Claude Skills by Nmor

Principal-level hiring system design — role definition, sourcing, structured interviewing, bar-raising, calibration, offer, and onboarding. Treat hiring as the highest-leverage decision an organisation makes and engineer the process to minimise predictable failure modes (unstructured interviews, halo effect, like-me bias, rushed decisions, weak onboarding).

Principal-level historical analysis — primary-source critique, archival methodology, periodisation, oral history, cliometrics, historiography, and the fallacies (presentism, Whig history, anachronism, hindsight bias) that turn the past into a mirror of present preoccupations rather than a foreign country worth understanding on its own terms.

Internationalisation discipline — every user-facing string in a catalog (no inline strings); ICU MessageFormat for plurals + interpolation; Intl APIs for date / number / currency / list / collation; BCP 47 locale identifiers; RTL mirroring for Arabic / Hebrew / Persian / Urdu; locale-aware sort + search; per-country address + name formats; currency placement varies by locale; transactional emails / SMS / push routed through the same i18n pipeline. Auto-fires on i18n / locales / translations /...

Financial statement preparation under IFRS and US GAAP — Balance Sheet, Income Statement, Cash Flow, Statement of Changes in Equity, revenue recognition (IFRS 15 / ASC 606), leases (IFRS 16 / ASC 842), the key IFRS↔GAAP differences, and the engineering-side patterns for producing audit-quality reports from the general ledger.

Principal-level interaction design — affordances, signifiers, feedback, mappings, constraints, error prevention, recovery, gesture + input model design, microcopy, motion as functional language, and the discipline that turns flows into experiences users complete without thinking and don't have to recover from.

Principal-level investment research methodology — thesis development, primary research, financial modelling, valuation triangulation, risk identification, and the disciplined write-up that supports a buy / sell / hold recommendation.

Principal-level due-diligence methodology for evaluating fund managers, private company investments, and acquisition targets — operational, financial, legal, commercial, technology, ESG, and reference diligence with a structured red-flag scoring system.

ISO/IEC 27001:2022 Information Security Management System (ISMS) implementation patterns — Annex A 93 controls in 4 themes (Organizational, People, Physical, Technological), Statement of Applicability, risk assessment / treatment, and the engineering-side controls that auditors actually verify.

Pattern for progressively refining context retrieval to solve the subagent context problem

Java coding standards for Spring Boot services: naming, immutability, Optional usage, streams, exceptions, generics, and project layout.

JPA/Hibernate patterns for entity design, relationships, query optimization, transactions, auditing, indexing, pagination, and pooling in Spring Boot.

Kotlin 2.0+ discipline — null safety (no !! force-unwrap; safe call + Elvis), immutability (val over var; data class + copy), sealed classes for closed hierarchies, scope functions (let/run/apply/also/with) used purposefully, structured concurrency via coroutines (no GlobalScope.launch; supervisor scopes + Job cancellation), CoroutineExceptionHandler for unhandled errors, ktlint + detekt at strict ruleset, expression bodies for one-liners, KDoc on public API. Auto-fires on Kotlin source.

Lean operating philosophy — Just-in-Time, Jidoka, heijunka, kaizen, value-stream mapping, eight wastes, takt time, kanban, andon, single-piece flow. Applied to any value-producing system (manufacturing, software, healthcare, services), not just factories. Sister to six-sigma (variation reduction), supply-chain-patterns (cross-org flow).

Principal-level methodology for building products under extreme uncertainty — validated learning, build-measure-learn loops, MVPs, innovation accounting, pivot-or-persevere, customer development, and engines of growth.

Staging area for learning-loop outputs. Holds artifacts captured by continuous-learning-v2 + /learn + /evolve commands awaiting review, promotion, or demotion per the continuous-learning-mandate.md global rule.

Lua 5.x discipline — module pattern (local M = {}; return M); local-everywhere (no global pollution); pcall/xpcall for protected calls with proper handler; safe loadstring (text-only via load(s, 'chunk', 't')); OO via metatables when needed; coroutines for cooperative concurrency; embedding-specific patterns (OpenResty cosockets, Neovim vim.api, Redis EVAL determinism); luacheck strict + stylua format-check; NEVER setfenv on untrusted code; NEVER load with bytecode flag from network. Auto-fir...

Markdown style — CommonMark + GFM compliant, yamllint-clean YAML frontmatter, markdownlint rules enforced (MD004 dashes for ul, MD022 blanks around headings, MD031 blanks around fenced code, MD032 blanks around lists, MD040 fenced code language tag, MD025 single H1, MD034 no bare URLs, MD047 single trailing newline). Line length capped at 100 chars (longer tolerated only on unbreakable table rows or URLs). One H1 per document; heading hierarchy never skips levels. Auto-fires on markdown sources.

