Claude Skills by timwukp

**Duration:** 30 minutes **Difficulty:** Beginner **Prerequisites:** Kiro IDE or CLI installed ---

Generates RESTful and GraphQL API designs with OpenAPI specs, proper resource naming, HTTP method usage, status codes, pagination, filtering, error responses, versioning strategies, and GraphQL schema patterns. Triggers on: "design API", "create API spec", "OpenAPI", "REST endpoint design", "GraphQL schema".

Reviews AWS architectures, IaC, and design docs against the AWS Well-Architected Framework's six pillars, producing a findings report with pillar-mapped risks (High/Medium) and concrete remediation. Loads only the pillars relevant to the change. Use for AWS architecture reviews, not generic code review. Triggers on: "well-architected review", "review this AWS architecture", "WAR review", "check this design against AWS best practices", "review my Terraform/CDK for AWS pitfalls", "is this archi...

Generates CI/CD pipeline configurations for GitHub Actions, GitLab CI, and AWS CodePipeline. Covers build, test, lint, security scanning, and deployment stages with caching and parallelism. Triggers on: "create CI/CD pipeline", "GitHub Actions workflow", "deployment pipeline", "automate build".

Analyzes code changes for security vulnerabilities, performance issues, and maintainability concerns. Provides structured feedback with SOLID principle checks and anti-pattern detection. Triggers on: "review this code", "code review", "check my PR", "review my changes".

Infers a codebase's implicit coding conventions (naming, structure, imports, comments, error handling) by analyzing the existing code, then makes them explicit: generates linter/formatter configs that match current reality, a conventions document, and agent steering rules so AI-written code blends in. Use when adopting AI coding tools on an existing codebase or onboarding to an unfamiliar team style. Triggers on: "match our coding style", "infer our conventions", "generate lint config from th...

Designs normalized database schemas with migration scripts, indexing strategies, and relationship handling. Supports SQL, Flyway, Liquibase, and Prisma. Triggers on: "design database", "create schema", "database migration", "design tables".

Generates multi-stage Dockerfiles and docker-compose configurations optimized for size, security, and development workflow. Covers common stacks including Node.js, Python, Java, and Go. Triggers on: "create Dockerfile", "docker-compose", "containerize", "docker setup".

Maps code, architecture, and infrastructure changes to specific control IDs in financial services compliance frameworks - PCI-DSS v4.0 for payment card data and MAS TRM for Singapore-regulated institutions - producing an audit-traceable findings report with per-control remediation. Use this instead of a general security review whenever a compliance framework (PCI-DSS, MAS TRM), regulator, audit, or cardholder-data scope is mentioned, even if the request is phrased as a code review or a yes/no...

Helps with git workflows including conventional commit messages, branching strategies, merge conflict resolution, and changelog generation. Triggers on: "git commit message", "branching strategy", "resolve conflict", "generate changelog".

A minimal example skill that greets users and explains how skills work. Use when user says "hello world skill", "test my skills setup", or "show me how skills work".

Generates JUnit unit tests for Java classes with loop prevention and incremental generation. Triggers on: "generate unit tests", "create JUnit tests", "test Java class", "add test coverage".

Helps users set up a complete Kiro project structure with steering files, skills directory, and proper configuration. Use when user says "set up kiro project", "initialize kiro", "create kiro structure", or "add kiro configuration".

Adds tests to legacy code that has none, safely: characterization tests that pin current behavior (including bugs) before any refactoring, seam identification for breaking untestable dependencies, and a risk-ranked coverage strategy. Use for untested or inherited codebases. Triggers on: "add tests to legacy code", "this code has no tests", "characterization tests", "make this testable", "safe to refactor?", "pin down current behavior", "test this old module before we change it".

Sets up Python projects with modern tooling including pyproject.toml, linting with ruff, formatting, type checking with mypy or pyright, testing with pytest, and pre-commit hooks. Triggers on: "setup Python project", "create Python package", "python project structure", "pyproject.toml".

Generates REST API tests using RestAssured or MockMvc with loop prevention and incremental validation. Triggers on: "test API endpoints", "generate API tests", "test REST API", "create integration tests".

