loads data-retention.md / audit-logging.md content migrated from rules/common/ on 2026-06-02.

Git + repo discipline — git-workflow (per-org identity, conventional commits, PR workflow), repo-setup-checklist (20-point first-touch security audit), docs-sync-with-code (every PR ships docs + code together), documentation-requirements (Diátaxis four-quadrant: tutorials / how-tos / reference / explanation). Auto-fires on git config + repo setup files + docs/.

Idiomatic Go patterns, best practices, and conventions for building robust, efficient, and maintainable Go applications.

Go testing patterns including table-driven tests, subtests, benchmarks, fuzzing, and test coverage. Follows TDD methodology with idiomatic Go practices.

Principal-level guidance for HIPAA Privacy + Security + Breach Notification + HITECH + 42 CFR Part 2 compliance — BAAs, minimum-necessary, ePHI encryption, audit controls, breach 60-day clock, OCR enforcement. Sister to gdpr-ccpa-compliance, audit-logging, data-retention, security.