Claude Skills by VincentChuWaiChow

Use this skill when statically reviewing the JVM's untrusted-deserialization and data-parsing surface for remote-code-execution and injection risk — Java native ObjectInputStream gadget chains (and the ObjectInputFilter/JEP 290 control), SnakeYAML bare Constructor, Jackson polymorphic default typing without a PolymorphicTypeValidator, XML external-entity (XXE) exposure across every parser factory, and reflective/expression sinks fed by untrusted input. Trigger when a user provides code that d...

Use this skill when statically reviewing a Spring Boot, Quarkus, or Micronaut service for production readiness — externalized configuration, health/readiness/liveness endpoint wiring, graceful shutdown, jakarta namespace correctness plus the framework's JDK floor, build-time DI/AOT reflection safety, profile/config validation, and dependency BOM alignment. Trigger when a user provides a build file (pom.xml/build.gradle), application.properties/application.yml (sanitized), or source annotation...

Use this skill when statically reviewing a Java estate's JDK lifecycle and upgrade posture — identifying the JDK vendor and version, mapping them to support and license boundaries, finding language/API upgrade blockers, and prescribing a phased, evidence-gated upgrade path. Trigger when a user provides build files (pom.xml, build.gradle), toolchain/CI config, or a Dockerfile and asks whether their JDK is supported, what an upgrade will break, or how to sequence it. Reads build files and sourc...

Use this skill when statically reviewing JPA/Hibernate data access for fetch-strategy correctness and reliability — N+1 exposure, JOIN FETCH vs @EntityGraph vs @BatchSize vs DTO projection, LazyInitializationException and open-in-view misuse, pagination combined with a collection fetch (cartesian product), MultipleBagFetchException, and HikariCP connection-pool sizing. Trigger when a user provides entity classes, mappings, Spring Data repositories, or JPQL/Criteria queries and asks why querie...

Use this skill when statically reviewing a proposed JVM garbage-collector or performance change — collector selection (G1, ZGC/Generational ZGC, Shenandoah, Parallel), allocation-pressure source patterns, heap-sizing/GC-flag configuration, and OOM/memory-leak triage. Trigger when a user proposes or has made a GC-collector switch, tunes GC/heap flags, shares JVM startup flags or a Dockerfile/K8s manifest with memory limits, or supplies GC logs, a JFR recording, or heap-dump analysis output and...

Use this skill when statically reviewing a Kafka producer/consumer pipeline for whether it actually delivers the delivery semantics it claims — idempotent-producer-vs-exactly-once conflation, transactional read-process-write wiring (transactional.id, initTransactions, sendOffsetsToTransaction, consumer isolation.level=read_committed), at-least-once with or without an idempotent consumer, commit-before-process message loss, ordering (max.in.flight.requests.per.connection combined with idempote...

Java Maestro routing skill. Classify the user's Java/JVM task, select the narrowest static-review specialist from the Java board (or the smallest team, max 4), and dispatch. Trigger when a user brings a Java, JVM, Spring, Jakarta EE, JDK-upgrade, JPA/Hibernate, or Java-security task and it is not yet clear which specialist should handle it. Routes only — never answers Java questions itself, never runs code, never requests secrets.

Use this skill when statically reviewing resilience4j + Spring composition on a Java code path: decorator/aspect order between @Retry, @CircuitBreaker, @RateLimiter, @TimeLimiter, and @Bulkhead; retry safety on non-idempotent write paths (idempotency/dedup keys); TimeLimiter and total retry timeout-budget coherence; Bulkhead isolation strategy (semaphore vs thread pool); RateLimiter blocking/timeout behavior; fallback correctness (must not swallow the failure signal); bounded queues/backpress...

Use this skill when statically reviewing a Spring Security 6 service's authorization and endpoint-exposure posture — multiple SecurityFilterChain beans and securityMatcher disjointness/ordering, authorizeHttpRequests matcher sequencing (first-match-wins, permitAll before authenticated, anyRequest() last), request-level vs @PreAuthorize/@PostAuthorize/@Secured method-security precedence, AuthorizationManager delegation and fail-closed behavior, CSRF on state-changing endpoints, and Spring Boot...