Writes security user stories and security-aware acceptance criteria that fit a Scrum backlog, converting threats, scan findings, and compliance requirements into INVEST-compliant stories with Given/When/Then criteria and regression tests. Use this (not general story writing) whenever the story or criteria concern a security control, vulnerability, or compliance requirement. Triggers on: "write a security story", "security acceptance criteria", "acceptance criteria for rate limiting/auth/valid...

Generates Selenium WebDriver tests for React/Angular front-ends with STRICT loop prevention. Triggers on: "test UI", "generate Selenium tests", "test React app", "create E2E tests", "test front-end". WARNING: UI tests cost 3x more than unit tests -- generate selectively.

Facilitates sprint planning with security debt baked in: capacity planning from rolling velocity, risk-weighted prioritization balancing feature value against security debt, commitment sizing, and a DevSecOps definition of done. For writing or refining the stories themselves, use user-story-writing instead. Triggers on: "plan the sprint", "sprint planning", "prioritize these stories", "how much can we commit", "balance security debt against features", "sprint capacity".

Prepares sprint review and retrospective materials that demonstrate security alongside features: green build reports aggregating SAST/DAST/dependency scan results, completed security story summaries, and security metrics trends. Triggers on: "prepare sprint review", "green build report", "security metrics for this sprint", "demo our security work", "sprint security summary", "retro on our pipeline".

Creates Terraform modules following AWS Well-Architected Framework best practices. Generates variable definitions, outputs, documentation, and module composition patterns for common AWS services including VPC, ECS, Lambda, RDS, and S3. Triggers on: "create Terraform module", "infrastructure as code", "IaC", "provision AWS resources".

Performs STRIDE threat modeling for features, APIs, and architecture changes, producing a threat model document with risk-rated threats, mitigations, and security stories ready for the backlog. Use during sprint planning or design review. Triggers on: "threat model", "STRIDE", "security risks of this feature", "what could go wrong with this design", "security review of architecture".

Writes and refines user stories for product backlogs: splits epics into INVEST-compliant stories, drafts Given/When/Then and EARS-format acceptance criteria, and runs definition-of-ready checks. Triggers on: "write user stories", "split this epic", "acceptance criteria for", "refine this story", "is this story ready", "turn these requirements into stories".

Replace with a clear description of what this skill does and when the AI assistant should use it. Include trigger phrases like "when user says X" to help with activation.

Build production-ready AWS Bedrock AgentCore Harness agents end to end — declarative model + prompt, managed/BYO Memory, built-in Browser, Code Interpreter, Web Search and Knowledge Bases (RAG), Gateway/MCP tools + rate limits, inline functions, Skills (incl. AWS catalog), versioning + endpoints, advanced config (truncation, limits, lifecycle, network, inbound auth, BYO S3 Files/EFS mounts or container), Observability (log delivery), Evaluations, Optimizations, Identity (outbound auth, Token ...

Drive a change through an AI-native software development lifecycle as a loop of committed, machine-readable artifacts — intent.md, spec.md, plan.md, diff plus tests, PR review, control bands — and make the stage order enforceable with a PreToolUse hook and a CI gate instead of relying on discipline. Use when the user wants to start a feature, capture intent, write a spec, plan before coding, run a change from idea to production, onboard an existing repo to a governed process, add stage gates ...

Build apps with the Claude API or Anthropic SDK. TRIGGER when: code imports `anthropic`/`@anthropic-ai/sdk`/`claude_agent_sdk`, or user asks to use Claude API, Anthropic SDKs, or Agent SDK. DO NOT TRIGGER when: code imports `openai`/other AI SDK, general programming, or ML/data-science tasks.

Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers. Trigger when user mentions writing docs, creating proposals, drafting specs, or similar documentation tasks.

Build, extend, or debug GitLab CI/CD pipelines (.gitlab-ci.yml) that run Kiro CLI in headless mode for AI-powered merge-request review, security scanning, test-failure analysis, config-drift detection, code-duplication sync checks, and change-impact/risk analysis — including integrating the customer's MCP servers (SonarQube SAST, Jira, internal tools) into CI jobs. Use this skill whenever the user mentions GitLab CI, .gitlab-ci.yml, GitLab pipelines, merge-request automation, AI code review i...

A set of resources to help me write all kinds of internal communications, using the formats that my company likes to use. Claude should use this skill whenever asked to write some sort of internal communications (status reports, leadership updates, 3P updates, company newsletters, FAQs, incident reports, project updates, etc.).