Claude Skills by VincentChuWaiChow

Use this skill to classify a Python live-control-plane task by runtime, business process, data class, environment, and control profile, and route it to the narrowest live specialist (read-only-runtime or mutating-runtime), or to gate a mutating request to a named human owner under live-guard-gate. Routing only — never mutates, approves, or declares compliance.

Use this skill to confirm active identity, role, credential age, target scope, JIT status, and approval authority before any gated live action. Read-only-runtime: it blocks shared identities, unidentified principals, standing administrative credentials, and requester-as-approver conflicts, but never grants, elevates, or approves anything itself.

Use this skill to operate a distributed job or business-automation process (retry, requeue, run): confirm both technical and business idempotency before acting, bound every retry instead of blindly retrying all failed jobs, and reconcile the actual business outcome rather than accepting the job's own success status.

Use this skill to promote exactly one immutable model artifact: confirm the artifact's provenance and integrity (hash/signature), an AI-risk classification, evaluation evidence matched to the deployment, live monitoring, and a rollback to the prior artifact before promoting, and record the AI-system role without declaring regulatory conformity.

Use this skill to evaluate a versioned, machine-readable policy bundle and control applicability against a live action's recorded inputs, producing candidate control results. Read-only-runtime: it cannot create an exception or an approval.

Use this skill to execute exactly one bounded release, canary increment, rollback, or single-instance restart under mutating-runtime controlled execution: confirm an independent approval bound to the plan digest and target, target-scoped JIT credentials, a captured before-state, and a pre-approved rollback exist before acting, then capture the after-state and route verification to an independent check. It never executes a fleet-wide or unbounded change and never self-attests success.

Use this skill to execute only a previously approved, tested rollback procedure against the exact affected target. It confirms rollback authority and a captured before-state/snapshot reference exist before acting, then captures and reconciles the post-rollback state through an independent check. It never improvises a rollback during an active failure.

Use this skill to read live Python interpreter, process, worker, task, thread, memory, and health state through allowlisted read-only diagnostics, and to flag health signals as findings. Read-only-runtime: it never restarts, kills, scales, or reconfigures a process.

Use this skill to perform read-only discovery of Python runtimes, services, scheduled jobs, notebooks, packages, owners, environments, deployment revisions, service identities, and criticality, producing an asset and ownership register. Read-only-runtime: it never mutates a discovered asset and never retrieves raw credentials.

Use this skill to classify a Python application, runtime, packaging, framework, data, or code-level task and route it to the narrowest static-review specialist on the Python board, or to gate a production-mutation request to a named human owner. Routing and classification only — it never reviews Python work itself, never answers a Python question directly, and never contacts a live system.

Use this skill to statically review Python ML/AI production correctness: training-serving skew, feature/data leakage, model-artifact serialization safety, reproducibility, evaluation-deployment match, batch-vs-online consistency, and model/prompt provenance. Reads training/serving source, configuration, and evaluation artifacts only; it never trains, loads, or serves a model.

Use this skill to statically review Python native extensions and interop (CPython C API, Cython, PyO3/Rust): reference-ownership correctness, stable-ABI use, buffer-protocol safety, exception translation, and thread/GIL and free-threaded readiness. Reads extension source and build config only; it never compiles or runs the extension.

Use this skill to statically review Python numerical and scientific correctness: binary float used for money, rounding-mode errors, silent dtype coercion and integer overflow, missing-data (NaN) handling, timezone-naive timestamps, unseeded randomness and irreproducibility, numerical instability, and unbenchmarked vectorization claims. Reads source only; it never runs the calculation, notebook, or benchmark.

Use this skill to statically review in-application Python observability: structured logs, metrics, traces, context propagation and correlation, error taxonomy, metric/label cardinality, PII exposure, and SLO-supporting instrumentation. Reads application instrumentation code only; it routes collector, exporter, and dashboard infrastructure to the platform boards.

Use this skill to statically review Python packaging and software supply-chain integrity: pyproject build metadata, dependency locking and hash-checking, index trust and dependency confusion, build isolation, dependency specifiers, license metadata, and CI release-token exposure. Reads manifests and lockfiles only; it never installs packages, resolves environments, or contacts an index.

Use this skill to statically review Python performance and memory claims: CPU profiling vs benchmarking rigor, memory growth and allocation patterns, GC pressure, algorithmic complexity, and serialization/import/startup cost. Reads source, profiles, and benchmark artifacts only; it never runs the profiler or benchmark itself.

