Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies, and production readiness checklists for web applications.

Deployment Patterns

Production deployment workflows and CI/CD best practices.

When to Activate

Setting up CI/CD pipelines

Dockerizing an application

Planning deployment strategy (blue-green, canary, rolling)

Implementing health checks and readiness probes

Preparing for a production release

Configuring environment-specific settings


Go testing patterns including table-driven tests, subtests, benchmarks, fuzzing, and test coverage. Follows TDD methodology with idiomatic Go practices.

Go Testing Patterns
Integration with CI/CD

Integration with CI/CD

**Remember**: Tests are documentation. They show how your code is meant to be used. Write them clearly and keep them up to date.


Decision framework for choosing between regex and LLM when parsing structured text — start with regex, add LLM only for low-confidence edge cases.

Regex vs LLM for Structured Text Parsing

4. Hybrid Pipeline

Real-World Metrics

From a production quiz parsing pipeline (410 items):

| Metric | Value |
|--------|-------|
| Regex success rate | 98.0% |
| Low confidence items | 8 (2.0%) |
| LLM calls needed | ~5 |
| Cost savings vs all-LLM | ~95% |
| Test coverage | 93% |


Operate as an agentic engineer using eval-first execution, decomposition, and cost-aware model routing.

Model Routing

Haiku: classification, boilerplate transforms, narrow edits

Sonnet: implementation and refactors

Opus: architecture, root-cause analysis, multi-file invariants


Docker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration.

When to Activate

Setting up Docker Compose for local development

Designing multi-container architectures

Troubleshooting container networking or volume issues

Reviewing Dockerfiles for security and size

Migrating from local dev to containerized workflow


Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Security Scan Skill
Interpreting Results
Medium Findings (recommended)

Medium Findings (recommended)

Silent error suppression in hooks (`2>/dev/null`, `|| true`)

Missing PreToolUse security hooks

`npx -y` auto-install in MCP server configs


Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

Spring Boot Security Review
Input Validation

Input Validation

Use Bean Validation with `@Valid` on controllers

Apply constraints on DTOs: `@NotBlank`, `@Email`, `@Size`, custom validators

Sanitize any HTML with a whitelist before rendering


Use this skill when writing new features, fixing bugs, or refactoring code. Enforces test-driven development with 80%+ coverage including unit, integration, and E2E tests.

Test-Driven Development Workflow
Continuous Testing

FAIL: WRONG: No Test Isolation

PASS: CORRECT: Independent Tests

Continuous Testing


Codified expertise for production scheduling, job sequencing, line balancing, changeover optimization, and bottleneck resolution in discrete and batch manufacturing. Informed by production schedulers with 15+ years experience. Includes TOC/drum-buffer-rope, SMED, OEE analysis, disruption response frameworks, and ERP/MES interaction patterns. Use when scheduling production, resolving bottlenecks, optimizing changeovers, responding to disruptions, or balancing manufacturing lines.

Key Edge Cases

Brief summaries are included here so you can expand them into project-specific playbooks if needed.

**Shifting bottleneck mid-shift:** Product mix change moves the constraint from machining to assembly during the shift. The schedule that was optimal at 6:00 AM is wrong by 10:00 AM. Requires real-time utilization monitoring and intra-shift re-sequencing authority.

**Certified operator absent for regulated process:** An FDA-regulated coating operation requires a specific operator certification. The only certified night-shift operator calls in sick. The line cannot legally run. Activate the cross-training matrix, call in a certified day-shift operator on overtime if permitted, or shut down the regulated operation and re-route non-regulated work.

**Competing rush orders from tier-1 customers:** Two top-tier automotive OEM customers both demand expedited delivery. Satisfying one delays the other. Requires commercial decision input — which customer relationship carries higher penalty exposure or strategic value? The scheduler identifies the tradeoff; management decides.

**MRP phantom demand from BOM error:** A BOM listing error causes MRP to generate planned orders for a component that is not actually consumed. The scheduler sees a work order with no real demand behind it. Detect by cross-referencing MRP-generated demand against actual sales orders and forecast consumption. Flag and hold — do not schedule phantom demand.

