Claude Skills by tonone-ai

Security reconnaissance — full inventory of secrets management, IAM, dependencies, auth, encryption, audit logging, and compliance gaps. Use when asked about "security posture", "how secure is this", or "security assessment".

Automated SAST + dependency vulnerability scan. Runs Semgrep (code vulnerabilities) and pip-audit (CVE-matched dependencies) and writes a structured JSON report. Use when asked to "scan for vulnerabilities", "run a security scan", "check for CVEs", or "audit dependencies".

Produce a threat model — assets, ranked threats, mitigations, accepted risks. Use when asked to "threat model this", "what could go wrong security-wise", "map our attack surface", or before designing any security-sensitive feature.

Security engineer — IAM, secrets, threat modeling, hardening, auth, and supply chain security.

Plan and scope a project — discovery, challenge assumptions, present S/M/L options with token and cost estimates. Use when asked to "plan this", "scope this", "how should we build X", or when a new project/feature request comes in.

Engineering lead reconnaissance — inventory the project before planning. Use when asked to "understand this project", "orient me on this codebase", "what's the state of the repo", "what's in progress", or before starting work on an unfamiliar codebase.

Cross-cutting review of recent work — catches gaps between specialists. Use when asked to "review what we built", "check the work", "pre-launch review", or after completing a significant chunk of work.

CTO-level project status from git and codebase state. Use when asked "where are we", "project status", "what's done", or at the start of a work session.

System takeover — take ownership of an existing codebase or inherited system. Use when "we acquired this", "previous team left", "take over this system", "inherited this codebase".

Write an Architecture Decision Record — document what was decided, why, what alternatives were considered, and what trade-offs were accepted. Use when asked to "write an ADR", "document this decision", or "why did we choose X".

Maintain per-repo and cross-repo changelogs — append structured entries after agent work. Use when asked to "log this change", "update changelog", "what changed", "change history".

Map the system architecture — read the codebase, identify services and connections, output a C4-level architecture map as Mermaid diagrams with component descriptions. Use when asked to "map the architecture", "system diagram", "how does this work", or "architecture overview".

Generate onboarding documentation — what this project does, how to set up locally, where things live, key decisions, how to deploy. Written for day-one engineers who know nothing. Use when asked for "onboarding docs", "new engineer guide", "how to get started", or "developer setup".

Generate a polished HTML presentation page and Obsidian Canvas for big releases — new products, takeovers, major migrations. Non-technical audience. Use when asked to "present this", "release announcement", "show what we built", or "stakeholder update".

Documentation reconnaissance for takeover — find all docs, assess accuracy, freshness, coverage, and discoverability, and identify critical knowledge gaps. Use when asked "what docs exist", "documentation assessment", or "knowledge gaps".

Render agent findings as a styled HTML report in the browser. Use when asked for "full report", "detailed report", "show in browser", or when CLI output exceeds the 40-line budget.

Internal legal controls review — approval workflows, contract lifecycle, access to sensitive docs.

Full legal compliance audit — contracts, policies, regulatory, IP, corporate hygiene.

Survey legal artifacts for audit readiness.

Run a WCAG accessibility audit against a component, page, or full product.

Write accessibility fixes for specific WCAG failures — ARIA, focus management, keyboard patterns.

Survey a codebase for accessibility debt — missing ARIA, broken keyboard patterns, and contrast issues.

Compare API performance across versions — regression detection and root cause analysis.

Design a performance benchmark for an API — test scenarios, metrics, and tooling.

Audit existing performance testing — find missing benchmarks, stale baselines, and CI gaps.

Run a compliance gap analysis against SOC2, GDPR, HIPAA, or ISO 27001.

Draft compliance policies required by a framework (access control, incident response, data retention).

Survey existing compliance artifacts — policies, audits, certifications.

Design detection rules for a threat — SIEM queries, alert logic, and MITRE ATT&CK mapping.

Write a hardening playbook for a system or service — CIS benchmark mapping and implementation steps.

Audit existing security controls and detection coverage — find gaps against MITRE ATT&CK.

Design escalation path -- Tier 1 to Tier 2 to Engineering handoff, decision criteria, and communication templates. Use when asked to "design our escalation process", "when should support escalate to engineering", "build an escalation runbook", or "reduce escalation rate".

Build or audit knowledge base -- article structure, coverage gaps, deflection rate, and maintenance process. Use when asked to "build a knowledge base", "what docs are missing", "improve our self-serve rate", or "audit our help center".

Design support metrics dashboard -- CSAT, FRT, TTR, ticket deflection rate, volume trends, and agent efficiency. Use when asked to "what metrics should support track", "build our support dashboard", "measure support quality", or "audit our support performance".

Design customer support onboarding flow -- first-contact experience, proactive support touchpoints, and setup success checklist. Use when asked to "design our onboarding support", "how do we support new customers during onboarding", or "reduce early churn from setup failures".

Write support playbook -- response templates, issue-type runbooks, tone guide, and common resolution paths. Use when asked to "write support templates", "build a support playbook", "train our support agents", or "standardize our support responses".

Support operations reconnaissance -- audit current ticket volume, SLA compliance, knowledge base coverage, escalation paths, and CSAT to understand where support is the constraint. Use when asked to "audit our support", "why is our response time bad", "how healthy is our support operation", or "before designing a support system".

Design SLA framework -- response time targets, resolution time targets, tier definitions, and breach escalation process. Use when asked to "define our SLAs", "what response times should we commit to", "build a support tier structure", or "set up SLA monitoring".

Design ticket triage system -- routing rules, priority tags, queue structure, and first-response automation. Use when asked to "design our ticket routing", "how should we tag tickets", "set up our helpdesk", or "reduce time to first response".

Draft a contract or policy document from a description or template.

Survey the project's existing contracts and policy docs.

Review and redline a contract — flag risk, missing clauses, one-sided terms.

Audit AI spend — per-model cost breakdown, top consumers, waste identification, optimization levers.

Design cost reduction strategies — model tiering, prompt compression, caching, batch inference.

Map AI cost topology — billing attribution, team-level spend, forecast vs actuals, alert gaps.

Build and manage open source community — Discord/Slack structure, contributor onboarding, ambassador program, community flywheel design, and GitHub community health. Use when asked to "build a community", "grow our Discord", "improve contributor experience", or "design a developer ambassador program".

Developer relations playbook builder — produces a DevRel program design covering community platform, contributor program tiers, ambassador criteria, event strategy, and success metrics. Use when asked to "build a DevRel program", "design our developer community", "create a contributor program", "start a developer advocacy program", or "how do we grow our dev community".

Hacker News post crafter — given a product, feature, or story produces a ready-to-post HN submission (title ≤80 chars, no marketing), honest body text with technical depth, no outbound links, predicted reception analysis, and comment-response templates for likely pushback. Use when asked to "write an HN post", "craft a Show HN", "prepare our Hacker News launch", or "help me post on HN".

Design and execute a launch plan — Product Hunt, HN Show HN, newsletter coordination, social posts, and community launch moment. Use when asked to "launch [feature/product]", "plan a launch", "help us do a Product Hunt launch", or "coordinate the announcement".

Media and podcast outreach personalizer — takes a story angle and target journalist or host list and produces personalized pitch emails per target. Use when asked to "write media pitches", "pitch this story to journalists", "get us on podcasts", "write press outreach", or "personalize pitches for these contacts".