Claude Skills by tinh2

Review database schema design, query patterns, and data access layer for correctness and performance. Checks normalization balance, index coverage against actual queries, constraint completeness (NOT NULL, FK, unique, check, defaults), data type correctness (money as DECIMAL not FLOAT, timestamps with timezone), N+1 query detection, connection pooling configuration, transaction safety, and migration hygiene. Supports PostgreSQL, MySQL, SQLite, MongoDB, Firestore, DynamoDB, and all major ORMs....

Audit energy utility software for NERC CIP cybersecurity, FERC market and tariff compliance, EPA emissions and CEMS reporting, renewable portfolio standards (RPS/REC tracking), pipeline safety (49 CFR 192/195), SCADA security, carbon market compliance, and state PUC/ISO/RTO requirements. Use when reviewing power generation, transmission, distribution, pipeline, renewable, EV charging, or energy trading codebases.

Audit environmental software for EPA reporting (CEDRI, NetDMR, RCRAInfo), Clean Air Act (Title V, NESHAP, CEMS, TRI), Clean Water Act (NPDES, SWPPP, SPCC), RCRA hazardous waste tracking (manifests, biennial reports), NEPA environmental impact assessment workflows, GHG reporting, and compliance calendar management. Use when reviewing environmental management systems, permit tracking, emissions monitoring, waste management, or environmental impact assessment software.

Audit fintech and financial services code for KYC/AML (CIP, CDD, EDD, sanctions screening, transaction monitoring), BSA (SAR/CTR filing, FinCEN reporting, Travel Rule), Reg E (EFT error resolution, unauthorized transfer liability, provisional credit), SOX (audit trails, segregation of duties, financial controls), GLBA (privacy notices, Safeguards Rule, data sharing), and state money transmitter licensing. Use when reviewing banking, payments, lending, crypto, neobank, BNPL, or embedded financ...

Audit game projects for accessibility across visual (colorblind modes, contrast, font scaling, photosensitivity), audio (subtitles, captions, visual sound indicators, mono audio), motor (remappable controls, one-handed play, hold-to-toggle, QTE alternatives), cognitive (difficulty options, tutorials, quest logs, hint systems), and communication (CVAA text chat, voice-to-text). Checks Xbox Accessibility Guidelines (XAGs), WCAG 2.1, platform APIs (VoiceOver, TalkBack), and first-launch accessib...

Review game code architecture for component coupling, ECS vs OOP design, update loop organization (deltaTime, fixed timestep, frame budget), state machine quality (boolean soup, string states), save/load serialization (versioning, migration, corruption handling), input handling (action-based abstraction, buffering, remapping), and anti-patterns (god objects, find-in-update, tight loop allocation, missing object pooling, magic numbers). Supports Unity, Unreal, Godot, Phaser, and custom engines...

Audit government and federal software for FedRAMP authorization readiness (Low/Moderate/High), NIST 800-53 controls (AC, AU, CM, IA, SC, SI families), FISMA compliance, Section 508 / WCAG 2.1 AA accessibility, FOIA search and redaction, NARA records retention, FIPS 140-2 cryptography, CJIS Security Policy, IRS Pub 1075, data sovereignty, and ATO-blocking gaps. Use when reviewing GovTech, federal contractor, or public sector codebases for compliance certification.

Review healthcare software for operational efficiency: appointment scheduling and resource allocation, clinical workflow burden (order entry clicks, documentation templates, alert fatigue), EHR/LIS/pharmacy/PACS integrations (HL7v2, FHIR, NCPDP SCRIPT, EDI 837/835), patient flow (ADT, bed management, wait times, throughput), quality reporting (CMS, HEDIS, MIPS), staff credentialing and workload balancing, and revenue cycle optimization. Use when auditing hospital, clinic, or health system sof...

Audit affordable housing and property management software for Fair Housing Act (protected classes, disparate impact screening, AFFH), Section 504/ADA accessibility (5% mobility units, reasonable accommodations), HUD reporting (HUD-50058, PHAS, SEMAP), LIHTC compliance (IRS Section 42 income certification, rent calculation, 8823 noncompliance), lead paint disclosure (pre-1978, EPA RRP), VAWA protections (emergency transfer, lease bifurcation, confidentiality), HQS/NSPIRE inspections, and tenan...