**Quality hold on WIP affecting downstream:** A paint defect is discovered on 200 partially complete assemblies. These were scheduled to feed the final assembly constraint tomorrow. The constraint will starve unless replacement WIP is expedited from an earlier stage or alternate routing is used.

**Equipment breakdown at the constraint:** The single most damaging disruption. Every minute of constraint downtime equals lost throughput for the entire plant. Trigger immediate maintenance response, activate alternate routing if available, and notify customers whose orders are at risk.

**Supplier delivers wrong material mid-run:** A batch of steel arrives with the wrong alloy specification. Jobs already kitted with this material cannot proceed. Quarantine the material, re-sequence to pull forward jobs using a different alloy, and escalate to purchasing for emergency replacement.

**Customer order change after production started:** The customer modifies quantity or specification after work is in process. Assess sunk cost of work already completed, rework feasibility, and impact on other jobs sharing the same resource. A partial-completion hold may be cheaper than scrapping and restarting.


Create platform-native content systems for X, LinkedIn, TikTok, YouTube, newsletters, and repurposed multi-platform campaigns. Use when the user wants social posts, threads, scripts, content calendars, or one source asset adapted cleanly across platforms.

Repurposing Flow

Pick the anchor asset.

Extract 3 to 7 atomic claims or scenes.

Rank them by sharpness, novelty, and proof.

Assign one strong idea per output.

Adapt structure for each platform.

Strip platform-shaped filler.

Run the quality gate.


Multi-source deep research using firecrawl and exa MCPs. Searches the web, synthesizes findings, and delivers cited reports with source attribution. Use when the user wants thorough research on any topic with evidence and citations.

Deep Research
Workflow
Step 3: Execute Multi-Source Search

Step 3: Execute Multi-Source Search

For EACH sub-question, search using available MCP tools:

**With firecrawl:**

**With exa:**

**Search strategy:**

Use 2-3 different keyword variations per sub-question

Mix general and news-focused queries

Aim for 15-30 unique sources total

Prioritize: academic, official, reputable news > blogs > forums


Database migration best practices for schema changes, data migrations, rollbacks, and zero-downtime deployments across PostgreSQL, MySQL, and common ORMs (Prisma, Drizzle, Kysely, Django, TypeORM, golang-migrate).

Database Migration Patterns
PostgreSQL Patterns
Renaming a Column (Zero-Downtime)

PostgreSQL Patterns

Adding a Column Safely

Adding an Index Without Downtime

Renaming a Column (Zero-Downtime)

Never rename directly in production. Use the expand-contract pattern:


Analyze an unfamiliar codebase and generate a structured onboarding guide with architecture map, key entry points, conventions, and a starter CLAUDE.md. Use when joining a new project or setting up Claude Code for the first time in a repo.

Codebase Onboarding
How It Works
Phase 4: Generate Onboarding Artifacts

Phase 4: Generate Onboarding Artifacts

Produce two outputs:

Output 1: Onboarding Guide

Output 1: Onboarding Guide

Output 2: Starter CLAUDE.md

Output 2: Starter CLAUDE.md

Generate or update a project-specific CLAUDE.md based on detected conventions. If `CLAUDE.md` already exists, read it first and enhance it — preserve existing project-specific instructions and clearly call out what was added or changed.


Evidence-first revenue, pricing, refunds, team-billing, and billing-model truth workflow for ECC. Use when the user wants a sales snapshot, pricing comparison, duplicate-charge diagnosis, or code-backed billing reality instead of generic payments advice.

Guardrails

distinguish live data from saved snapshots

separate:

revenue fact

customer impact

code-backed product truth

recommendation

do not say "per seat" unless the actual entitlement path enforces it

do not assume duplicate subscriptions imply duplicate value


C++ coding standards based on the C++ Core Guidelines (isocpp.github.io). Use when writing, reviewing, or refactoring C++ code to enforce modern, safe, and idiomatic practices.

