Claude Skills by OutlineDriven

Use when existing cryptographic implementations and a vector-consuming harness need mutation-driven, cross-implementation test vector expansion. Produces targeted test vectors isolating escaped-mutant defects and a measured before/after kill-rate delta. Not for validating against the established Wycheproof corpus — use wycheproof. Not for coverage-guided fuzzing — use fuzz-harness-writing.

Use when an incoming vulnerability report, CVE, bug-bounty submission, or automated finding needs resource-allocation triage before deep verification. Evaluates through seven brocards and returns ACCEPT, DISMISS, or NEEDS-MORE-INFO. Don''t use for tasks that require source or remote-system changes.

Use when validating a cryptographic implementation against Project Wycheproof vectors to prove it accepts/rejects them correctly, or when explaining why an implementation disagrees with a vector. Produces parameterized valid, invalid, and acceptable cases with stable tcId identifiers and a per-category pass/fail/warn summary. Not for mutation-driven vector creation — use vector-forge. Not for zeroization auditing — use zeroize-audit.

Use when writing, reviewing, optimizing, validating, or migrating YARA or YARA-X malware-detection rules, including CRX or DEX rules. Produces a validated rule with family-specific indicators and separated validation results. Not for network IDS or memory-forensics rules.

Use when auditing C, C++, or Rust secret-handling code to verify zeroization survives compiler optimization (dead-store elimination, register spills). Produces findings JSON and a Markdown report correlating source lines with optimization-level evidence. Not for test vectors — use wycheproof.

Use when the user requests a userspace C or C++ security review with an explicit threat model, severity filter, and model. Runs a partitioned read-only audit and writes report, SARIF, and findings to a .c-review-results run directory. Not for kernel drivers, managed languages, or embedded code.

Use when building or reusing a CodeQL database, running CodeQL security analysis, or modeling project-specific sources and sinks. Produces a quality-gated database, nonzero query suite, and final SARIF. Not for manual vulnerability review — use confirmed-security-review.

Use when the user asks for a security review, vulnerability audit, or review of injection, XSS, auth, or crypto. Returns only HIGH-confidence vulnerabilities with attacker-controlled input confirmed, or a cleared report. Not for CodeQL analysis — use codeql-security-analysis.

Use when reviewing Django or DRF access control, IDOR, authorization, permissions, or tenant isolation. Returns validated findings with evidence, impact, and enforcing fixes. Not for Django query performance — use django-perf-review. No source or remote-system changes.

Use when mapping state-changing external entry points in a smart-contract codebase by access level. Returns signatures, access classification, restriction evidence, and callbacks. A human-invoked entry-points command with an optional directory is a supported invocation form.

Use when an authorized user needs to assess mobile-backend exposure from compiled Android APKs. Extracts backend configuration from APK carriers, probes discovered endpoints for misconfiguration under written authorization, and returns a per-APK classification with evidence and verified cleanup. Covers Firebase, custom HTTP backends, and cloud function endpoints. Human-only invocation.

Use when an orchestrator or user requests deep audit-context analysis of one function, or needs to build audit context across a codebase before vulnerability hunting. Produces fixed-format per-function prose analysis with cited lines, or a multi-function dossier with entry points, actors, state, and open questions. Not for vulnerability finding or severity rating. Local write only.

Use when asked to review GitHub Actions workflows for exploitable vulnerabilities, including prompt injection through AI coding actions (Claude Code Action, Gemini CLI, OpenAI Codex). Returns HIGH or MEDIUM findings each with a five-element exploitation scenario, or a cleared report. Not for general security review. Read-only.

Use when the user asks to audit a file, subtree, or repository for fallback secrets, default credentials, fail-open controls, weak primitives, permissive access, or exposed debug behavior. Returns a coverage-aware findings report. Not for exhaustive secret scanning.

Use when the user requests a security or correctness audit of a Rust crate, service, library, or subtree, especially unsafe, FFI, concurrency, async, or untrusted-input code. Dispatches cluster-based review workers with dedup and false-positive judging, and writes report.md and findings.sarif. Not for a general security audit. Use security-review.

Use when handling untrusted input, auth/authz, data storage, or external integrations to add security controls during construction. Not for auditing a change set — use security-review. Not for verifying a named finding — use security-finding-verification.