Use this skill to statically review Python test-suite quality (pytest, hypothesis): fixture scope and isolation, mock misuse and wrong-target patching, control of time/randomness/environment, flakiness sources, assertion quality, coverage theater, async-test correctness, and property-based-testing signal. Reads test and source code only; it never runs the suite or measures coverage.

Use this skill to statically review Python web-service production readiness across FastAPI, Starlette, Django, and Flask (ASGI/WSGI): sync-vs-async endpoint blocking, request validation, authentication and authorization boundaries, middleware order, worker model, timeouts, graceful shutdown, and health checks. Reads source and config only; it never starts the server or sends requests. Loads the framework-specific reference only when the framework is detected.

Use this skill when reviewing how a CI pipeline runs tests — gating, sharding, parallelism, fail-fast behavior, artifact retention, and flaky-test quarantine wiring. Trigger when a user provides a CI workflow file (GitHub Actions, GitLab CI, CircleCI, Jenkins), asks why CI is slow or unreliable as a merge gate, or wants to know whether their test pipeline actually blocks bad merges. This skill reviews CI configuration statically; it does not trigger or run pipelines.

Use this skill when a user provides a Helm chart or asks to review Helm chart quality, security, or testability — including Chart.yaml, values.yaml, templates/, tests/, or chart-testing CI configuration.

Use this skill when the user provides raw Kubernetes YAML manifests or asks to review K8s manifests for quality, security, or policy compliance — covering Deployment, StatefulSet, DaemonSet, Service, Ingress, NetworkPolicy, RBAC, and CRD resources.

Use this skill when reviewing how an LLM or AI pipeline is evaluated — metric selection, golden datasets, threshold governance, adversarial coverage, and regression gating — to determine whether low-quality or unsafe model outputs can ship undetected. Trigger when a user provides evaluation configuration files, DeepEval or RAGAS test scripts, eval CI steps, or asks whether their AI pipeline actually prevents a bad model from reaching production. This skill reviews evaluation setup statically;...

Use this skill when an operator wants to actually execute an existing Playwright end-to-end suite against a confirmed non-production target and receive a structured, attested run report — pass/fail counts, flaky tests, durations, and trace artifacts. Trigger when the user asks to "run the e2e suite", "execute the Playwright tests against staging", or hands the agent a Playwright project plus a target base URL. This is the live-execution counterpart to the static-review skill `playwright-e2e-s...

Use this skill when reviewing a Playwright end-to-end test suite for flakiness, selector brittleness, isolation defects, and CI reliability. Trigger when a user provides Playwright spec files, a playwright.config.ts/js, a CI workflow that runs Playwright, or asks why their E2E suite is flaky, slow, or fails intermittently in CI but passes locally. This skill reviews test artifacts statically; it does not execute the suite or launch browsers.

Use this skill when reviewing exported PLC program logic (Ladder Diagram, Structured Text, Function Block Diagram, or Sequential Function Chart) for safety and reliability defects. Trigger when a user provides exported IEC 61131-3 program source, an I/O list, a safety requirements spec, a SIL assessment, or asks whether their PLC logic has a safe state, a correct E-stop implementation, unresolved latches, forced I/O, or interlock bypass risks. This is OT/ICS — defects injure people or destroy...

Use this skill when reviewing exported RPA workflow definitions for resilience and security defects that cause unattended bots to fail silently in production. Trigger when a user provides UiPath XAML files, Automation Anywhere bot exports, Power Automate Desktop flow definitions, Blue Prism process XML, or project dependency manifests, or asks why an unattended bot crashes silently, double-processes transactions, or times out under load. This skill reviews workflow definitions statically; it ...

Use this skill when reviewing a test suite for assertion quality rather than coverage percentage — detecting coverage theater, where line/branch coverage is high but the tests would not catch a regression. Trigger when a user provides test files, a coverage report, or asks whether their tests are actually meaningful, why bugs ship despite high coverage, or how to set a coverage gate. This skill reviews test artifacts statically; it does not execute tests or run a coverage tool.

Use this skill when triaging flaky tests across any test framework — analyzing a flaky-test report, CI rerun history, or a set of intermittently failing tests to assign each a root-cause category and a remediation or quarantine path. Trigger when a user reports tests that pass on re-run, asks why CI is unreliable, provides a flaky-test dashboard export, or wants a quarantine policy. This skill reviews evidence statically; it does not execute or re-run tests.

Use this skill when an Agentforce or Salesforce AI agent configuration must be reviewed for grounding quality, retrieval scope, action allowlist safety, human handoff design, hallucination containment, prompt injection surface, autonomous action boundary, audit logging, and model-risk controls. Trigger phrases: "review this Agentforce configuration", "assess the risk of this AI agent", "check the action allowlist for this agent", "review grounding and retrieval scope", "is this autonomous AI ...