Audit manufacturing software for FDA 21 CFR Part 11 (electronic records, e-signatures, audit trails), ISO 9001/13485/14001/45001 quality management (document control, CAPA, nonconformance), GMP batch records and cleaning validation, lot/serial traceability (forward, backward, process, recall-ready), OSHA safety (incident tracking, LOTO, PPE), hazmat handling (SDS, chemical inventory, RCRA waste), ALCOA+ data integrity, and AS9100/IATF 16949/ITAR/EAR compliance. Use when reviewing MES, ERP, qu...

Audit mobile apps against OWASP Mobile Top 10 (M1-M10): credential hardcoding, supply chain dependencies, insecure auth/token storage (Keychain/Keystore), input validation (deep links, WebView XSS), certificate pinning (OkHttp, TrustKit, Alamofire), privacy (PII in logs, clipboard, screenshots), binary protections (ProGuard/R8, obfuscation, anti-tampering), security misconfiguration (backup, exported components, permissions), data-at-rest encryption (SQLCipher, EncryptedSharedPreferences), ro...

Audit multiplayer netcode, online game networking, and real-time synchronization. Reviews client-server authority, lag compensation, client-side prediction, server reconciliation, entity interpolation, server rewind hit detection, tick rate tuning, delta compression, bandwidth budgets, matchmaking (ELO, Glicko-2, TrueSkill), lobby systems, reconnection flows, host migration, anti-cheat architecture, and input validation. Supports Unity Mirror/NGO/Photon/FishNet, Unreal replication, Godot ENet...

Audit construction permit tracking, building code compliance, and inspection management software. Reviews permit lifecycle workflows (building, electrical, plumbing, mechanical, demolition, zoning, certificate of occupancy), IBC code reference systems, ADA and Fair Housing accessibility checks, fire and life safety compliance, NEPA and CWA environmental review, stormwater NPDES/SWPPP tracking, LEED and ENERGY STAR sustainability, plan review and RFI management, submittal workflows, inspector ...

Create a convention-compliant pull request from the current branch.

Audit procurement and procure-to-pay software for sourcing, purchasing, and vendor management. Reviews requisition-to-PO workflows, RFQ/RFP bid management, approval routing with delegation and escalation, purchase order lifecycle (standard, blanket, contract POs), three-way matching (PO-receipt-invoice), budget encumbrance controls, vendor onboarding and scorecards (on-time delivery, quality, price), contract lifecycle management, spend analytics (UNSPSC classification, maverick spend, tail s...

Audit codebases for cross-industry regulatory compliance across SOX, GDPR, HIPAA, PCI-DSS, CCPA/CPRA, FedRAMP, FISMA, COPPA, and FERPA. Reviews audit trail completeness (who/what/when/where/why with tamper-evident storage), data retention policies and right-to-erasure workflows, RBAC/ABAC access control with least-privilege enforcement, privileged access management and JIT elevation, change management controls (branch protection, deployment gates, emergency change process), DSAR and ROPA repo...

Audit K-12 school operations, district management, and education administration software. Reviews master schedule building and constraint optimization, student course request scheduling with IEP service integration, staffing formula models and FTE allocation, class size management, Title I weighted per-pupil funding and comparability reporting, fund accounting and budget-to-actual variance, facility utilization and room capacity tracking, maintenance work order systems, transportation route o...

Security audit and vulnerability assessment for any codebase. Scans for authentication bypasses, missing auth middleware, broken JWT validation (algorithm confusion, weak secrets, missing expiry), OAuth state and PKCE flaws, IDOR and horizontal privilege escalation, vertical privilege escalation via role manipulation, SQL injection, NoSQL injection, XSS (stored, reflected, DOM), command injection, path traversal, SSRF, CSRF, hardcoded secrets and API keys (sk_live_, AKIA, ghp_), .env and cred...

Pre-submission audit for Apple App Store and Google Play Store compliance. Checks App Store Review Guidelines (safety, performance, business, design, legal sections) and Google Play Developer Policies (user data, permissions, deceptive behavior, monetization, store listing, content). Reviews In-App Purchase and Play Billing requirements, privacy policy and data collection disclosure, App Tracking Transparency and PrivacyInfo.xcprivacy privacy manifests, iOS App Privacy nutrition labels, Andro...

