Claude Skills by pitimon

Use when asked to generate professional cybersecurity documents — IR playbooks, DFIR forensic reports, SOC L1–L3 triage runbooks, DevSecOps pipeline configs, threat models, compliance gap analyses, or executive cyber-risk reports. Covers 22 domains across AppSec / Cloud / OT / AI-ML / API / Identity / Web3, bilingual Thai+English output mapped to NIST 800-53, MITRE ATT&CK, OWASP, ISO 27001. Also: post-pentest defensive (Shannon handoff manifest). Triggers: "incident response", "SOC triage", "...

Generate AI-assisted development log from git history + Co-Authored-By trailers. Use for EU AI Act Article 11 (technical documentation) audit trail and AI transparency. Maps to H4 (Win-Win — honest disclosure) + H1 (Be Proactive — audit-ready).

Decompose feature into atomic tasks — 1 task per agent. Use AFTER /design and BEFORE /build-brief. Step 3 of 7-step workflow. Maps to H3 (First Things First).

Generate context-rich implementation brief before coding. Use AFTER /breakdown for each task. Step 4 of 7-step workflow. Maps to H5 (Seek First to Understand).

Assess your 8-habit maturity level via 5-7 questions and persist a profile to ~/.claude/habit-profile.md. Other skills read this profile to adapt their verbosity — Dependence (full guidance) → Independence (key checkpoints) → Interdependence (team focus) → Significance (minimal prompts). Maps to H8 (Find Your Voice — meet the user where they are, not where the template assumes).

Cross-artifact consistency analyzer — runs 5 detection passes across persisted spec artifacts (PRD ↔ design ↔ tasks) and emits severity-graded findings. Use AFTER /requirements, /design, /breakdown have been run with `--persist <slug>`. Read-only — reports drift, coverage gaps, contradictions; does NOT modify or block. Inspired by github/spec-kit /analyze. Maps to H5 (Understand First — verify your understanding holds across artifacts) + H1 (Be Proactive — catch drift before code).

Run 17-question 8-Habit cross-verification checklist on a plan or implementation. Use AFTER planning and BEFORE committing to implementation. Maps to ALL 8 Habits.

Step-by-step deployment assistance with rollback planning. Use when deploying to staging or production. Step 6 of 7-step workflow. Maps to H1 (Be Proactive).

Produce architecture decisions — DB, auth, API, constraints. Use AFTER /requirements and BEFORE /breakdown. Step 2 of 7-step workflow. Maps to H8 (Find Your Voice).

Active bug investigation discipline — 6-phase methodology covering feedback-loop, reproduce, hypothesise, instrument, fix-with-regression-test, and cleanup-with-post-mortem. Use when investigating a hard bug or performance regression that doesn't have an obvious root cause. Triggers: "diagnose", "debug this", "investigate this bug", "reproduce the failure", "why is X failing". Read-only guidance — guides the human through systematic investigation rather than auto-fixing. Refuses to skip Phase...

EU AI Act compliance — migrated to pitimon/claude-governance v3.1.0. This stub redirects to the canonical implementation. Maps to H1 (Be Proactive — prevent regulatory crisis) + H8 (Voice/Conscience).

Reshape engineer-to-engineer content for engineering-org leadership (VPs, directors, PMs, release managers) and shape it for the channel — JIRA comment, Slack post, async standup, email, or meeting talking-points. Use AFTER `/post-mortem` or any engineering writeup when the same information needs to flow up-the-org. Strips function/file/SHA identifiers but keeps JIRA keys, PR numbers, product names, and customer/workload identifiers. Maps to H4 (Win-Win — leadership gets the right facts, not ...

Set up error tracking, alerting, and health checks. Use AFTER deploy to ensure observability. Step 7 of 7-step workflow. Maps to H7 (Sharpen the Saw).

Canonical engineering record of a fixed bug — root cause, mechanism, fix, validation, and how it slipped through. Use AFTER a debug session lands a validated fix, BEFORE closing the ticket — produces an engineer-audience artifact. Refuses to draft without a reliable repro, known root cause, identified fix, and validated outcome. Maps to H4 (Win-Win — engineer-to-engineer deposit) + H7 (Sharpen the Saw — capture learning for future-you).

Post-task micro-retrospective — 6 questions, 5 minutes. Use AFTER completing a task or workflow to capture lessons learned, including a skill-effectiveness signal that feeds SKILL-EFFECTIVENESS.md. Maps to H7 (Sharpen the Saw — invest in capability, not just output).

Generate PRD from user intent — define what, why, who, scope, and success criteria. Use BEFORE starting any feature. Step 1 of 7-step workflow. Maps to H2 (Begin with End in Mind).

Investigate before specifying — research existing solutions, prior art, and domain constraints. Use BEFORE /requirements when the problem space is unclear. Step 0 of 7-step workflow. Maps to H5 (Seek First to Understand).

Audit AI-generated code for security, quality, and completeness. Use AFTER implementation, BEFORE commit. Step 5 of 7-step workflow. Maps to H4 (Think Win-Win).

Scaffold a project-root SPEC.md digest following the spec-digest-pattern archetype. User-invoked. Phase 1 minimum viable — generator only; refuses to overwrite an existing SPEC.md. Use AFTER deciding the repo fits the project-orientation hub deployment mode (not feature-spec mode). Maps to H8 (Find Your Voice — pick the deployment mode that fits your repo) + H2 (Begin with End in Mind — establish the save point on day 1).

Outsider-perspective end-to-end review of a plan, PR, or proposed change — questions intent first (is there a simpler way?), then traces the actual code path (not just the diff) to verify the change does what it claims. Use BEFORE committing to an implementation, or BEFORE merging a PR — pairs with `/review-ai` (scope-question vs diff-local). Output is concise, actionable, with rationale per finding. Maps to H5 (Understand First — outsider lens) + H8 (Find Your Voice — question whether the ch...

Focused security review — secrets, injection, auth, dependencies, OWASP Top 10. Use as a dedicated security lens separate from general code review. Maps to H1 (Be Proactive — prevent security incidents, don't react to them).

Onboarding meta-skill — explains the 7-step workflow, all 17 skills, and the decision tree for "which skill next?". Read this first when starting with 8-habit-ai-dev. Maps to H5 (Seek First to Understand) + H8 (Empower next person).

Assess a feature, component, or PR against Covey's 4 dimensions: Body, Mind, Heart, Spirit. Use to evaluate balance across discipline, vision, passion, and conscience. Maps to H8 (Find Your Voice — Whole Person Model).

Guided walkthrough of the 7-step workflow. Prompts at each step to invoke or skip. Use when starting a new feature or when unsure which step comes next.