Development

Authors a feature specification (scenarios, rules, data, API operations, UI states, edge cases, security, accessibility, acceptance criteria) from the product spec. Produces docs/specs/features/F-NNN-name.md. Run per feature before stories.

Implements a story end-to-end: loads spec/contract/ADR/rules, routes to the right engineers (Go/PHP/Node/GraphQL/Angular/Vue/three.js/DB), drives code + tests, runs checks, confirms each acceptance criterion. The core implementation skill — run after stories exist, before /code-review and /story-done.

Defines the project design system — principles, --ds-* tokens (colour roles, spacing, type, radius, motion) for light/dark, component inventory with states and aria patterns, mapping to Angular Material / Taiga UI / Vue kits, game HUD rules. Produces docs/specs/design-system.md and a tokens CSS draft.

Breaks a feature spec into implementable stories (vertical slices: contract → backend → frontend/game → tests) with acceptance criteria mapped to tests, size, layer, ADR links. Produces production/stories/F-NNN/S-NNN-*.md.

Reviews code (files, directory, or current diff) for correctness, standards compliance, ADR adherence, security (OWASP), performance, testability; routes to the right lead and specialist by file type (Go/PHP/TS/Angular/Vue/GraphQL/three.js) and to appsec-engineer for sensitive paths. Read-only findings with BLOCKING/WARNING/INFO.

Cross-checks ADRs, API contracts, data model, threat model and feature specs for consistency and feasibility before build; verifies stack facts against the stack reference; `code` mode checks the repository itself against the ADRs, contract and threat model (module boundaries, dependencies, entry points, surfaces) and records drift as findings. Read-only report with PASS / CONCERNS / FAIL. Run at the architecture→build gate, quarterly, and on an adopted project.

Designs the API contract before implementation — GraphQL SDL by default (types, Node/connections, inputs, mutations with payload errors, subscriptions, @auth, persisted operations) or OpenAPI 3.1 / AsyncAPI for REST/events; validates with graphql-inspector / spectral, generates types, documents in docs/architecture/api/. Also game WebSocket protocols.

Brownfield onboarding — detects the real stack of an existing project (Go/PHP/Node, Angular/Vue/Nuxt, GraphQL/REST, three.js), fills technical-preferences from the facts, audits existing artifacts against studio formats, merges settings/CLAUDE.md, and produces a numbered adoption plan. Run when installing the studio into an existing project.

Use when the user explicitly asks to regenerate, rebuild, or refresh the `claude-prospector` token-usage dashboard with no interpretive question attached — runs `python -m claude_prospector dashboard`, writes the HTML file, and reports the output path. Do NOT use when the user is asking what the data means, where their budget stands, or what to change (use `usage-analysis` instead — it regenerates as part of answering). Trigger phrases: "regenerate the usage dashboard", "rebuild my claude-pro...

Use when the user asks an interpretive question about their Claude Code token spend — what's interesting, what's anomalous, what to change. This skill produces insights and questions; it does NOT enumerate top consumers (the dashboard does that). Use `usage-dashboard` for "show me the numbers." Use `claude-audit` for "audit my config overlap." Use this skill for "tell me what's interesting / what should I change." Trigger phrases: "am I close to my Claude limit", "how much Sonnet am I using...

Set up claude-prospector's plugin-owned Python venv. Invoked via /setup-prospector or natural-language triggers: "set up claude-prospector", "install prospector dependencies", "prospector isn't working", "fix prospector", "repair prospector". Do not trigger on "dashboard", "usage analysis", or "skill adoption" — those are distinct skills.

Use when the user wants a judgment-level read on whether a Claude Code session stayed on task — did the agent do what was originally asked, and what did it acknowledge skipping. This is the interpretive (LLM) complement to the deterministic `session-audit` CLI: 1a extracts ask-vs-done for free; this skill adds the `Variance` and `What was NOT done` judgment that a parser can't compute, then persists a combined record for drift analysis. Cost: ~1-3k tokens of the current session, paid only wh...

Audit a project's effective Claude Code configuration — custom and plugin-provided agents and skills — and produce a structured overlap/conflict report with keep / modify / drop recommendations scoped to the project's stated objectives. Trigger this skill whenever the user types `/claude-audit`, asks to "audit my claude config", "find overlap in my agents", "check for skill conflicts", "are any of my agents duplicates", "what's redundant in my setup", or any similar request to review the agen...

Expert Next.js 14+ developer specializing in App Router, React Server Components, Server Actions, TypeScript, and modern full-stack patterns. Use when building Next.js applications or debugging Next.js-specific issues.

Grounds every implementation decision in project documentation AND official framework docs. Use before writing any code — check project artifacts first, then verify framework APIs. Prevents "retraining from scratch" each session.

Adapt iOS apps (SwiftUI and UIKit) for iPhone Duo, Apple's folding iPhone: two displays, a hinge, toolbars and tab bars that move to the side, reserved regions, and the iOS 27.1 layout APIs (ArrangementView, UIArrangementViewController, reservedRegions, onHingeChange, axisBehavior, toolbarVerticalBehavior). Use this skill whenever the user mentions iPhone Duo, a foldable or folding iPhone, the hinge or fold, book or laptop pose, inner or outer display, Device Hub, vertical bars, or Arrangemen...

Triage bugs reported in chat/issues, search for duplicates, file or update GitHub issues with full context, and push fix PRs.

Launch, restart, or troubleshoot the real AO Electron desktop app from this repository; run a checkout against isolated or real local AO data; combine PR branches for local UI review; and diagnose stale Electron processes, port conflicts, or preload bridge mismatches. Use whenever asked to run, open, show, or visually verify AO frontend changes in the actual desktop app rather than ao preview, dev:web, or mock data.

Perform static analysis on Android APK, iOS IPA, or bundled web apps to extract endpoints, secrets, permissions, code flow, and other security-relevant data

Hunt mobile vulnerability classes in decompiled Android (jadx/apktool) and iOS (class-dump/otool/nm) trees — ripgrep signature scan first (zero deps), optional semgrep taint analysis for dataflow classes, then triage (exported check, attacker-APK discipline) and pick the matching dynamic PoC (adb/drozer/Frida) per class from the bundled reference docs.

Greybox fuzz Android native libraries (.so) on-device with AFL++ — cross-compile the fuzzer for Android arm64, harness a JNI parser with a stub JNIEnv, detect memory bugs with ASan/libdislocator, and validate the harness actually reaches the target.

Perform static analysis on Android APK, iOS IPA, or bundled web apps to extract endpoints, secrets, permissions, code flow, and other security-relevant data

Hunt mobile vulnerability classes in decompiled Android (jadx/apktool) and iOS (class-dump/otool/nm) trees — ripgrep signature scan first (zero deps), optional semgrep taint analysis for dataflow classes, then triage (exported check, attacker-APK discipline) and pick the matching dynamic PoC (adb/drozer/Frida) per class from the bundled reference docs.

Greybox fuzz Android native libraries (.so) on-device with AFL++ — cross-compile the fuzzer for Android arm64, harness a JNI parser with a stub JNIEnv, detect memory bugs with ASan/libdislocator, and validate the harness actually reaches the target.