Use this skill when statically reviewing a JVM test suite's architecture for soundness and non-flakiness: JUnit 5 lifecycle and isolation (shared mutable static state, test-instance lifecycle, order dependence, time/locale/timezone dependence, and unguarded junit.jupiter.execution.parallel usage), Testcontainers discipline (singleton-container-with-Ryuk-reuse vs per-test @Container, explicit Wait strategies vs Thread.sleep), ArchUnit layering/cycle rules including FreezingArchRule brownfield ...

Use this skill when statically reviewing Spring @Transactional boundary correctness — propagation (REQUIRED joining an existing transaction and silently ignoring an inner isolation/timeout; REQUIRES_NEW suspending it), isolation levels, readOnly, rollbackFor (checked exceptions do not roll back by default), proxy self-invocation bypass, and over-wide boundaries that hold a connection through an external call — plus cross-resource/cross-service consistency: the save()-then-send() dual-write an...

Use this skill to statically review Android app architecture correctness: ViewModel lifecycle and scoping across configuration changes, SavedStateHandle persistence across process death, lifecycle-aware Flow collection (repeatOnLifecycle/collectAsStateWithLifecycle/flowWithLifecycle), and unidirectional data flow with a single source of truth. Reads source only; it never runs or instruments the app.

Use this skill to statically review measured Android runtime performance and reliability evidence: cold/warm startup via StartupTimingMetric and CompilationMode, frame jank via FrameTimingMetric/JankStats against the 60fps budget, Baseline Profile coverage, ANR root-causing against the main-thread-blocking threshold, and Macrobenchmark P50/P90/P99 regression-gating. Reads benchmark reports and source only; it never runs a benchmark or instruments a device.

Use this skill to statically review an Android app's security and privacy posture against OWASP MASVS: exported components and intent surfaces, deep-link/App Links validation, WebView exposure, cleartext traffic and network-security-config, local storage and secrets (EncryptedSharedPreferences/Keystore), backup exposure, runtime-permission minimization, and PII in logs. Reads manifest, source, and sanitized config only; it never builds, installs, or instruments an app.

Use this skill to statically review production readiness for Ktor servers and the Kotlin-on-Spring coroutine surface: server lifecycle/monitoring events, Netty/CIO graceful-shutdown configuration, StatusPages typed exception mapping, DI/AutoCloseable resource cleanup on shutdown, and correctly routing the coroutine-context-loss hazard behind suspend WebFlux handlers to its root-cause owner. Reads source and sanitized configuration only; it never runs or deploys a server.

Use this skill to statically review Jetpack Compose UI correctness and accessibility: recomposition stability (@Stable/@Immutable, unstable parameters cascading recomposition), correct side-effect API usage with required cleanup, remember/derivedStateOf for recomposition scope, state hoisting and rememberSaveable, and mandatory semantics/contentDescription plus touch-target sizing for accessibility. Reads source only; it never renders or profiles the UI.

Use this skill to statically review Kotlin coroutine and Flow reliability — structured concurrency and cancellation cooperation, dispatcher selection and blocking-call confinement, cold Flow vs hot StateFlow/SharedFlow semantics and backpressure, and context propagation (transaction, trace, MDC, security) across suspension and dispatcher switches. Reads source only; it never runs coroutine code or profiles live timing.

Use this skill to statically review Java-to-Kotlin migration strategy and mixed-codebase governance: strangler-fig / module-by-module vs file-by-file sequencing, the mixed Java/Kotlin interop boundary and its platform-type null-safety debt, reversibility of each migration step, when a module should NOT be migrated, and governance of J2K automatic-converter output (review required, never merge as-is). Reads module inventories, dependency graphs, and sanitized diffs only; it never runs the conv...

Use this skill to statically review Gradle build-graph quality and CI throughput for Kotlin/KMP projects: configuration-cache compatibility (no execution-time Project access), build-cache correctness (@CacheableTask annotation completeness and relocatable/reproducible output), kapt vs KSP annotation-processing configuration and incremental opt-in, configuration-avoidance API usage, and convention-plugin (build-logic included build) centralization. Reads Gradle build files and build-scan evide...