Queries Salesforce Telemetry & Data Management (STDM) and Data Cloud for live Agentforce session traces, faithfulness scores, answer relevance scores, action invocation telemetry, and quality metrics under T1 least-privilege scope (api + refresh_token + cdp_query_api). Answers the production observability question: \"is my Agentforce agent working correctly right now?\" Operational counterpart to the static-review salesforce-agentforce-risk-review-skill. TRIGGER when: user asks for Agentforce...

Generates production-grade Apex classes with Service-Selector-Domain layering, correct sharing models (with sharing / without sharing / inherited sharing per class type), async patterns (Queueable, Batchable, Schedulable), and governor-limit awareness. T0 static generation — no org connection required. TRIGGER when: user asks to write an Apex class or trigger, generate a service/selector/domain layer, create an async job, implement a REST resource, scaffold a .cls file, or port business logic...

Retrieves and analyzes Apex debug logs from a connected Salesforce org to identify governor-limit hits, SOQL N+1 patterns, unhandled exceptions, and async job failures. T1 read-only runtime — retrieves logs only, never executes code or mutates data. TRIGGER when: user asks to analyze an Apex log, debug a trigger failure, diagnose a governor limit hit, interpret a stack trace from a Salesforce org, or review a DEBUG log for performance issues. Trigger phrases: analyze apex log, debug this trig...

Use this skill when Salesforce Apex classes, triggers, Lightning Web Components (LWC), or async jobs (Queueable, Batch, Future, Schedulable) must be reviewed for security vulnerabilities and governor-limit risk. Flags: SOQL and DML inside loops, missing test coverage patterns, WITH SECURITY_ENFORCED or WITH USER_MODE or stripInaccessible usage, sharing keyword omission, governor-limit risk, LWC XSS surface, and Locker Service issues. Trigger phrases: "review this Apex class", "check this trig...

Generates Apex test classes with TestDataFactory patterns, Assert class usage, bulkification (200+ records), positive/negative/bulk test method separation, async test patterns (Test.startTest/stopTest), and proper @TestSetup usage. T0 static generation — no org connection required. TRIGGER when: user asks to write Apex test classes, create @isTest code, generate test setup data, scaffold test coverage for a class, or add a test class for a .cls file. Trigger phrases: write apex tests, test cl...

Executes Apex tests against a connected SANDBOX org via sf apex run test, parses results and coverage delta, identifies failures with stack traces, and suggests fixes. T1 read-only runtime (sandbox-only). Production org targets are HARD REFUSED before any API call. TRIGGER when: user wants to run Apex tests, execute a test class, check test coverage, diagnose test failures, or validate coverage before deployment. Trigger phrases: run apex tests, execute test class, test my changes, check test...

Generates scripts for Salesforce bulk data operations: mass owner reassignment, record deduplication (Apex MergeOpportunities pattern), mass field update, batch close stale records, contact deactivation, and lead conversion. Outputs both Data Loader CSV transformation templates and Anonymous Apex scripts ready for sf apex run. T0 generation only — T2 dry-run execution requires salesforce-deployment-validator-skill. TRIGGER when: user says reassign owners, mass update field, deduplicate record...

Runs `sf project deploy validate` against a SANDBOX or non-production org to surface deployment issues, test failures, and metadata dependency problems WITHOUT committing changes. T2 sandbox-mutating but reversible (dry-run only — no commit occurs). Production org targets are REFUSED — production deploys require human approval via salesforce-live-guard-agent. Feeds salesforce-change-impact-analyst-agent. TRIGGER when: user wants to validate a deployment package, dry-run a manifest, check pre-...

Use this skill when Salesforce development pipelines must be reviewed for DevSecOps compliance — covering Salesforce Code Analyzer (SCA) finding triage and false positive review, sandbox data governance and PII masking strategy, change impact analysis across metadata dependencies and downstream automation, CI/CD security gate requirements, and DevOps Center deployment governance. Trigger phrases: "review SCA findings", "triage code analyzer results", "assess sandbox data masking", "review cha...

Maps CSV or spreadsheet column headers to Salesforce field API names with type mismatch detection, missing-field flagging, picklist value normalization, and API name collision detection. Used during data migration from HubSpot, Pipedrive, Excel exports, and legacy CRMs. TRIGGER when: user says map these columns to salesforce fields, field mapping for migration, convert csv headers to api names, import field mapping, migrate data from hubspot/pipedrive/excel, column mapping for data loader. DO...