Audit therapy and behavioral health documentation platforms for clinical quality and regulatory compliance. Reviews SOAP, DAP, and BIRP note template structure, note completeness enforcement and timeliness deadlines, note locking and amendment/addendum workflows, DSM-5 diagnostic code completeness, ICD-10-CM crosswalk accuracy and annual update currency, diagnostic code validation and billing alignment, informed consent lifecycle (treatment, telehealth, release of information, minor consent) ...

Online research agent that searches the live web for any topic, fetches the strongest sources, and produces an easy-to-digest formatted report with citations. Triggers: 'research X online', 'find me info about X', 'search the web for X', 'look up X', 'what are the most used Y', 'who is doing Y now', 'compare X vs Y online', 'find references for X', 'is there a tool that does X', 'what's the current state of X', 'find recent articles about X'. Use this whenever the answer requires LIVE externa...

Audit government benefits and entitlement systems for fraud prevention, detection, and recovery capabilities. Assesses identity proofing (document verification, SSA cross-match, biometrics, NIST 800-63 IAL levels), synthetic and stolen identity detection, deceased and incarcerated person checks, duplicate applicant matching (fuzzy, probabilistic, Soundex/metaphone), cross-program and cross-jurisdiction benefit matching, income verification (state wages, IRS 1075, new hire reporting), anomaly ...

Fetches dependency vulnerabilities from Vanta, Snyk, Dependabot, or GitHub Security Advisories, creates a tracking issue in Jira/Linear/GitHub Issues, then fixes, commits, pushes, and opens PRs for each affected repo. Trigger on: vulnerabilities, security scan, Vanta, CVE, dependency audit, Snyk, Dependabot.

Scan project dependencies for known vulnerabilities (CVEs), auto-fix safe patches, and generate SBOM. Auto-detects all package managers in monorepos — npm (npm audit), yarn (yarn audit), pnpm (pnpm audit), pip/poetry (pip-audit), Cargo (cargo audit), Go modules (govulncheck), Maven (dependency-check), Gradle, Bundler (bundle audit), and Composer. Categorizes findings by severity (Critical/High/Medium/Low), dependency type (direct vs transitive), and fix availability. Applies safe patch-level ...

Audit and harden encryption across the full stack. Checks data-at-rest encryption (database TDE, field-level AES-256-GCM, file storage SSE, backup encryption), data-in-transit security (TLS 1.2+, HSTS, certificate pinning, mTLS, WebSocket WSS), key management (KMS, envelope encryption, key rotation, key separation), password hashing (argon2id, bcrypt, scrypt, PBKDF2 work factors, salt uniqueness, migration plans), token security (JWT signing algorithms, CSPRNG, refresh token rotation), and AP...

Game-specific security review covering cheat prevention, exploit surfaces, and server authority. Audits client-side authority vulnerabilities (damage, health, currency, cooldown, movement speed), memory manipulation risks (value scanning, anti-debug, DLL injection), network security (packet tampering, replay attacks, speed hacking, MITM, DDoS resilience), save file integrity (encryption, checksums, cloud save abuse, config tampering, wallhacks), API and backend security (auth bypass, receipt ...

GDPR and CCPA/CPRA privacy compliance audit for codebases. Inventories PII fields (email, phone, SSN, IP, device ID, geolocation, biometrics, behavioral data), maps data collection points (forms, APIs, cookies, analytics, error tracking), audits consent mechanisms (cookie banners, opt-in, pre-checked boxes, consent withdrawal), verifies data subject rights implementation (right to access, erasure, rectification, portability, opt-out, Do Not Sell), traces third-party data sharing (Google Analy...

Deep HIPAA Security Rule technical audit mapping code-level findings to 45 CFR sections. Covers administrative safeguards (164.308 -- risk analysis, workforce security, access management, incident procedures, contingency planning), physical safeguards (164.310 -- facility access, workstation security, session timeout, device controls, crypto-shredding), and technical safeguards (164.312 -- unique user IDs, emergency break-glass access, automatic logoff, AES-256 PHI encryption, audit controls ...