C++ Coding Standards (C++ Core Guidelines)

Resource Management (R.*)

Key Rules

| Rule | Summary |
|------|---------|
| **R.1** | Manage resources automatically using RAII |
| **R.3** | A raw pointer (`T*`) is non-owning |
| **R.5** | Prefer scoped objects; don't heap-allocate unnecessarily |
| **R.10** | Avoid `malloc()`/`free()` |
| **R.11** | Avoid calling `new` and `delete` explicitly |
| **R.20** | Use `unique_ptr` or `shared_ptr` to represent ownership |
| **R.21** | Prefer `unique_ptr` over `shared_ptr` unless sharing ownership |
| **R.22** | Use `make_shared()` to make `shared_ptr`s |


Knowledge base management, ingestion, sync, and retrieval across multiple storage layers (local files, MCP memory, vector stores, Git repos). Use when the user wants to save, organize, sync, deduplicate, or search across their knowledge systems.

Knowledge Operations
Ingestion Workflow
3. Store

3. Store

Write to appropriate layer(s):

Always update Claude Code memory for quick access

Use MCP memory for semantic searchability and relationship mapping

Update GitHub / Linear first when the information changes live project truth

Commit to the knowledge base repo for durable long-form additions


Operate customer billing workflows such as subscriptions, refunds, churn triage, billing-portal recovery, and plan analysis using connected billing tools like Stripe. Use when the user needs to help a customer, inspect subscription state, or manage revenue-impacting billing operations.

Customer Billing Ops

Use this skill for real customer operations, not generic payment API design.

The goal is to help the operator answer: who is this customer, what happened, what is the safest fix, and what follow-up should we send?


Patterns and architectures for autonomous Claude Code loops — from simple sequential pipelines to RFC-driven multi-agent DAG systems.

When to Use

Setting up autonomous development workflows that run without human intervention

Choosing the right loop architecture for your problem (simple vs complex)

Building CI/CD-style continuous development pipelines

Running parallel agents with merge coordination

Implementing context persistence across loop iterations

Adding quality gates and cleanup passes to autonomous workflows


Go testing patterns including table-driven tests, subtests, benchmarks, fuzzing, and test coverage. Follows TDD methodology with idiomatic Go practices.

TDD Workflow for Go

The RED-GREEN-REFACTOR Cycle

Step-by-Step TDD in Go

Table-Driven Tests

The standard pattern for Go tests. Enables comprehensive coverage with minimal code.


Laravel architecture patterns, routing/controllers, Eloquent ORM, service layers, queues, events, caching, and API resources for production apps.

Laravel Development Patterns
Examples
Route Model Binding (Scoped)

Route Model Binding (Scoped)

Use scoped bindings to prevent cross-tenant access.


Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies.

Perl Security Patterns
Safe Regular Expressions
ReDoS Prevention

Length Constraints

Safe Regular Expressions

ReDoS Prevention

Catastrophic backtracking occurs with nested quantifiers on overlapping patterns.


Production Scheduling
Communication Patterns
Tone Calibration

Communication Patterns

Tone Calibration

**Daily schedule publication:** Clear, structured, no ambiguity. Job sequence, start times, line assignments, operator assignments. Use table format. The shop floor does not read paragraphs.

**Schedule change notification:** Urgent header, reason for change, specific jobs affected, new sequence and timing. "Effective immediately" or "effective at [time]."

**Disruption escalation:** Lead with impact magnitude (hours of constraint time lost, number of customer orders at risk), then cause, then proposed response, then decision needed from management.

**Overtime request:** Quantify the business case — cost of overtime vs. cost of missed deliveries. Include union rule compliance. "Requesting 4 hours voluntary OT for CNC operators (3 personnel) on Saturday AM. Cost: $1,200. At-risk revenue without OT: $45,000."

**Customer delivery impact notice:** Never surprise the customer. As soon as a delay is likely, notify with the new estimated date, root cause (without blaming internal teams), and recovery plan. "Due to an equipment issue, order #12345 will ship [new date] vs. the original [old date]. We are running overtime to minimize the delay."

**Maintenance coordination:** Specific window requested, business justification for the timing, impact if maintenance is deferred. "Requesting PM window on Line 3, Tuesday 06:00–10:00. This avoids the Thursday changeover peak. Deferring past Friday risks an unplanned breakdown — vibration readings are trending into the caution zone."

Brief templates appear above. Adapt them to your plant, planner, and customer-commitment workflows before using them in production.


