Claude Skills by peterbamuhigire

Use when coordinating or auditing multi-engine workflows, agent roles, command surfaces, hooks, evidence contracts, handoffs, or bounded recovery. Keeps domain doctrine in the owning engines.

Use when planning branch strategy, making commits, reviewing diffs, resolving conflicts, preparing pull requests, or shipping releases. Covers trunk-friendly collaboration, commit hygiene, conflict recovery, and CI-linked release discipline.

Use when auditing actual software implementation status against requirements, plans, schemas, integrations, tests, and release evidence, with a prioritised completion blueprint.

Use when auditing or improving this engineering engine or a product it produces. Coordinates evidence-backed baselines, small experiments, standardisation, and re-audits without replacing domain skills.

Use when fixing Markdown lint failures, heading structure, list spacing, code-fence languages, or local formatting consistency without changing document meaning.

Use when interviewing stakeholders and producing traceable SaaS requirements, business rules, user types, workflows, assumptions, and acceptance criteria before implementation.

Use when producing, reviewing, or consolidating SDLC documentation across planning, requirements, design, testing, deployment, user rollout, post-deployment, and maintenance phases. Load absorbed SDLC phase references as needed.

Use when authoring, normalising, or reviewing skills that must follow the repository house style, capability boundaries, input/output contracts, decision rules, references, and composition gates.

Use when auditing, grading, benchmarking, or conforming an entire skills engine. Measures taxonomy, doctrine, contracts, depth, routing, safety, references, output readiness, and normalisation priorities.

Use when auditing a skill or skills engine for safety, routing hazards, hallucination risks, unsafe tools/installers, credential harvesting, hidden execution, prompt injection, excessive permissions, data exfiltration, or retained third-party source content.

Use when authoring, creating, or upgrading a reusable SKILL.md, specialist-role instruction, or vendor adapter with repository house style, triggers, progressive disclosure, context pointers, permissions, output/evidence contracts, validation, and routing fixtures.

Use when significant implementation, architecture, API, database, routing, or planning changes require aligned project documentation and verified examples.

Use when applying the final quality gate to high-stakes bids, donor submissions, consulting deliverables, compliance knockout scans, evidence audits, spreadsheets, and delivery feasibility.

Use when designing, building, reviewing, or upgrading production software systems that must be secure, performant, maintainable, scalable, and user-centered. Apply before writing specs, code, architecture, APIs, databases, mobile apps, SaaS platforms, or ERP systems.

Use when scanning a codebase before deployment for critical vulnerabilities, server-error risks, unsafe AI-generated code, dependency problems, or payment misconfiguration.

Use when producing or reviewing a Data Protection Impact Assessment (DPIA) for a new feature or for Uganda DPPA-regulated, large-scale, sensitive, monitored, or high-risk personal-data processing.

Use when hardening or auditing Debian and Ubuntu hosts for identity, sudo, PAM, MFA, permissions, AppArmor, auditd, kernel, patching, integrity, boot, encryption, and CIS controls.

Use when designing, hardening, or auditing network security for self-managed SaaS infrastructure, including firewalls, WAF, VPN, TLS/PKI, IDS/IPS, SSH, segmentation, DDoS, and DNS controls.

Use when designing or reviewing application, API, or multi-tenant SaaS security. Produces threat models, abuse cases, authorisation matrices, secret plans, and OWASP-aligned evidence.

Use when auditing a PHP/JavaScript/HTML web application for security vulnerabilities. Covers configuration, authentication, authorization, input validation, XSS, API security, HTTP headers, and dependency scanning. Produces a severity-rated audit...

Progressive multi-pass context refinement for a context-starved subagent — a 4-phase DISPATCH-EVALUATE-REFINE-LOOP cycle, max 3 cycles, for when a subagent cannot predict upfront which files or context it needs. Narrower than skills/ai/ai-rag-patterns (general agentic RAG) and skills/ai/ai-agent-multi-agent-coordination (handoff contracts) — this skill is specifically the retrieval-refinement loop inside one subagent's own context-gathering pass.

Design, implement, and refactor Ports & Adapters systems with clear domain boundaries, dependency inversion, and testable use-case orchestration across TypeScript, PHP, Java, Kotlin, and Go services. Use when introducing or refactoring toward Ports and Adapters, or when domain logic has become entangled with I/O. Complements skills/architecture/microservices-architecture (service topology) and skills/architecture/api-design-first (boundary contracts) — this skill governs internal module bound...

Use when building, diagnosing, or modernising Java/JVM APIs, data pipelines, modular ERP, or Hibernate N+1/fetch plans with Spring Boot/Batch, Jakarta EE, transactions, tests, PostgreSQL/jOOQ, Maven/Gradle, WebLogic, Oracle JDBC, Quarkus, GraalVM, JFR, or javax-to-jakarta.persistence migration.

Use when architecting, specifying, implementing, or auditing PMS, POS, restaurant, hotel, resort, lodge, guest-house, venue, catering, or food-service software.

Create CodeTour `.tour` files — persona-targeted, step-by-step walkthroughs with real file and line anchors. Use for onboarding tours, architecture walkthroughs, PR tours, RCA tours, and structured "explain how this works" requests.

Convene a four-voice council for ambiguous decisions, tradeoffs, and go/no-go calls where multiple valid paths exist and structured disagreement is more useful than a single confident answer. Not for code review, implementation planning, or architecture design — use the dedicated agents/skills for those.