Systematic audit against the OWASP 2021 Top 10 web application security risks with severity-rated, file-level findings. Checks A01 Broken Access Control (IDOR, path traversal, CORS, privilege escalation), A02 Cryptographic Failures (weak algorithms, exposed secrets, missing TLS), A03 Injection (SQL, NoSQL, command, XSS, LDAP, XPath, template injection), A04 Insecure Design (missing rate limiting, business logic flaws, race conditions), A05 Security Misconfiguration (debug mode, default creden...

PCI DSS v4.0 compliance audit for payment-handling codebases. Scans for PAN patterns (Visa, Mastercard, Amex, Discover), CVV storage violations, and track data retention. Audits all 12 requirements: network security controls (firewall rules, CDE segmentation, default-deny), secure configurations (default credentials, hardening), stored cardholder data protection (AES-256 encryption, masking first-6/last-4, tokenization, key rotation), transmission encryption (TLS 1.2+, certificate pinning, HS...

Static-analysis penetration test that hunts for exploitable vulnerabilities with proof-of-concept payloads and fix code. Covers SQL and NoSQL injection (string concatenation, raw queries, operator injection), XSS (reflected, stored, DOM-based, template injection, dangerouslySetInnerHTML), authentication bypass (missing auth middleware, JWT algorithm confusion, predictable tokens, OAuth state CSRF), authorization flaws (IDOR, mass assignment, horizontal/vertical privilege escalation), path tra...

Full-stack security posture assessment with 0-100 risk scoring. Scans dependency vulnerabilities (npm audit, pip-audit, cargo audit, govulncheck), dangerous code patterns (SQL injection, eval, command injection, ReDoS, innerHTML, XSS vectors), authentication gaps (missing auth middleware, CSRF, hardcoded JWT secrets, insecure session flags), insecure crypto (MD5/SHA1 password hashing, Math.random for tokens, hardcoded encryption keys), configuration issues (exposed .env files, debug mode, per...

SOC 2 Type II readiness assessment against all five Trust Service Criteria. Evaluates Security controls (CC6/CC7 -- RBAC, access provisioning/removal, network segmentation, TLS enforcement, input validation, vulnerability management, incident detection and response), Availability controls (A1 -- capacity management, auto-scaling, backup frequency, disaster recovery, RTO/RPO, health checks, uptime monitoring), Processing Integrity (PI1 -- data validation, error handling, transaction logging, i...

Lock down design decisions before implementation — app name, terminology, design tokens, screen inventory, data models, and microcopy. Outputs a design-spec.md that other skills reference.

Automated WCAG 2.1 AA accessibility testing with axe-core and Lighthouse CI. Auto-detects frontend framework (React, Next.js, Vue, Angular, Svelte, Astro, Flutter, React Native), discovers all routes and interactive components, installs Playwright + axe-core for page-level scanning and jest-axe/vitest-axe for component-level testing. Generates tests for color contrast (4.5:1), alt text, form labels, ARIA attributes, heading order, landmark regions, focus visibility, keyboard navigation (tab o...

Generate consumer-driven contract tests for APIs. Auto-detects framework (Express, Fastify, NestJS, Django, FastAPI, Go), selects Pact, OpenAPI validation, or schema snapshots, verifies backward compatibility, catches breaking changes before deploy, and configures CI verification. Use when you need to validate API schemas, prevent breaking changes, verify backward compatibility, or set up consumer-driven contracts.

Configure device matrix testing across real phones, tablets, and emulators. Sets up Firebase Test Lab, AWS Device Farm, or BrowserStack with smart device selection covering flagships to budget phones, test sharding for parallel execution, flaky test quarantine, and cross-device performance benchmarking. Use when you need to test on multiple devices, validate across screen sizes, catch device-specific bugs, or benchmark performance on low-end hardware.

Auto-detects any tech stack, generates and runs exhaustive end-to-end tests. Triggered by "end-to-end tests", "e2e tests", "integration tests", "test the whole app", "generate tests", "test coverage", "write e2e", "run e2e", "full test suite".

Complete testing pipeline — full test suite, test everything, automated and manual tests.

