Claude Skills by tody-agent

Private Code-to-Video Engine using Remotion React, TTS (ElevenLabs/OpenAI), and Content Mastery. Creates pure VibeCoding-style animations for TikTok/Shorts/Reels automatically.

Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms.

Easy-to-use conversational CLI (Codex style) for non-technical users to spawn parallel AI tasks supervised by a visual web dashboard.

Strategic analysis gate for existing products — multi-dimensional evaluation (tech, product, design, business) using Design Thinking + 9 Windows (TRIZ) + Double Diamond. Outputs 2-3 qualified options with recommendations. Use BEFORE cm-planning for complex initiatives and enhancements on existing codebases.

Use when you need visual QA, screenshots, or post-deploy smoke testing through a real browser with Playwright.

Code hygiene gate — detect and eliminate dead code, duplicates, naming mess, and code smells. TRIZ-powered. Run after features, before PRs, during debt sprints.

Full review lifecycle — request reviews, handle feedback with technical rigor, and complete branch integration. Use when completing tasks, receiving feedback, or finishing feature branches.

Unified code intelligence — Skeleton Index (zero-dep, <4s) + AST knowledge graph (CodeGraph) + architecture diagrams (Mermaid) + smart context builder. Pre-indexes code structure so AI agents understand any codebase instantly. 95% token compression for onboarding. 30% fewer tokens for deep analysis.

[Deprecated] parallel execution mode. Use `cm-execution` instead.

Working memory protocol — maintains context across sessions via CONTINUITY.md. Inspired by Loki Mode. Read at turn start, update at turn end. Captures mistakes and learnings to prevent repeating errors.

[Deprecated] both visualize project state. Use `cm-status` instead.

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes

Optional power-up — detects oversized codebases/docs and suggests tobi/qmd for local semantic search. Bridges cm-continuity (working memory) with long-term document retrieval. Zero-config detection, non-intrusive suggestion.

[Deprecated] design pipeline merged. Use `cm-design-system` instead.

Ultimate Design System Intelligence. Manage, extract, replicate, and improve UI design systems. Extracts design tokens visually from existing sites (Harvester v5), manages multi-page tokens, and utilizes MCP servers like Google Stitch and Pencil.dev to generate complete, consistent design systems (Shadcn UI, Halo, Lunaris, Nitro). Use when the user asks to "extract design from a URL", "create a Shadcn design system", "analyze design tokens", "build a design system for", or "copy the UI style ...

Knowledge systematization engine — analyze codebases, generate Personas, JTBD, Process Flows, technical docs, SOP user guides, API references. Output as Markdown or VitePress Premium. SEO-optimized, AI/LLM-readable. One scan = complete knowledge base.

Use when exploring the CodyMaster skill ecosystem roadmap, marketplace, or distro validation.

[Deprecated] engineering bridge merged. Use `cm-mcp-engineering` instead.

A template demonstrating the universal format compatible with Antigravity, Codex, Cursor, and OpenClaw.

Use when executing implementation plans — choose mode: batch execution with checkpoints, subagent-per-task, or parallel dispatch for independent problems.

[Deprecated] worktree management is part of execution. Use `cm-execution` instead.

Use when you need to check if a destructive command is blocked or run guardian freeze checks.

Complete guide to vibe coding with the CodyMaster skill kit — from idea to deploy. Covers the full workflow, skills used at each phase, and common use cases. Read this first if you are new; reference it whenever you're unsure which skill to invoke.

Verify and lock project identity before ANY git push, Cloudflare deploy, or Supabase operation. Essential when working with multiple GitHub accounts (personal + work), multiple Cloudflare accounts, or multiple Supabase/Neon projects. Prevents wrong-account deploys, cross-project secret leaks, and git history contamination.

Use when you need to interact with the MCP engineering bridge tools (cm_plan, cm_review, cm_qa, cm_deploy, cm_search).

You MUST use this before any creative work or multi-step task. Explores intent, requirements, and design before implementation. Then documents the plan before coding.

[Deprecated] quality gate now covers tests + canary. Use `cm-quality-gate` instead.

Use when starting any new project from scratch. Asks for project identity (name, GitHub org, Cloudflare account), detects project type, sets up design system, staging+production, i18n from day 1, SEO foundation, AGENTS.md manifest, test infrastructure, 8-gate deploy pipeline, and disciplined development workflows. Prevents wrong deploys, redundant repos, and technical debt from day 0.

[Deprecated] browser daemon overlap. Use `cm-browse` instead.

Use before any deployment or completion claim. Enforces test gates, evidence-based verification, and frontend safety checks. No deploy without passing. No claims without evidence.

Strategic codebase re-direction when requirements change, architecture doesn't fit, or tech debt blocks progress. TRIZ-powered pivot protocol for large codebases.

Use at end of sprint to append operational learnings as structured JSONL to the project retro log.

Use when setting up deployment infrastructure for any project - establishes multi-gate deploy pipeline with test gates, build verification, frontend safety checks, and rollback strategy before code reaches production

Use when translating, extracting, or mass-converting hardcoded strings to i18n t() calls. Enforces multi-pass batching, parallel-per-language dispatch, 8 audit gates, and HTML integrity checks. Battle-tested through 21+ batches and 12 bug categories from the March 2026 incidents.

[Deprecated] engineering bridge merged. Use `cm-mcp-engineering` instead.

[Deprecated] deploy safety merged. Use `cm-safe-deploy` instead.

[Deprecated] deploy safety merged. Use `cm-safe-deploy` instead.

Skill Chain Engine — compose skills into automated pipelines. One task triggers multi-skill workflows with progress tracking, auto-detection, and step management.

Repair or extend CodyMaster skills with a three-mode loop: FIX, DERIVED, and CAPTURED, grounded in current repo tooling.

[Deprecated] skill lifecycle merged. Use `cm-skill-evolution` instead.

Progressive Disclosure skill index — efficient skill loading in 3 layers. Layer 1 (index, ~100 tokens) always loaded. Layer 2 (summary, ~300 tokens) loaded on context need. Layer 3 (full SKILL.md) loaded on execution only.

[Deprecated] discovery and meta-skill merged. Use `cm-skill-index` instead.

[Deprecated] discovery merged. Use `cm-skill-index` instead.

[Deprecated] skill lifecycle merged. Use `cm-skill-evolution` instead.

Use to run the full sprint pipeline: brainstorm → plan → design → tdd → build → review → qa → security → ship → monitor → retro.

Start the CM Workflow to execute your objective from idea to production code.

View a quick progress summary of current tasks.

Use when implementing any feature or bugfix, before writing implementation code

Use when running ANY terminal command - enforces clear progress logging, output reading, and error-stop behavior so terminal processes are never left unchecked

[Deprecated] quality gate now covers tests + canary. Use `cm-quality-gate` instead.