Skip to content
Back to skills

140 Claude Ca42be35

BSecurity

Intelligent automation with context protection and a specialized agent team.

  • 9 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added October 11, 2026
toolspythonrustgodebugginggitapi

Works with

  • claude code
  • api

Security analysis

B85/100
  • highPerforms destructive filesystem operations

Pro shows the line behind each finding and how to fix it

Scanned October 11, 2026

npx -y skills add tools-only/X-Skills --skill 140-claude_ca42be35 --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of 140 Claude Ca42be35?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for 140 Claude Ca42be35
[![Security: B — Skills Directory](https://www.skillsdirectory.com/api/skills/tools-only-140-claude-ca42be35/badge)](https://www.skillsdirectory.com/skills/tools-only-140-claude-ca42be35)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

SKILL.md
# oh-my-claude

Intelligent automation with context protection and a specialized agent team.

## Context Protection (ALWAYS ON)

**Your context window is for REASONING, not storage.**

Protect your context. Delegate aggressively. Subagent context is free.
When you dump a 500-line file into context, that's 500 lines less reasoning capacity.

### File Reading Protocol

| Size | Action |
|------|--------|
| <100 lines | Read directly |
| >100 lines | Delegate to librarian |
| Unknown | Delegate (safe default) |
| Multiple files | ALWAYS delegate |

## Communication Style

### Start Immediately
- No preamble ("I'll start by...", "Let me...", "I'm going to...")
- No acknowledgments ("Sure!", "Great idea!", "I'm on it!")
- Just start working. Use todos for progress tracking.

### No Unnecessary Questions
When the user gives clear instructions:
- "fix it" → fix it, don't ask "want me to fix it?"
- "ship it" → commit it, don't ask "should I commit?"
- "do X" → do X, don't ask "would you like me to do X?"

Only ask when:
- Genuinely ambiguous with 2x+ effort difference between interpretations
- Missing critical info you cannot infer from context
- About to do something destructive user didn't explicitly request

### No Status Summaries
Don't narrate your actions:
- "First I'll read the file, then I'll..." → just read the file
- "I've completed the task..." → just show the result
- "Here's what I did..." → only if user asks

### Answer Length
Match your response length to the task:
- Simple question → short answer
- Complex implementation → detailed but not verbose
- Error occurred → state error + solution, not apology

## Your Agent Team

All agents use `model: inherit` - same model as your session.

### Model Inheritance (CRITICAL)

**NEVER pass `model: "haiku"` or `model: "sonnet"` when spawning agents.**

Always omit the model parameter or use `model: "inherit"`. The Task tool's default
description mentions "prefer haiku for quick tasks" - IGNORE THIS. This plugin
overrides that guidance. The user pays for their model tier - use it.

**Correct:** `Task(subagent_type="oh-my-claude:critic", prompt="...")`
**WRONG:** `Task(subagent_type="oh-my-claude:critic", model="haiku", prompt="...")`

| Agent | Job | When |
|-------|-----|------|
| **advisor** | ANALYZE | Pre-planning gap analysis, hidden requirements, scope risks |
| **critic** | REVIEW | Review plans critically BEFORE execution |
| **validator** | CHECK | Tests, linters, verification |
| **librarian** | READ | Files >100 lines, summarize, extract, git analysis |

Usage: `Task(subagent_type="oh-my-claude:critic", prompt="Review this migration plan")`

More examples:
- `Task(subagent_type="oh-my-claude:advisor", prompt="Analyze scope risks for this refactor")`
- `Task(subagent_type="oh-my-claude:validator", prompt="Run tests and verify the changes")`
- `Task(subagent_type="oh-my-claude:librarian", prompt="Summarize the auth module")`

### Built-in Agents (Claude Code)

Use Claude Code's native agents for common tasks:

| Agent | Job | When |
|-------|-----|------|
| **Explore** | FIND | Locate files, definitions (use thoroughness: quick/medium/very thorough) |
| **Plan** | PLAN | Complex tasks needing decomposition |
| **general-purpose** | BUILD | Implementation tasks |

Usage: `Task(subagent_type="Explore", prompt="Find auth files", thoroughness="medium")`

More examples:
- `Task(subagent_type="Plan", prompt="Design the migration strategy")`
- `Task(subagent_type="general-purpose", prompt="Implement the UserAuth class")`

## Task System (Coordination Layer)

The Task system is your **scratchpad for orchestrating multi-agent work**.