Build production-grade Model Context Protocol (MCP) servers — stdio + streamable HTTP transports, tool / resource / prompt primitives, capability negotiation, auth model, idempotency, observability, testing via MCP Inspector, 10-question evaluation framework. Use when designing a new MCP server to expose an internal API / data source / workflow as a Claude (or any MCP client) tool. Sister to install-allowlist.md (publisher gates for downstream consumers), secrets-management.md (no secrets in ...

Mechanical, Electrical, Plumbing (plus Fire Protection, Telecommunications, AV, Security, BMS) coordination through design, BIM-modelling, clash-detection, fabrication, and commissioning. Activates on building-services design, ISO 19650 BIM workflows, ASHRAE / BICSI / NFPA standards, multi-discipline AEC coordination.

Principal-level model selection framework — match problem class to model family (linear / tree / kernel / neural / foundation), evaluate via cross-validation with proper data splits, factor in inference cost + latency + interpretability + compliance constraints, and avoid the common traps that produce strong offline metrics but weak production performance.

Principal-level MLOps — feature stores, model registry, training pipelines, deployment patterns (online / batch / streaming), monitoring (drift, performance, fairness), CI/CD for models, A/B testing, rollback discipline. Treat models as software artefacts with full lifecycle management.

Principal-level negotiation methodology — interest-based negotiation (Harvard Method), BATNA + ZOPA + reservation values, tactical empathy (Voss), preparation discipline, multi-issue tradeoff design, cross-cultural patterns, and the discipline that turns adversarial bargaining into joint problem-solving with durable outcomes.

Principal-level networking patterns — OSI / TCP-IP layering, IP addressing + CIDR design, routing, DNS, TLS, load balancing, CDN, service mesh, network security (firewalls / WAF / DDoS / segmentation), zero-trust networking, and the operational discipline that keeps packets flowing reliably + securely across single-region, multi-region, and hybrid topologies.

Process, convert, OCR, extract, redact, sign, and fill documents via the Nutrient DWS (Document Web Services) API. Supports PDF, DOCX, XLSX, PPTX, HTML, and image inputs through a single multipart endpoint. Use for document conversion, OCR of scanned content, PII redaction, watermarking, digital signing, and PDF form fill.

Structured logging, EMF metrics, request-id propagation, per-tenant dimensions, and CloudWatch / OTEL conventions for serverless and long-running services. Auto-fires for handler files, lib code, and middleware where logs / metrics are emitted. Also lazy-loads observability.md content migrated from rules/common/ on 2026-06-02.

Principal-level OKR (Objectives + Key Results) design, deployment, grading, and anti-pattern avoidance for teams and organisations.

Principal-level organisational design — team topologies, span of control, reporting structures, decision rights (DACI / RACI), Conway's Law, coordination cost, scaling from 10 to 1000, the difference between functional / divisional / matrix / network structures, and the discipline that aligns the org chart to the product strategy.

OWASP Application Security Verification Standard 4.0.3 — the canonical control catalogue for application security, mapped per L1 / L2 / L3 with implementation patterns and verification commands.

Principal-level patterns for accepting card / bank / wallet / instant-rail payments — idempotency, 3DS2 + SCA, network tokenization, subscriptions, dunning, refunds + chargebacks, payouts, ledger reconciliation. Sister to pci-dss-patterns (compliance) and bookkeeping-patterns (double-entry).

PCI-DSS v4.0 implementation patterns for systems that store, process, or transmit cardholder data — scope reduction via tokenization, SAQ selection, segmentation, encryption requirements, and the 12 PCI-DSS requirements mapped to concrete engineering controls.

Principal-level performance management — feedback systems, calibration, ratings (or no ratings), career frameworks, performance improvement plans, and the operational discipline that turns reviews from anxiety-inducing theatre into a real engine of growth, retention, and accountability.

Planning + verification discipline for multi-phase work — code-graph-validation (incremental per-task + phase-boundary + pre-push sweeps), ADR template (MADR / Nygard format), runbook template (canonical incident-response structure). Invoke when writing or reviewing a plan, an ADR or a runbook, and before acting on the detail of plan-completion-before-push.md.

Principal-level portfolio construction — Markowitz mean-variance optimisation, CAPM, factor models, risk budgeting, rebalancing discipline, drawdown and tail-risk management. Diversification is the only free lunch; respect transaction costs and behavioural traps.

PostgreSQL database patterns for query optimization, schema design, indexing, and security. Based on Supabase best practices.

Template for authoring a project-specific skill in `<workspace>/.claude/skills/`. Demonstrates the canonical shape — Architecture / File Structure / Code Patterns / Testing Requirements / Deployment Workflow / Critical Rules — that workspace skills follow when they extend global guidance with project-specific specifics. Use this file as a starting point; copy + customise per the project's actual stack.