Use before answering setup, configuration, or API-reference questions about a specific library or framework, or before writing code that depends on its exact current behavior — fetch live docs via an MCP documentation server (e.g. Context7) instead of relying on training data, which is a fixed snapshot and goes stale as libraries release new major versions.

Use for GitHub repository operations beyond plain git — issue triage, PR review status and stale-PR policy, CI/CD failure diagnosis, release and changelog management, and Dependabot/secret-scanning monitoring, all via the `gh` CLI. Not for branching strategy, merge-vs-rebase, or local conflict resolution — use `sdlc-meta/git-collaboration-workflow` for those.

Use when onboarding an AI coding agent onto a hand-written legacy project (including this consultancy's WAMP/PHP client codebases) and you need to prevent "style drift" — the model imposing pretrained mainstream idioms onto a project with its own implicit conventions. Language- and framework-agnostic; aligns meta-architecture only, not syntax. Once run, becomes a standing behavioral constraint on all subsequent coding tasks in that project. Not for pure research or one-off questions unrelated...

Fork, sanitize, and package a private project for safe public release — a 3-stage pipeline (fork/strip secrets, sanitize/verify clean, package for release). Use when a private project (including any of this consultancy's engines or client codebases) must be prepared for public GitHub release. Prerequisite before publishing any Chwezi engine publicly.

Use when a task can go faster by doing independent work at the same time — batched reads/searches, concurrent subagents, isolated worktrees, or multiple verification lanes — without letting concurrency create conflicting writes or a false sense of "done." Not for deciding whether a task should be delegated to a subagent at all — this is about running already-independent lanes efficiently once decomposed.

Decision framework for choosing between regex and an LLM call when parsing structured or semi-structured text (forms, invoices, quiz/exam content, scraped listings) — start with regex, add an LLM only for the low-confidence remainder. Relevant to this engine's scraping and document-processing work.

Use when output must clear two independent adversarial reviewers before it ships — production code, published content, or any deliverable where a single self-reviewing agent shares the blind spots that produced the output. Not for internal drafts or deterministic checks (use build/test/lint pipelines for those).

Use when a long session is approaching a context limit, or is between task phases (research/plan/implement/test), to decide whether this is a good point to manually compact — rather than waiting for arbitrary auto-compaction to hit mid-task and discard state you actually needed.

Use when a defect, regression, intermittent failure, or performance symptom needs evidence-led reproduction and causal diagnosis before a fix; use advanced-testing-strategy to design broader test coverage.

Use before claiming a feature, refactor, or fix is complete, and before opening a PR — a fixed six-phase mechanical gate (build, types, lint, tests, security, diff review) that produces a READY/NOT READY verdict. Not a test-design framework — use `sdlc-meta/advanced-testing-strategy` to decide what tests to write; this is the ordered pipeline that runs them and reports the result.

Audit a project's Claude Code configuration (.claude/ directory, CLAUDE.md/AGENTS.md, settings.json, MCP server configs, hooks, and agent definitions) for security vulnerabilities and misconfigurations — hardcoded secrets, overly permissive tool allow lists, command injection in hooks, prompt-injection surface. Use whenever a hooks.json, agent roster, or settings.json changes, and before publishing a plugin/engine publicly. Newly relevant now that this engine ships real hooks and an agent ros...

Use when initialising documentation and a methodology roadmap for a brand-new project by detecting project type, selecting Waterfall, Agile, or Hybrid delivery, and generating the governed document sequence.

Use when the task matches skill: new project scaffold and this skill''s local workflow.

Use when checking that every irreversible agent action has signed approval evidence linked to the action audit log, and producing an approval-gap register or audit evidence pack.

Use when pricing, billing, refunding, recognizing revenue, or packaging commercial terms for agentic AI services and outcomes.

Use when mapping AI agent operations to SOC 2, ISO 27001, HIPAA, audit logs, control testing, attestations, and compliance evidence.

Use when capturing kill-switch, red-team, and eval-drift drills as audit-ready compliance evidence — minimum-cadence enforcement, pass/fail recording, and cross-link to the incident drill skill. Turns drills from operational exercises into SOC 2 / ISO 27001 / HIPAA evidence rows with signed packs.

Use when defining agent budgets, step limits, reversibility, blast-radius controls, kill switches, and governance policy for agentic AI systems.

Use when proving agent-memory erasure was complete and verifiable for GDPR / CCPA / POPIA / KE DPA requests — the 9-step cascade verification job emits a signed-off evidence pack. Pairs with `ai-agent-memory` (three-tier memory + erasure cascade) and `saas-tenant-data-portability-and-erasure` (tenant-level erasure pipeline).

Use when designing systems where multiple agents collaborate on one task — supervisor/worker, debate, plan-execute, peer handoff. Covers handoff message contracts, shared scratchpad, conflict resolution, deadlock detection, and the cost/SLA discipline that keeps multi-agent setups from spiralling.

Use when measuring, evaluating, replaying, evidencing, or tracking success for AI agent tasks, steps, traces, and outcomes.

Use when designing multi-tenant agent runtimes, control loops, state machines, retries, idempotency, step caps, durable resumability, scheduling, cancellation, and workflow boundaries.

Use when red-teaming agent tool and data perimeters for indirect prompt injection, action escalation, tenant exfiltration, unsafe tool chains, self-modification, or containment regressions.

Use when defining agent SLAs, customer commitments, SLA dashboards, credits, support promises, and service evidence for agentic AI products.