Use this skill to statically review Kotlin Multiplatform source-set architecture, expect/actual design and pairing completeness, platform-API-leakage prevention, cross-target dependency compatibility, Swift/Objective-C interop (suspend-to-async, @Throws, @ObjCName), and Kotlin/Native runtime correctness (new memory manager, freezing deprecation). Reads source and build configuration only; it never compiles or runs a target.

Use this skill to decide whether a product should adopt Kotlin Multiplatform at all, and how much to share, by weighing org topology and team ownership, product-roadmap alignment, platform-differentiation risk, skills/hiring constraints, lifecycle/maintenance cost, and reversibility. This skill can and must be able to recommend against KMP; it reasons from user-supplied context and never designs the expect/actual implementation.

Use this skill to statically review Kotlin language-level correctness: nullability and Java-interop platform types, inline functions with reified type parameters past JVM erasure, @JvmInline value-class boxing behavior, statically-dispatched extension functions vs member precedence, and lateinit use-before-init hazards. Reads source only; it never compiles or runs code to observe runtime null-pointer or boxing behavior.

Use this skill to statically review Kotlin library public-API evolution and binary/source compatibility for libraries consumed by both Kotlin and Java: binary-compatibility-validator .api snapshots and apiCheck gating, Explicit API mode, @JvmOverloads/@JvmStatic/@JvmName Java-facing surface shaping, and ABI-sensitive data-class and inline-function-body changes. Reads source and build configuration only; it never runs apiDump/apiCheck or publishes a release.

Use this skill to classify a Kotlin, JVM-Kotlin, Android, or Kotlin Multiplatform task and route it to the narrowest static-review specialist on the Kotlin board, or to gate a production-mutation request to a named human owner. Routing and classification only — it never reviews Kotlin work itself, never answers a Kotlin question directly, and never contacts a live system.

Use this skill to statically review kotlinx.serialization wire-contract safety and schema evolution: encodeDefaults/explicitNulls defaults and @EncodeDefault overrides, strict-decode ignoreUnknownKeys behavior, sealed-class closed polymorphism and class-discriminator conventions, and whether a schema change is additive or breaking given how defaults make a field optional on decode. Reads source and serializer configuration only; it never sends or receives real wire traffic.

Use this skill to statically review Kotlin/Gradle dependency trust and release integrity: whether `gradle/verification-metadata.xml` enforces checksum/signature verification in strict mode, whether dependency locking pins transitive versions for reproducible release builds, whether Gradle plugins are pinned and sourced from trusted repositories, whether repository scope prevents dependency confusion, and whether a KMP/Maven publication carries the metadata and evidence a consumer needs to tru...

Use this skill to statically review Kotlin/coroutine/Compose/Android/KMP test architecture and determinism: `runTest` and virtual-time usage, `StandardTestDispatcher` vs `UnconfinedTestDispatcher` choice and advance-call discipline, `Dispatchers.setMain`/`resetMain` hygiene and dispatcher injection, Turbine Flow-testing idioms, Compose UI semantics-based testing, and the Robolectric-vs-instrumented boundary. Reads test source and build config only; it never runs the suite or a device/emulator.

Use this skill when reviewing External Secrets Operator (ESO) configuration, including SecretStore, ClusterSecretStore, ExternalSecret, and PushSecret resources. Trigger when a user provides ESO YAML manifests, asks about secret rotation interval compliance, questions whether ClusterSecretStore scope is too broad, or wants to audit the auth method used to reach an external secret store (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, HashiCorp Vault, 1Password).

Use this skill when reviewing a Kubecost or OpenCost installation for enterprise chargeback readiness. Trigger when the user asks whether cost allocation is accurate, whether label taxonomy is complete enough for chargeback, whether idle cost is properly attributed, whether the cost API is secured, or whether savings recommendations are being actioned.

