Claude Skills by ShipWithAI

> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. **Goal:** Add a `new-project` skill to shipwithai-starter that guides a user from an empty directory through a 3-phase interview (goals → architecture → conventions), scaffolds the project via official tools, and configures the Claude harness. **Architecture:** New skill `n...

Diagnose and fix issues in existing auth setups. Scans environment, files, security, middleware, OAuth, database, and dangerous code patterns. Produces scored health report with actionable fixes.

Set up authentication for web apps. Supports Better Auth and Firebase Auth. Handles email/password, Google OAuth, sessions, middleware, protected routes. Includes UI components. Auto-detects existing project themes. (GitHub & Apple OAuth coming soon)

Diagnose and fix your Claude Code harness. Scans CLAUDE.md, settings.json, hooks health, and stack consistency. Produces scored report. Run /shipwithai-harness:doctor

Generate a Claude Code harness for any project. Scans your actual code to create tailored CLAUDE.md, settings.json, and safety hooks. Run /shipwithai-harness:setup

Generate a Flyway or Liquibase migration in lockstep with an entity change. Detects which migration tool the project uses and the next version number. Invoked by jpa-entity after a schema change, or directly. Trigger phrases: "create migration", "add db migration", "new flyway migration", "add liquibase changeset".

Scaffold idempotency-key handling for unsafe POSTs — read an Idempotency-Key header, replay the stored response on a retry instead of re-processing, otherwise process once and store the response keyed by (key, request fingerprint). Ships a servlet filter plus a storage SPI the project implements with Redis or a DB. Trigger phrases: "idempotency key", "idempotent endpoint", "make POST idempotent", "safe retries", "exactly-once POST", "dedupe requests".

Scaffold a Spring Boot integration test against REAL infrastructure via Testcontainers — a throwaway Postgres (Kafka optional), wired with Spring Boot 3.1+ @ServiceConnection so there's no manual datasource config. Async assertions use Awaitility, never Thread.sleep. Trigger phrases: "integration test", "testcontainers", "test against real postgres", "spring boot test with a database", "end-to-end repository test".

Scaffold a Spring Data JPA @Entity correct-by-default so the guardrails never fire: @Version optimistic locking, business-key equals/hashCode (never the generated @Id), JPA auditing fields, optional soft-delete, plus a matching repository — all matching this project's conventions. Trigger phrases: "create entity", "scaffold jpa entity", "add a jpa entity", "new @Entity", "generate entity".

Scaffold JWT bearer authentication for a stateless JSON API. Recommends Spring Security's resource server (framework verifies signature + exp); also ships a custom OncePerRequestFilter using jjwt for teams that need it — it verifies the signature, rejects alg=none, checks exp/nbf, and returns 401 JSON on failure. Secret from env. Trigger phrases: "jwt auth", "bearer token", "validate jwt", "secure my api with tokens", "jwt filter", "resource server".

Scaffold a global REST error contract — a @RestControllerAdvice that maps every exception to an RFC 7807 ProblemDetail (Spring 6): validation errors → 400 with field details, a domain NotFoundException → 404, and a fallback 500 that never leaks stack traces. This is the fix the entity-in-controller / error-contract guidance points at. Trigger phrases: "add global error handler", "problemdetail", "rest exception handler", "@RestControllerAdvice", "map exceptions to RFC 7807".

Scaffold a Spring Security 6 SecurityFilterChain @Bean baseline — deny-by-default authorizeHttpRequests, a BCryptPasswordEncoder, explicit CORS, and CSRF guidance (kept for cookie/session auth, disabled only for stateless token APIs). Lambda DSL, Jakarta, no deprecated .and() chaining. Trigger phrases: "set up spring security", "securityfilterchain", "lock down endpoints", "spring security config", "password encoder bean".

Wire the Spring Boot guardrails into this project — install the jpa-guardrail PostToolUse hook + ruleset, register it in settings.json, copy the springboot-reviewer agent, and inject the Spring Boot rule block into CLAUDE.md. Short interview fills project slots (base entity, migration tool, strict mode). Trigger phrases: "set up spring boot guardrails", "install java backend toolkit", "wire jpa guardrails", "setup springboot toolkit".

Scaffold a Spring Web REST endpoint correct-by-default — controller + request/ response DTOs + service method + mapper. Never exposes a JPA entity (satisfies the entity-in-controller guardrail). Request bodies are @Valid DTOs. Trigger phrases: "add endpoint", "scaffold rest controller", "new REST endpoint", "create controller".