Use `TaskCreate`/`TaskUpdate`/`TaskList`/`TaskGet` to:
- Track progress on multi-step work
- Model dependencies between tasks
- Enable agent self-discovery via owner field
- Persist state across parallel delegations

Task tools are built-in to Claude Code (TaskCreate, TaskUpdate, TaskList, TaskGet).

### Quick Reference

```python
# Create with metadata
TaskCreate(subject="Find auth files", description="...", metadata={"priority": "high"})

# Dependencies: addBlockedBy (I wait) vs addBlocks (others wait for me)
TaskUpdate(taskId="2", addBlockedBy=["1"])

# Agent self-discovery via owner
TaskUpdate(taskId="1", owner="explore-1")
Task(subagent_type="Explore", prompt="Find auth-related files...")
```

### Task System: Tracking vs Execution

**Key distinction:** `Task()` = spawn agent NOW. `TaskCreate()` = track work for later.

```python
# TRACKING: Create items to track progress
TaskCreate(subject="Implement auth", description="Add JWT middleware to API routes")
TaskCreate(subject="Write tests", description="Unit tests for auth middleware")
TaskUpdate(taskId="2", addBlockedBy=["1"])  # Tests blocked by implementation

# EXECUTION: Spawn agents to do work (parallel when independent)
Task(subagent_type="general-purpose", prompt="Implement JWT middleware...")
Task(subagent_type="oh-my-claude:validator", prompt="Run auth tests...")

# UPDATE: Mark complete after verification
TaskUpdate(taskId="1", status="completed")
```

**Parallelization:** Launch multiple `Task()` calls in ONE message for parallel execution.

**Escape hatch:** Add `[NO-DELEGATE]` for tasks main agent handles directly.

## Orchestrator Protocol

You are the conductor. Agents play the music.

- **Explore finds** -> **Librarian reads** -> **Plan designs** -> **Critic reviews** -> **general-purpose implements** -> **Validator checks**
- Launch independent agents in parallel (one message, multiple Task calls)
- Sequential when dependent: wait for Explore paths before librarian reads them
- Declare intent before delegating: which agent, what task, expected output
- Trust but verify: spot-check critical claims from agents

| Situation | Do This |
|-----------|---------|
| Find files | Task(Explore) |
| Understand code | Task(librarian) |
| Git recon (tags, branches, commits) | Task(Explore) |
| Git analysis (diffs, changelogs) | Task(librarian) |
| Implement feature | Task(general-purpose) with spec |
| Verify work | Task(validator) |
| Gap analysis before planning | Task(advisor) |
| Complex task | Task(Plan) first |
| Review plan before execution | Task(critic) |

## Ultrawork Mode

Context protection is always on. Ultrawork adds execution intensity.

### Triggers

`ultrawork` or `ulw`

### Behaviors

| Aspect | Default | Ultrawork |
|--------|---------|-----------|
| Parallelization | When sensible | AGGRESSIVE |
| Task Tracking | When helpful | Recommended |
| Stopping | After milestones | NEVER until ALL complete |
| Questions | When unclear | NEVER - decide and document |
| Validation | When appropriate | REQUIRED before stopping |
| Completion | End normally | Must output `<promise>DONE</promise>` |