Use when a user asks for a Semgrep security scan or fast pattern-based scan of a codebase. Runs Semgrep with --sarif, merges results, and reports every finding with severity, file, and line. Not for authoring or porting rules. Use port-static-analysis-rule.

Use when a specialist agent must analyze APIs, configurations, or interfaces for misuse resistance. Returns findings with category, severity, exploitability, and recommendation. Not for a quick inline audit — use sharp-edges.

Use when asked to audit a code surface for security-relevant edge cases. Returns a structured findings report. Not for delegated specialist analysis — use sharp-edges-analyzer.

Use when assessing npm, PyPI, or Go dependency supply-chain risk. Produces deterministic findings.json and report.md with lockfile-aware advisories, three-state coverage, and separate remediation guidance. Handles lockfile-absent paths by marking transitive dependencies unassessable. Do not use for remote or irreversible changes.

Use when writing, reviewing, or generating Terraform HCL that must pass fmt and validate with correct file organization, naming, version pinning, and security defaults. Not for module authoring, state operations, `terraform apply`, or remote state.

Use when asked to migrate a JavaScript or TypeScript project from ESLint, Prettier, Standard, or mixed legacy lint configuration to Biome 2.5. Biome owns linting and formatting, legacy configuration and dependencies are removed, and the project CI check passes without auto-fix.

Use when asked to test Fastify applications without network sockets: auth, validation errors, uploads, streams, plugins, hooks. Tests exercise routes via inject() with no listener. Not for building the app — use fastify-schema-first-service.

Use when asked to prepare a Fastify service for production load and exposure: timeouts and payload limits, overload shedding, rate limiting, CORS and security headers, proxy safety, SIGTERM drain, and a measured performance baseline. Not for building the app; use fastify-schema-first-service.

Use when asked to build or extend a Fastify application: routes, plugins, JSON Schema validation/serialization, hooks/lifecycle, decorators, content types, and database wiring. Not for testing — use fastify-inject-testing; not for hardening — use fastify-production-hardening.

Use when a request concerns multi-tenant app scaffolding, tenant isolation, custom domain wiring, or SaaS architecture for Cloudflare or Vercel. Scaffolds tenant routing, domain logic, platform config, and a management surface locally. Not for single-tenant apps; use standard project scaffolding.

Use when deep diagnostics target Node.js segfaults, addon crashes, native or heap memory leaks, event-loop anomalies, thread-pool saturation, V8 deoptimizations, or binding.gyp failures. Returns a root-cause classification with tool evidence. Not for code edits or service restarts.

Use when asked to implement or fix service termination handling: SIGTERM or SIGINT, connection draining, health-check shutdown signaling, zero-downtime deploys. Not for general service scaffolding; use nodejs-service-foundations.

Use when asked to diagnose Node.js tests that hang after the runner reports completion. Finds and closes the leaked resource so the isolated test passes repeatedly and the full suite exits 0. Not for remote, credential, publish, deploy, or irreversible changes.

Use when asked to set up or harden Node.js service foundations: env validation, structured logging with redaction, typed error catalogue with instanceof and HTTP mapping, native TypeScript type stripping, and AbortController shutdown wiring. Not for dedicated shutdown implementation; use nodejs-graceful-shutdown.

Use when asked to build Node.js stream ETL pipelines for large-file or continuous ingestion without exceeding heap memory. Implements typed async-generator transforms, pipeline()-based backpressure, conditional caching for expensive lookups, and a bounded-memory benchmark. Not for remote, credential, publish, deploy, or irreversible changes.

Use when asked to make a Next.js App Router application crawlable, indexable, and structurally optimized for search with green Core Web Vitals. Configures sitemaps, robots, metadata, structured data, canonicals, internal linking, and CWV budgets, then validates with build, curl, and Lighthouse evidence. Not for security-header configuration or remote mutations.

Use when TypeScript tests use unsafe any or as assertions for partial or intentionally invalid fixtures. Replaces eligible assertions with intent-matching safe coercion functions and proves the project typecheck and test suite pass. Not for production source or manifest edits; test files only.

Use when asked to create a complete Node.js 24 TypeScript 7 command-line project with ESM, pnpm 11, tsdown, Biome, Vitest, Changesets, a locked CI workflow, and one observable command test. Not for a Next.js app scaffold; use scaffold-nextjs.

