Claude Skills by onfire7777

Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guidance, cryptography patterns, and security scanning tools. Use when the user asks about security reviews, threat analysis, vulnerability assessments, secure coding practices, security audits, attack surface analysis, CVE remediation, or security best practices.

Static security analysis agent responsible for detecting hardcoded secrets, preventing SQL injection, validating inputs, configuring security headers, and scanning dependencies for CVEs. Used for security audits and vulnerability remediation.

Inspect Sentry issues, summarize production errors, and pull health data via the Sentry API (read-only). Use when user says "check Sentry", "what errors in production?", "summarize Sentry issues", "recent crashes", or "production error report". Requires SENTRY_AUTH_TOKEN. Do NOT use for setting up Sentry SDK, configuring alerts, or non-Sentry error monitoring.

Optimize for search engine visibility and ranking. Use when asked to "improve SEO", "optimize for search", "fix meta tags", "add structured data", "sitemap optimization", or "search engine optimization".

Install and configure shadcn/ui components for React projects. Guides component selection, installation order, dependency management, customisation with semantic tokens, and common UI recipes (forms, data tables, navigation, modals). Use after tailwind-theme-builder has set up the theme infrastructure, when adding components, building forms, creating data tables, or setting up navigation.

Manages shadcn components and projects — adding, searching, fixing, debugging, styling, and composing UI. Provides project context, component docs, and usage examples. Applies when working with shadcn/ui, component registries, presets, --preset codes, or any project with a components.json file. Also triggers for "shadcn init", "create an app with --preset", or "switch to --preset".

SharePoint Automation: manage sites, lists, documents, folders, pages, and search content across SharePoint and OneDrive

Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows ''secure by default'' and ''pit of success'' principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration.

A workflow guide that breaks down complex tasks (Epics) into atomic steps of 15 minutes or less. Manages progress tracking, derailment prevention, risk assessment, and timely commit suggestions. Used when complex task decomposition is needed.

Build Shopify apps, extensions, themes using GraphQL Admin API, Shopify CLI, Polaris UI, and Liquid. TRIGGER: "shopify", "shopify app", "checkout extension", "admin extension", "POS extension", "shopify theme", "liquid template", "polaris", "shopify graphql", "shopify webhook", "shopify billing", "app subscription", "metafields", "shopify functions"

Automate project management workflows in Shortcut -- create stories, manage tasks, track epics, and organize workflows through natural language commands.

Create Storybook stories, manage catalogs, and integrate visual regression testing. Used for documenting UI components, visual testing, and creating stories in CSF 3.0 format. Prepares Forge artifacts for presentation. Supports React Cosmos.

Expert agent for load testing, contract testing, chaos engineering, mutation testing, and resilience verification. Used to validate system limits, non-functional testing, and reliability.

A meta-tooling agent that analyzes a project's codebase, tech stack, and conventions to dynamically generate portable project skills. Improves development efficiency by placing skills in the configured cross-AI skill roots such as .claude/skills/, .agent/skills/, and OpenSkills-compatible locations.

Analyze websites and domains using SimilarWeb traffic data. Get traffic metrics, engagement stats, global rankings, traffic sources, and geographic distribution for comprehensive website research.

Automate SimilarWeb tasks via Rube MCP (Composio): website traffic, rankings, and digital market intelligence. Always search tools first for current schemas.

Create AI image generation code using the Gemini API, handling text-to-image generation, image editing, and prompt optimization. Use when image generation code is needed.

The definitive guide to chaining, composing, and layering multiple skills together for complex multi-phase tasks. Use when a task requires more than 2-3 skills, when you need to determine the optimal sequence of skill application, when skills need to pass outputs to each other, or when you need to build a custom workflow from existing skills. This is the "programming language" for skill orchestration — it turns individual skills into composable pipelines.

Maps the hidden connections between all 630+ installed skills, enabling cross-pollination of ideas across domains. Use when you want to find unexpected connections, when a problem in one domain might benefit from thinking in another domain, when you want to transfer patterns between fields, or when you want to see the bigger picture of how skills relate. This is the "neural network" that connects all skills into a living, interconnected knowledge system.

Guide for creating or updating portable AI skills via specialized knowledge, workflows, scripts, references, or tool integrations. For any skill modification or improvement request, read this skill first and follow its update workflow.

Deep dual-model debugging of AI skills using reasoning model and fast synthesis model. Use when asked to debug a skill, find bugs in a skill, review a skill for issues, fix a broken skill, or audit a skill's quality. Also use when a skill is not working correctly or producing unexpected results.

Hosted project-UI compatibility adapter for deploying skills through a provider gRPC-web API. Packages skills as zips, uploads/deletes/syncs per-project skill sets, and curates domain-relevant skills using LLM analysis. Use only when filesystem skills must be visible in a hosted project UI sidebar or synchronized across hosted projects.

Search the installed skill library to find and fully activate the most relevant skills for any user task. Use when the user asks to find a skill, search for skills, says "find the best skill for this", "which skill should I use", "search skills", or when the assistant needs to identify which installed skills are most applicable to a complex or unfamiliar task before execution. Also use proactively when facing a task outside core capabilities to discover specialized workflows, scripts, and dom...