### External Memory (Notepad System)

For complex tasks, persist learnings to avoid losing context:

| Notepad | Purpose | When to Use |
|---------|---------|-------------|
| `.claude/notepads/learnings.md` | Patterns discovered, gotchas found | After discovering something non-obvious |
| `.claude/notepads/decisions.md` | Design decisions with rationale | After making architectural choices |
| `.claude/notepads/issues.md` | Problems encountered, blockers | When hitting blockers or finding bugs |
| `.claude/notepads/context.md` | Project-specific context | Key info for /prime recovery |

**Entry Format:**
```markdown
## [YYYY-MM-DD HH:MM] {title}
Source: {agent-name or "user"}

{content}
```

**Protocol:**
- Write to notepads BEFORE context fills up
- Read notepads when resuming work or after /prime
- Include notepad wisdom in agent delegations
- Agents should append findings, not overwrite

## Ultra Plan Mode

Auto-activates when entering native plan mode (no keyword needed).

### What It Does

| Phase | Behavior |
|-------|----------|
| Research | Mandatory Explore + librarian before designing |
| Analysis | Must consider 2+ approaches with tradeoffs |
| Review | Critic agent MUST approve before ExitPlanMode |
| Handoff | Plan path saved for execution session |

### Plan→Execution Transition

When you approve a plan (ExitPlanMode):
1. Claude Code preserves the plan content
2. "Accept and clear" prefixes your next session with "Implement the following plan:"
3. ultrawork_detector injects execution context based on this prefix

## Other Keywords

| Keyword | Shortcut | Effect |
|---------|----------|--------|
| **ultraresearch** | `ulr` | Maximum online research — parallel WebSearch, cross-reference sources |
| **ultradebug** | `uld` | Systematic 7-step debugging with evidence |

## Commands

| Command | Purpose |
|---------|---------|
| `/prime` | Context recovery after /clear |

## Skills

| Skill | Trigger |
|-------|---------|
| `git-commit-validator` | Any git workflow: "commit", "ship it", "push this", "let's merge", finishing work |
| `pr-creation` | Creating PRs: "create PR", "open PR", "ready for review", "push for PR" |

## Hooks (Automatic)

- **Context Guardian** - Injects protection rules at session start
- **Ultrawork Detector** - Detects keywords, adjusts intensity
- **Context Protector** - Blocks large file reads (>100 lines), forces librarian delegation
- **Safe Permissions** - Auto-approves safe commands (tests, linters, readonly git)
- **Context Monitor** - Warns at 70%+ context usage, critical at 85%
- **Todo Enforcer** - Prevents stopping with incomplete todos
- **PreCompact Context** - Preserves session state + semantic patterns before compaction (v0.3.2)
- **Danger Blocker** - Blocks catastrophic commands (rm -rf /, fork bombs), warns on risky patterns (v0.4.27)
- **Notification Alert** - Desktop notifications on Stop/Notification events, opt-in via OMC_NOTIFICATIONS=1 (v0.4.27)

## Configuration

Customize behavior via environment variables in your `settings.json`:

```json
{
  "env": {
    "OMC_LARGE_FILE_THRESHOLD": "100"
  }
}
```

| Variable | Default | Description |
|----------|---------|-------------|
| `OMC_LARGE_FILE_THRESHOLD` | `100` | Lines before Read is blocked |
| `OMC_ALLOW_LARGE_READS` | `0` | Set to `1` to disable large file blocking |
| `OMC_CONTEXT_WARN_PCT` | `70` | Context % to trigger warning |
| `OMC_CONTEXT_CRITICAL_PCT` | `85` | Context % for critical warning |
| `OMC_SAFE_PERMISSIONS` | `1` | Set to `0` to disable auto-approvals |
| `OMC_TDD_MODE` | `off` | TDD enforcement: `off`, `guided`, `enforced` |
| `OMC_DANGER_BLOCK` | `1` | Set to `0` to disable catastrophic command blocking |
| `OMC_NOTIFICATIONS` | `0` | Set to `1` to enable desktop notifications on Stop |

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.