Claude Skills by Vimalk0703

Use when guardrail strictness needs to adjust based on user signals, project maturity changes, or accumulated session data. Moves guardrails from static rules to dynamic control systems.

Graduated pre-commit quality checks that scale with project complexity and user tier. Level 0 for Builder-tier small projects, up to Level 4 for enterprise codebases. Thresholds configurable in architecture.md.

Use when building APIs to enforce that every response matches a declared schema before reaching the client. Prevents accidental data leakage, field mismatches, and contract violations.

Testing discipline that adapts to user tier and task type. Rigorous RED-GREEN-REFACTOR for critical code. Invisible testing for Builder-tier users. Pragmatic skip for trivial changes. The goal is confidence that the code works, not ceremony.

Gate function — no completion claims without fresh verification evidence. Prevents shipping broken code by requiring proof that the change works.

Use when building any application to automatically detect the software type and apply appropriate security measures. Covers web apps, APIs, mobile backends, CLI tools, data pipelines, IoT, desktop apps, and infrastructure.

Use when writing or reviewing code that makes decisions about people — pricing, scoring, ranking, filtering, access control, or content moderation. Detects discriminatory logic and unfair algorithmic patterns.

Practical engineering guidance for SOC 2, GDPR, HIPAA compliance and data classification. Covers access controls, audit logging, change management, right to deletion, data portability, consent, PHI encryption, and data classification levels. Engineering checks, not legal advice.

Dockerfile best practices, secure base images, no secrets in build context, multi-stage builds, non-root execution, and image scanning guidance.

Vet packages before adoption, audit for vulnerabilities, pin versions, and prevent dependency bloat.

Detect and flag PII (emails, SSNs, credit cards, phone numbers) in code, test fixtures, and logs. Enforce masking before logging and GDPR/CCPA-aware data handling.

Use when handling API keys, database credentials, tokens, certificates, or any sensitive configuration values.

OWASP-aware security practices — input validation, secrets management, auth patterns, injection prevention, CORS, rate limiting, and CSP headers.

Use when adding dependencies, updating packages, or configuring build pipelines to prevent supply chain attacks.

Apply the STRIDE framework to identify and mitigate security threats. Covers Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege with practical questions, verification steps, and mitigations for each threat category.

Use when integrating third-party services, APIs, SDKs, or SaaS platforms to evaluate their security posture, compliance certifications, data handling practices, and operational reliability before adoption.