Fine-grained Spring Boot 3.x + JPA conventions and the rationale behind the toolkit's guardrail rules. Split by domain — load the reference for what you're touching. Use when working on persistence, controllers, transactions, or tests and you want the why, not just the what. Trigger phrases: "spring boot conventions", "jpa best practice", "why @Version", "transactional not working", "n+1 spring", "entity vs dto".

Scaffold focused Spring slice tests — @DataJpaTest for the persistence layer (rolls back per test) and @WebMvcTest for the web layer (MockMvc + mocked services). Pick the narrowest slice that proves the behavior; reach for full @SpringBootTest only for cross-layer flows. Trigger phrases: "datajpatest", "webmvctest", "slice test", "test my repository", "test my controller", "mockmvc test", "unit test the web layer".

Use when adding or extending automated module-boundary / architecture enforcement in a Kotlin or Kotlin Multiplatform Gradle project — rules like "core must not depend on feature", "api must not leak impl", layer/package dependency directions that should fail the build the moment a bad import is written. Covers tool choice (Konsist vs ArchUnit/Detekt), the scan-from-disk scaffold, and verifying a rule actually bites.

Evaluation criteria for grading rendered mobile UI screens. Use when reviewing, critiquing, or self-checking a mobile UI screenshot — especially after any UI edit in an agentic loop — to decide pass/fail and produce concrete fixes. Targets Compose Multiplatform (Android + iOS), Material 3. The mobile counterpart to frontend-design: structural integrity first ("is it broken?"), visual taste second.

Set up the Claude Code harness for this project. Configures CLAUDE.md, permissions, hooks, MCP servers, agents, and SSOT docs based on your stack and chosen tier. Run on first setup or when CLAUDE.md is missing or has [PLACEHOLDER] markers. Trigger phrases: "set up harness", "configure claude", "onboard project", "bootstrap claude", "let's get started", "setup claude code".

Start a new project from scratch. 3-phase interview: project goals → tech stack → architecture → conventions. Scaffolds using official tools then configures the Claude Code harness. Run on an empty directory. Trigger phrases: "start a new project", "create project from scratch", "greenfield setup", "I have an empty directory", "new project from scratch".

Analyze Claude Code tool call logs and suggest harness improvements based on actual usage patterns. Requires observability enabled + 7 days of data. Trigger phrases: "optimize harness", "harness suggestions", "improve my setup", "analyze tool usage", "what hooks should I add".

Audit the current Claude Code harness health: check configured components, detect drift from the codebase, and suggest fixes or tier upgrades. Trigger phrases: "review harness", "check setup", "harness health", "what's missing", "upgrade tier", "audit claude config".

Configure .claude/agents/ with specialized sub-agents for your project. Called by init or standalone to configure the agents pillar. Trigger phrases: "setup agents", "configure agents", "add claude agents".

Configure .claude/settings.json hooks section for your stack: auto-format, auto-lint, and test-on-stop triggers. Called by init or standalone to configure the hooks pillar. Trigger phrases: "setup hooks", "configure auto-format", "add lint hook".

Configure .mcp.json with MCP servers for external services your project uses. Called by init or standalone to configure the MCP pillar. Trigger phrases: "setup mcp", "configure mcp servers", "connect to [service]".

Configure project memory: write CLAUDE.md with architecture context and (Tier 3) set up a self-sustaining .claude/memory/ lifecycle — SessionStart load hook, Stop save-nudge hook, and a /save-memory skill that distills each session. Called by init or standalone to configure the memory pillar. Trigger phrases: "setup memory", "write CLAUDE.md", "configure project context".

Enable tool call logging for harness optimization. Installs observe.py hook writing tool metadata to .claude/logs/. Tier 3 opt-in. Trigger phrases: "setup observability", "enable tool logging", "track tool usage", "observe tool calls".

Configure .claude/settings.json with appropriate tool permissions for your stack. Called by init or standalone to configure the permissions pillar. Trigger phrases: "setup permissions", "configure allowed tools", "set claude permissions".

Install reusable project skills into .claude/skills/. Ships git-workflow (commit/branch/PR conventions from your init choices). Triggers: "setup skills", "install project skills", "add git skill".

Set up SSOT documentation: docs/architecture.md, ADR structure, and CODEMAPS for codebase navigation. Called by init or standalone. Trigger phrases: "setup ssot", "create architecture docs", "setup ADR structure", "create CODEMAPS", "document architecture".

Sync CLAUDE.md and architecture docs with the current state of the codebase. Use after significant changes: new dependencies, refactoring, architecture shifts. Trigger phrases: "update CLAUDE.md", "sync docs", "CLAUDE.md is outdated", "update architecture docs", "sync ssot".