Generate integration tests for APIs, databases, and external services. Auto-detects backend stack (Express, Fastify, NestJS, Django, FastAPI, Rails, Go), ORM (Prisma, TypeORM, SQLAlchemy, GORM), and database (PostgreSQL, MongoDB, Firestore), then creates tests covering endpoint CRUD, auth flows, DB transactions, and external service failures with proper fixtures and mocks. Self-heals failing tests up to 3 iterations. Use when you need to test API endpoints end-to-end, verify database operatio...

Generate and run load tests with k6, Locust, or Artillery. Auto-detects API framework, creates realistic user behavior flows (browsing, authenticated CRUD, search-heavy), runs ramp-up, sustained, spike, and stress test profiles with defined latency and error-rate thresholds, then produces a bottleneck analysis with optimization recommendations. Use when you need to benchmark API performance, find breaking points under traffic, test auto-scaling, validate SLAs, or identify slow endpoints befor...

Generates a manual test plan, QA plan, test scenarios, testing checklist, or guidance on how to test changes. Works from branch diffs, stories, specs, or requirements.

Generate a complete mobile test suite covering unit, widget, integration, snapshot, accessibility, and platform-specific tests. Auto-detects Flutter, React Native, native iOS (XCTest), or native Android (JUnit/Espresso), then produces tests for models, services, ViewModels, screens, navigation, forms, and pull-to-refresh with proper mocks and golden image comparisons. Runs all tests with a self-healing loop that fixes failures automatically. Use when you need to add tests to a mobile app, inc...

Analyze and score test coverage across all testing dimensions -- unit, integration, E2E, load, visual regression, contract, and accessibility. Auto-detects tech stack and test infrastructure, runs existing coverage tools, identifies gaps by category, scores each on a 0-10 scale with weighted overall health, and produces a prioritized remediation plan routing to the right testing sub-skill. Use when you need a test health overview, want to find coverage gaps, need to prioritize which tests to ...

Generate comprehensive unit tests with edge cases, error paths, and boundary values. Auto-detects test framework (Vitest, Jest, pytest, go test, flutter_test, RSpec, cargo test, JUnit), scans for untested functions by priority, adopts existing test conventions, generates tests with proper mocks, runs them, and self-heals failures in up to 3 iterations. Measures coverage before and after. Use when you need to add unit tests, increase code coverage, test edge cases, or verify error handling paths.

Set up visual regression testing with baseline screenshots across breakpoints. Auto-detects frontend framework (Next.js, React, Vue, Angular, Flutter, Storybook), configures Playwright screenshot comparison, BackstopJS, or Flutter golden tests, captures every page at mobile/tablet/desktop/wide viewports plus interactive states (hover, focus, error, empty, loading), stabilizes dynamic content to prevent false positives, and reports pixel-level diffs. Use when you need to catch unintended UI ch...

Run an app walkthrough — launch a Flutter app on a simulator or emulator, generate and run exhaustive integration tests that exercise every screen, button, form, and user flow, then self-heal failures. Triggers: app walkthrough, integration test, test on simulator, exercise every screen, Flutter integration tests.

Methodically walks a running app — every public route, every interactive control, every state (empty/loading/error/auth/un-auth) — to find real bugs, then root-causes, fixes, adds a regression test, and verifies each one before moving to the next. Use when: 'find bugs in the app', 'sweep for regressions', 'methodically hunt and fix bugs', 'audit user flows', 'find broken buttons / forms / links'. Distinct from /hotfix (one known bug, speed) and /triage (read-only ranked plan).

Implement complete dark mode for any frontend project. Auto-detects theme system (Flutter ThemeData, Tailwind dark class, CSS variables, MUI, Chakra UI, styled-components), generates a dark color palette with proper surface elevation hierarchy and desaturated brand colors, creates a theme toggle with system preference detection and persistence, migrates all hardcoded colors to theme tokens, handles special cases like images, shadows, form inputs, and charts, then verifies WCAG AA contrast rat...

Make interfaces truly adaptive — not just responsive. Uses container queries for component-level adaptation, adaptive navigation patterns, and platform-aware layouts for web, mobile, tablet, and desktop. Use when: 'make responsive', 'responsive design', 'adaptive layout', 'container queries', 'mobile layout', 'tablet layout', 'desktop layout', 'breakpoints'.