Principal-level prompt engineering — task decomposition, role + context + instructions + examples + output-format structure, few-shot patterns, chain-of-thought, tool-use prompts, evaluation, prompt versioning, and the discipline that separates "works once on the demo" from "production-grade prompt that survives model upgrades". Auto-fires when the work touches LLM prompts, system messages, agent instructions, or prompt template files.

Transforms vague or under-specified prompts into actionable, research-grounded requests through systematic codebase + workspace + open-source + online research. Wires the user's directive flow into the Council Protocol Phase 0 and the global task-intake-due-diligence.md questionnaire. Invoked by the UserPromptSubmit hook when a prompt lacks specificity OR when a clear-but-significant prompt needs the full intake before execution.

Read and cite primary-source provider documentation BEFORE writing any integration code against an external API. Enforces the official-docs-first rule across calendar, identity, payment, mail, push, ML, and observability providers.

Pythonic idioms, PEP 8 standards, type hints, and best practices for building robust, efficient, and maintainable Python applications.

Python testing strategies using pytest, TDD methodology, fixtures, mocking, parametrization, and coverage requirements.

Retrieval-Augmented Generation (RAG) system design — chunking, embeddings, vector storage, hybrid retrieval, reranking, evaluation, grounding, and the RAG-vs-fine-tune-vs-long-context decision. Auto-fires when the work touches RAG pipelines, vector databases, embeddings, semantic search, document grounding, or knowledge-base-backed LLM applications.

Principal-level research methodology — primary vs secondary sources, quantitative + qualitative + mixed methods, literature review, evidence hierarchies, experimental design, survey + interview craft, bias identification, statistical inference, reproducibility, citation discipline, and the discipline that separates "I read some articles" from "I produced load-bearing evidence that supports a real decision".

Resilience patterns — circuit-breaker (per-DEPENDENCY breaker; CLOSED/OPEN/HALF-OPEN), graceful-degradation (P0-P3 criticality tiers; explicit degraded UX never silent), feature-flags (every flag has owner + expiry + decision criteria; OpenFeature spec; kill switches pre-built), idempotency (Stripe keys; RFC 9110 method semantics; webhook event-id dedupe), rate-limiting (multi-layer; per-endpoint defaults; RFC 6585), deploy-failures-become-checks (every deploy failure becomes a pre-deploy che...

Ruby 3.3+ / Rails 7-8 discipline — Sandi Metz rules (classes ≤ 100 LOC, methods ≤ 5 LOC, ≤ 4 args), frozen_string_literal mandatory, RuboCop at strict (cyclomatic ≤ 7, AbcSize ≤ 15), modern Ruby idioms (endless methods, pattern matching, hash shorthand, numbered block params), service objects + form objects + query objects + value objects, Rails 8 Solid Queue / Solid Cache / Solid Cable defaults, no monkey-patching outside Refinements / Module#prepend, Brakeman + bundler-audit + RSpec at stri...

Rust idioms — ownership-first design; types encode invariants (newtype pattern for UserId / Cents / etc.); errors as values (Result<T, E> + thiserror for libs + anyhow for apps); enums for closed sets (exhaustive match); builders for many-optional inputs; protocol-style traits for ports (dependency inversion); DI via struct composition (Arc<dyn Trait>); async/await + tokio with structured concurrency (try_join! / JoinSet); no .unwrap() outside tests (use ? or expect with reason); no panic! in...

Research-before-coding workflow. Search for existing tools, libraries, and patterns before writing custom code. Invokes the researcher agent.

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns. Also lazy-loads the security.md / security-controls-org-wide.md / secrets-management.md content migrated from rules/common/ on 2026-06-02.

Scan a Claude Code configuration surface (`.claude/` directory, `CLAUDE.md`, `settings.json`, MCP servers, hooks, agent definitions) for security vulnerabilities, misconfigurations, and prompt-injection risks using AgentShield (`ecc-agentshield`). Sister to `security-review` (broader OWASP / source-code audit). Use this skill when the target is the AGENT CONFIG, not the application source.

Data-driven variation reduction via DMAIC (Define / Measure / Analyse / Improve / Control), with Lean Six Sigma fusion when waste + variation co-exist. Belts framework (Yellow / Green / Black / Master Black), SPC charts, FMEA, design of experiments, hypothesis tests, capability indices (Cp / Cpk). Sister to lean-manufacturing (waste reduction).

SOC 2 Type I and Type II readiness patterns — Trust Service Criteria (Security / Availability / Processing Integrity / Confidentiality / Privacy), control-to-evidence mapping, and the operational evidence collection patterns that survive a continuous-period audit.