Guard live kubectl apply, patch, or create operations on Kubernetes networking *architecture* surface — Service spec (`internalTrafficPolicy`, `externalTrafficPolicy`, `topology-mode`, `trafficDistribution`), CoreDNS Corefile, NodeLocal DNSCache install, Gateway API resources (Gateway / HTTPRoute / GRPCRoute / TLSRoute / ReferenceGrant), and ClusterMesh peer Secrets. HARD REFUSE one-way doors (CNI replacement, kube-proxy mode swap, MTU change, Pod / Service CIDR resize, namespace deletion). P...

Guard live kubectl apply, create, or delete operations on Kubernetes RBAC objects — Roles, ClusterRoles, RoleBindings, ClusterRoleBindings — with privilege-escalation verb detection, scope assessment, current-state diff, and explicit approval before any write. Use only when an intentional RBAC mutation is requested against a confirmed cluster target.

Route Kubernetes tasks to the narrowest specialist or team of specialists from the catalog. Use when you do not already know the specialist. Not for direct Kubernetes answers; Maestro classifies, dispatches, and synthesizes only. Dispatches single agent for focused tasks, parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard agents — requires explicit human confirmation with blast-radius and rollback before routing to any live mutation specialist.

Use this skill for Kubernetes cluster network architecture review across the dataplane (CNI choice, kube-proxy mode, IPAM, MTU, encapsulation, dual-stack), service routing surface (Service types, EndpointSlices, internalTrafficPolicy/externalTrafficPolicy, topology-aware routing, Ingress, Gateway API), in-cluster DNS (CoreDNS, NodeLocal DNSCache, ndots), multi-cluster topology (ClusterMesh, Submariner, MCS-API design choices), and connectivity observability and troubleshooting. Trigger when t...

Use this skill for Kubernetes Pod Security Admission (PSA) review covering namespace labels for the three profiles (privileged, baseline, restricted), enforce/audit/warn modes, version pinning, and the migration path from deprecated PodSecurityPolicy. Trigger when the user asks whether a namespace label flip is safe, whether a workload meets a stricter profile, whether the audit/warn modes should be promoted to enforce, or whether an exemption is justified.

Use this skill when reviewing a Kubernetes Pod spec, Deployment spec, or StatefulSet spec for correctness, security posture, and production-readiness. Trigger on any request to audit, validate, or score a workload manifest.

Use this skill for Kubernetes RBAC, Role, ClusterRole, RoleBinding, ClusterRoleBinding, ServiceAccount, workload identity, or least-privilege review tasks. Trigger when the user asks whether cluster access is too broad, how to grant workload permissions safely, or how to audit RBAC state.

Use this skill for Kubernetes workload identity review covering AWS IRSA (IAM Roles for Service Accounts), Azure Workload Identity, GCP Workload Identity Federation, and the underlying ServiceAccount token volume projection plus OIDC issuer trust. Trigger when the user asks how a pod should authenticate to cloud services, whether long-lived credentials in a Secret can be replaced, whether the OIDC trust policy is correctly scoped, or whether ServiceAccount token reuse is a risk.

Use this skill for Kyverno policy review across the stable policies.kyverno.io/v1 API surface — ValidatingPolicy, MutatingPolicy, GeneratingPolicy, DeletingPolicy, and ImageValidatingPolicy. Trigger when the user asks whether an admission policy is safe, whether a PolicyException is justified, whether a policy should be enforced or audited, whether a Kyverno policy should be replaced by a native ValidatingAdmissionPolicy (CEL), or whether image signature verification is correctly configured.

Use this skill when reviewing legal, contractual, regulatory, privacy, litigation, compliance, or risk-governance questions for an enterprise legal function. Trigger when a user provides a contract excerpt, a policy, a compliance question, a privacy-risk question, or a legal intake item and wants risks, evidence gaps, decision options, and escalation paths surfaced. This skill is an adversarial risk-review discipline; it does not provide legal advice, form an attorney-client relationship, or ...

Use this skill when reviewing ad-platform audience targeting configurations and declared AI feature usage for protected-class discrimination risk. Trigger when a user provides a Meta Ads Manager audience definition, Google Ads targeting layer export, DSP deal config, or any ad platform audience spec annotated with AI features enabled (Advantage+ Audience, broad match, automated bidding, lookalike seeds). Use when a campaign is in housing, credit, employment, or insurance verticals, or when au...