Evaluate Agent Skills against official specifications and patterns derived from 17+ official examples. Use when reviewing, auditing, or improving SKILL.md files and skill packages. Provides multi-dimensional scoring and actionable improvement suggestions.

Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks,...

Automatically detect source types and build AI skills using Skill Seekers. Use when the user wants to create skills from documentation, repos, PDFs, videos, or other knowledge sources.

Sync and install skills from a GitHub skills repository into a local or global AI skill root. Use when the user asks to install skills, update skills, sync skills from GitHub, load a skill library, or ensure cross-AI skill roots are up to date.

Build Slack apps using the Bolt framework across Python, JavaScript, and Java. Covers Block Kit for rich UIs, interactive components, slash commands, event handling, OAuth installation flows, and Workflow Builder integration. Focus on best practices for production-ready Slack apps. Use when: slack bot, slack app, bolt framework, block kit, slash command.

Create strategic HTML presentations with Chart.js, design tokens, responsive layouts, copywriting formulas, and contextual slide strategies.

This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.

Automate Snowflake data warehouse operations -- list databases, schemas, and tables, execute SQL statements, and manage data workflows via the Composio MCP integration.

Create square social media carousel layouts with three cards, strong visual hierarchy, and export-ready composition.

Use when teaching complex concepts (technical, scientific, philosophical), helping learners discover insights through guided questioning rather than direct explanation, correcting misconceptions by revealing contradictions, onboarding new team members through scaffolded learning, mentoring through problem-solving question frameworks, designing self-paced learning materials, or when user mentions "teach me", "help me understand", "explain like I'm", "learning path", "guided discovery", or "Soc...

Teaches the AI to design like a high-end agency. Defines the exact fonts, spacing, shadows, card structures, and animations that make a website feel expensive. Blocks all the common defaults that make AI designs look cheap or generic.

Guide for quality focused software architecture. This skill should be used when users want to write code, design architecture, analyze code, in any case that relates to software development.

Manage software complexity through deep modules, information hiding, and strategic programming. Use when the user mentions "module design", "API too complex", "shallow class", "complexity budget", or "strategic vs tactical". Covers deep vs shallow modules, red flags for complexity, and comments as design documentation. For code quality, see clean-code. For boundaries, see clean-architecture.

Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.

Use when the user asks to generate, remix, poll, list, download, or delete Sora videos via OpenAI’s video API using the bundled CLI (`scripts/sora.py`), including requests like “generate AI video,” “Sora,” “video remix,” “download video/thumbnail/spritesheet,” and batch video generation; requires `OPENAI_API_KEY` and Sora API access.

Proposes new features by leveraging existing data and logic, creating Markdown specification documents for feature ideation, product planning, and feature proposals without writing code.

Reverse-engineering specialist that extracts specifications from existing codebases. Use when working with legacy or undocumented systems, inherited projects, or old codebases with no documentation. Invoke to map code dependencies, generate API documentation from source, identify undocumented business logic, figure out what code does, or create architecture documentation from implementation. Trigger phrases: reverse engineer, old codebase, no docs, no documentation, figure out how this works,...

Verifies code implements exactly what documentation specifies for blockchain audits. Use when comparing code against whitepapers, finding gaps between specs and implementation, or performing compliance checks for protocol implementations.

A ghost hunter that detects invisible issues in concurrency, asynchronous processing, and resource management. Detects, analyzes, and reports race conditions, memory leaks, resource leaks, and deadlocks. Does not write code. Delegates fixes to Builder.

Use when the user asks for text-to-speech narration or voiceover, accessibility reads, audio prompts, or batch speech generation via the OpenAI Audio API; run the bundled CLI (`scripts/text_to_speech.py`) with built-in voices and require `OPENAI_API_KEY` for live calls. Custom voice creation is out of scope.

Automate Spotify workflows including playlist management, music search, playback control, and user profile access via Composio

Use when tasks involve creating, editing, analyzing, or formatting spreadsheets (`.xlsx`, `.csv`, `.tsv`) using Python (`openpyxl`, `pandas`), especially when formulas, references, and formatting need to be preserved and verified.

Create pixel or sprite-style animated explainer slides with staged composition and retro visual language.

This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.

Master SQL query optimization, indexing strategies, and EXPLAIN analysis to dramatically improve database performance and eliminate slow queries. Use when debugging slow queries, designing database schemas, or optimizing application performance.

Use this skill for reinforcement learning tasks including training RL agents (PPO, SAC, DQN, TD3, DDPG, A2C, etc.), creating custom Gym environments, implementing callbacks for monitoring and control, using vectorized environments for parallel training, and integrating with deep RL workflows. This skill should be used when users request RL algorithm implementation, agent training, environment design, or RL experimentation.

Use when designing organizational structure (team topologies, Conway's Law alignment), mapping stakeholders by power-interest for change initiatives, defining team interface contracts (APIs, SLAs, decision rights, handoffs), assessing capability maturity (DORA, CMMC, agile maturity models), planning org restructures (functional to product teams, platform teams, shared services), or when user mentions "org design", "team structure", "stakeholder map", "team interfaces", "capability maturity", ...