Use this skill when Salesforce Flow XML, validation rules, approval processes, or record-triggered automation must be reviewed for correctness, safety, and maintainability. Flags recursion, ungoverned bypass flags, brittle null handling, missing fault paths, hardcoded recipients, before-save vs after-save misuse, and mixed Process Builder plus Flow plus Apex on same object. Trigger phrases: "review this Flow", "check this automation for recursion", "review this approval process", "is this val...

Diagnoses Salesforce Flow failures from pasted error messages or (in T1 mode) live Flow Interview logs fetched via sf CLI. Identifies the failing node, root cause, and provides specific fix recommendations including fault path design, data type corrections, and null handling. TRIGGER when: user says debug this flow error, flow failed with, flow interview error, why did my flow fail, flow is not working, flow throws error, flow interview fault. Trigger phrases: flow error, interview log, fault...

Use this skill when Salesforce infrastructure security posture must be audited — covering network security policies, trusted IP ranges, login IP ranges per profile, CSP Trusted Sites configuration, session security settings, sandbox isolation strategy, sandbox data-sensitivity alignment, Hyperforce deployment controls, and data residency commitments. Trigger phrases: "audit Salesforce infrastructure security", "review network policies", "check IP allowlist config", "assess sandbox isolation",...

Use this skill when a Salesforce integration design must be reviewed for API choice, middleware position, retry and idempotency patterns, error queue design, observability, secret handling, OAuth scope minimization, named credential vs callout patterns, and MuleSoft vs point-to-point architecture. Trigger phrases: "review this Salesforce integration", "is this API design safe", "check OAuth scope for this integration", "review our MuleSoft pattern", "assess this Platform Events design". Do no...

Use this skill when marketing data flows must be reviewed for consent capture, lawful basis, purpose limitation, preference center coverage, suppression list integrity, subscriber-key collision risk, deliverability authentication (SPF, DKIM, DMARC), and unsubscribe link integrity. Covers Marketing Cloud, Account Engagement (formerly Pardot), Data Cloud, and related marketing orchestration tools. Trigger phrases: "review our marketing consent model", "check this Marketing Cloud data flow for c...

Fetches Salesforce metadata (objects, fields, flows, validation rules, permission sets, profiles, Apex classes/triggers, Lightning components) live from a connected org under T1 least-privilege scope (api + refresh_token only, no ModifyMetadata grant — uses sf org list metadata and REST describe endpoints requiring only View Setup and Configuration). Sanitizes output (redacts org IDs, user IDs, hardcoded values) and feeds downstream review skills: salesforce-metadata-review-skill, salesforce-...

Use this skill when pasted or exported Salesforce metadata must be reviewed for over-customization, unused fields, hardcoded IDs, and deprecated metadata types. Covers: objects, fields, layouts, page layouts, Lightning record pages, profiles, permission sets, and sharing rules. Trigger phrases: "review this Salesforce metadata", "check this object definition", "are there deprecated metadata types here", "find hardcoded IDs in this profile", "review this permission set export". Do not use when...

Use this skill when a Salesforce org's overall posture must be assessed from sanitized exports — covering the object model, automation inventory, permission topology, integration map, and technical debt indicators. Produces a risk register and remediation backlog. Trigger phrases: "assess this Salesforce org", "review org health", "generate a risk register for this org", "what is the technical debt in this org", "review this metadata export for posture". Do not use when you need to review a s...

Use this skill when Salesforce profiles, permission sets, permission set groups, permission set licenses, muting permission sets, sharing rules, OWD, role hierarchy, IP restrictions, or session policies must be reviewed for toxic combinations and over-privilege. Flags: ModifyAllData with broad assignment, ViewAllData on PII objects, API Enabled without IP restriction, Customize Application outside admin profiles, and sharing-rule widening on regulated-data objects. Trigger phrases: "review th...

Use this skill when a Salesforce release must be evaluated for deployment readiness. Covers: sandbox refresh strategy, source tracking state, package version diff, destructiveChanges.xml review, test coverage threshold verification, post-deploy steps, rollback plan, comms plan, and approval matrix. Trigger phrases: "is this release ready to deploy", "review the destructive changes for this release", "check our sandbox strategy", "validate the release checklist", "pre-deploy readiness review"....

Executes read-only SOQL queries against a connected Salesforce org via the sf data query CLI under T1 least-privilege scope (api + refresh_token only, Run As service account with no ModifyAllData/ViewAllData/ViewEncryptedData). Returns sanitized JSON with a structured audit envelope. Live operational counterpart to the static-review skills. TRIGGER when: user asks to query records, run SOQL, fetch live data, inspect records by ID, count records, run aggregate queries, or check field values in...