Use this skill when reviewing analytics platform configuration — GA4 property settings, BigQuery export schema, custom event-parameter definitions, and user-property declarations — for data-minimization violations, excessive collection, and storage-period over-retention. Trigger when a user provides a GA4 property configuration export, a BigQuery raw-event export schema, a custom event or user-property inventory, data-retention settings, or asks whether their analytics setup collects more per...

Use this skill when reviewing DNS sender-authentication records for a marketing domain to identify policy gaps exposing campaigns to rejection, spoofing, or inbox displacement. Trigger when a user provides DNS TXT record exports for SPF, DKIM, DMARC, or BIMI, or asks whether their email authentication posture meets Google/Yahoo bulk-sender requirements, DMARC enforcement standards, CISA BOD 18-01 obligations, PCI DSS v4.0 Req 5.3.3, or whether their transactional or marketing emails are at ri...

Use this skill when reviewing a marketing AI system's description card against EU AI Act risk-tier criteria to classify the system (prohibited / high-risk / limited-risk / minimal-risk), flag documentation obligations, and identify deployment-readiness gaps before the August 2, 2026 full-enforcement date. Trigger when a user provides an AI system description card covering system purpose, input data types, output decisions, human-oversight mechanism, deployment geography, and whether it profil...

Use this skill when reviewing an influencer campaign audit pack — campaign brief, creator agreement excerpt, platform post descriptions or screenshot descriptions, and the disclosure format and placement specification — against FTC Endorsement Guides to identify undisclosed material connections, inadequate disclosure placement, and brand liability exposure. Trigger when a user provides a structured influencer campaign audit pack and asks whether disclosures meet FTC requirements, whether the ...

Use this skill when reviewing custom-audience and lookalike-audience upload specifications for hashing adequacy, PII field scope, consent-basis validity, and platform data-sharing restrictions before the upload is submitted to Meta, Google, LinkedIn, or TikTok. Trigger when a user provides an audience upload field-mapping specification (CSV schema or platform upload template), declared hashing method, consent-basis documentation, or originating list segment metadata — or when they ask whether...

Use this skill when reviewing a marketing site's consent and data-collection posture — cookie/consent banner (CMP) configuration, tag-manager container exports, Google Consent Mode wiring, or a cookie policy. Trigger when a user provides a CMP configuration, a tag manager container JSON, a consent-banner screenshot description, or asks whether their marketing tracking is GDPR/CCPA/ePrivacy compliant, whether tags fire before consent, or whether their opt-out path is valid.

Use this skill when reviewing marketing conversion flow specifications — subscription sign-up, upsell interstitial, free-trial enrollment, and cancellation path — for dark-pattern practices that invalidate consent or constitute unfair or deceptive acts under FTC Section 5 and state privacy laws. Trigger when a user provides a UX flow specification including step-by-step page descriptions, annotated wireframes, CTA labels, pre-checked options, visual weight of accept vs decline paths, countdow...

Use this skill when reviewing marketing email list segment metadata, consent-record completeness, suppression-list coverage, and documented data-retention schedules for GDPR storage-limitation, CASL record-keeping, and CCPA deletion-right compliance. Trigger when a user provides a CRM or ESP export of list segment metadata fields — consent source, consent timestamp, last-engagement date, subscription status, suppression-list entries — plus the organization's documented email data-retention po...

Use this skill when reviewing the technical path by which a Global Privacy Control opt-out signal travels through the tag stack and CMP to determine whether ad tags, server-side forwarding, and conversion APIs actually cease firing. Trigger when a user provides a tag-manager container export, a CMP opt-out configuration, a server-side tag configuration, or asks whether their GPC implementation actually stops ad tags from firing, whether CPRA opt-out obligations are met technically, or whether...

Route marketing-governance review tasks to the narrowest specialist or team of specialists from the catalog. Use when you do not already know which marketing-governance specialist you need. Not for direct answers; Maestro classifies, dispatches, and synthesizes only. Dispatches a single agent for focused tasks or a parallel team (max 4) for multi-domain tasks. Never auto-dispatches live-guard or mutating agents — requires explicit human confirmation with blast-radius and rollback before any l...