Use when asked to scaffold a Next.js turborepo end to end and verify it. Produces a working local turborepo with verified app setup, turbo configuration, and passing root gates. Deployment and launch are deferred to a human. Not for a CLI scaffold; use scaffold-cli; for course exercises; use scaffold-exercises.

Use when the user asks to enforce package boundaries, set up deep modules, stop deep imports, mutation-prove boundary rules, or ensure packages are reachable only through entry points in a TypeScript repo. Wires dependency-cruiser so each package is a deep module and mutation-verifies the rules bite. Not for remote, credential, publish, deploy, or irreversible changes.

Use when TypeScript source must be shaped proactively toward narrow types, discriminated unions, readonly fields, exhaustive variants, typed trust boundaries, correct module resolution, and the TypeScript 7 strict-flag baseline. Not for concrete error repair; use typescript-type-hardening; not for language-agnostic domain modeling; use type-driven.

Use when existing TypeScript code has concrete type errors, any, failing inference, or needs advanced type mechanism design (generics, conditional or infer, mapped or template-literal, branded, utility derivation, overloads, builders) repaired against the current project state. Not for strict-flag setup or proactive shaping; use typescript-best-practices.

Use when building, debugging, or verifying browser-rendered code, or when asked to run browser tests for pages affected by a PR or branch. Interactive mode drives an attached browser via Chrome DevTools MCP to inspect runtime state with console, network, accessibility, and performance evidence. Diff-scoped mode derives affected routes from a git diff, exercises each against the local dev server, and reports every route as Pass, Fail, or Skip. Not for source, remote-system, credential, publish...

Use when the user explicitly asks to build, modify, or publish a Manifest V3 Chrome extension. Authors manifest.json, service worker, content scripts, messaging, storage, and UI surfaces with minimal permissions and CSP compliance. Store submission requires explicit human invocation and human-supplied credentials.

Use when asked to run branch-diff browser QA against a PR or branch. Derives a test matrix from the diff, drives each scenario through a real browser, classifies Pass/Fixed/Skipped/Blocked, runs the automated suite, and writes a dogfood report with a ready/not-ready verdict. Not for live-URL visual audit — use web-design-review. No remote, credential, publish, deploy, or irreversible changes.

Use when asked to make a public site discoverable and readable by LLM agents using llms.txt, Markdown content negotiation, and alternate link headers. Emits standards-grounded artifacts, validates them by fetching each route, and reports per-route verification. Not for remote, credential, publish, deploy, or irreversible changes.

Use when asked to improve SEO, optimize for search, fix meta tags, add structured data, or improve AEO visibility. Runs a full technical, page, structured-data, and AEO audit and returns a prioritized markdown report. Not for tasks requiring source or remote-system changes.

Use when a user says a site or app is ready to ship and wants a decision-gated pre-launch readiness pass. Runs infrastructure, security, content, discovery, and quality checks with pass/fail accounting and an ordered fix queue. Not for deployment execution — use shipping.

Use when asked to audit, profile, or debug page load performance, Lighthouse scores, or site speed. Returns a report with quantified Core Web Vitals, prioritized issues, and specific recommendations. Don''t use for tasks that require source or remote-system changes.

Use when asked to verify frontend functionality, debug UI behavior, or capture browser screenshots and console logs against a local dev server. Generates a Playwright assertion script, executes it, and classifies PASS or FAIL from the exit code. Not for read-only browser inspection (use browser-testing) or remote, credential, publish, or deploy changes.

Use when asked to codify, audit, or port measurable prose style rules (syntax, rhythm, mechanics) into a versioned PROSE.md, separate from emotional tone. Not for tone-of-voice guides — use copywriting-tone-of-voice-creator; not for general copywriting — use copywriting.

Use when a user asks to create, refresh, or port a brand tone of voice guide with channel-specific modulation. Not for prose style guides — use copywriting-prose-creator; not for general copywriting — use copywriting.

Use when asked to write, review, or improve an engineering blog post, technical architecture deep dive, postmortem, or technical launch announcement. Produces evidence-grounded engineering copy with verified metrics, working code, and clear trade-off analysis.

Use when a grounded piece needs user-selected beat-by-beat assembly. Writes only human-selected verbatim beats to a target file in the chosen order. Not for unstructured capture — use writing-fragments; not for paragraph shaping — use writing-shape.