Library-agnostic Flutter/Dart code review checklist covering widget best practices, state management patterns (BLoC, Riverpod, Provider, GetX, MobX, Signals), Dart idioms, performance, accessibility, security, and clean architecture.

11. Navigation and Routing

General principles (apply to any routing solution):

[ ] One routing approach used consistently — no mixing imperative `Navigator.push` with a declarative router

[ ] Route arguments are typed — no `Map<String, dynamic>` or `Object?` casting

[ ] Route paths defined as constants, enums, or generated — no magic strings scattered in code

[ ] Auth guards/redirects centralized — not duplicated across individual screens

[ ] Deep links configured for both Android and iOS

[ ] Deep link URLs validated and sanitized before navigation

[ ] Navigation state is testable — route changes can be verified in tests

[ ] Back behavior is correct on all platforms


Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.

Django Security Best Practices
Authentication
Custom User Model

Core Security Settings

Production Settings Configuration

Authentication

Custom User Model


HIPAA-specific entrypoint for healthcare privacy and security work. Use when a task is explicitly framed around HIPAA, PHI handling, covered entities, BAAs, breach posture, or US healthcare compliance requirements.

HIPAA Compliance
HIPAA-Specific Guardrails

HIPAA-Specific Guardrails

Never place PHI in logs, analytics events, crash reports, prompts, or client-visible error strings.

Never expose PHI in URLs, browser storage, screenshots, or copied example payloads.

Require authenticated access, scoped authorization, and audit trails for PHI reads and writes.

Treat third-party SaaS, observability, support tooling, and LLM providers as blocked-by-default until BAA status and data boundaries are clear.

Follow minimum necessary access: the right user should only see the smallest PHI slice needed for the task.

Prefer opaque internal IDs over names, MRNs, phone numbers, addresses, or other identifiers.


Clinical Decision Support System (CDSS) development patterns. Drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), alert severity classification, and integration into EMR workflows.

Healthcare CDSS Development Patterns
Examples
Example 3: NEWS2 Scoring

Examples

Example 1: Drug Interaction Check

Example 2: Dose Validation

Example 3: NEWS2 Scoring


AI-native lead intelligence and outreach pipeline. Replaces Apollo, Clay, and ZoomInfo with agent-powered signal scoring, mutual ranking, warm path discovery, source-derived voice modeling, and channel-specific outreach across email, LinkedIn, and X. Use when the user wants to find, qualify, and reach high-value contacts.

Lead Intelligence
Stage 5: Outreach Draft
Anti-Patterns

Anti-Patterns

generic templates with no personalization

long paragraphs explaining your whole company

multiple asks in one message

fake familiarity without specifics

bulk-sent messages with visible merge fields

identical copy reused for email, LinkedIn, and X

platform-shaped slop instead of the author's actual voice


Evidence-first current-state research workflow for ECC. Use when the user wants fresh facts, comparisons, enrichment, or a recommendation built from current public evidence and any supplied local context.

Skill Stack

Pull these ECC-native skills into the workflow when relevant:

`exa-search` for fast current-web discovery

`deep-research` for multi-source synthesis with citations

`market-research` when the end result should be a recommendation or ranked decision

`lead-intelligence` when the task is people/company targeting instead of generic research

`knowledge-ops` when the result should be stored in durable context afterward


Create and update pitch decks, one-pagers, investor memos, accelerator applications, financial models, and fundraising materials. Use when the user needs investor-facing documents, projections, use-of-funds tables, milestone plans, or materials that must stay internally consistent across multiple fundraising assets.

Quality Gate

Before delivering:

every number matches the current source of truth

use of funds and revenue layers sum correctly

assumptions are visible, not buried

the story is clear without hype language

the final asset is defensible in a partner meeting


Apple FoundationModels framework for on-device LLM — text generation, guided generation with @Generable, tool calling, and snapshot streaming in iOS 26+.

FoundationModels: On-Device LLM (iOS 26)

SwiftUI Integration

Key Design Decisions

| Decision | Rationale |
|----------|-----------|
| On-device execution | Privacy — no data leaves the device; works offline |
| 4,096 token limit | On-device model constraint; chunk large data across sessions |
| Snapshot streaming (not deltas) | Structured output friendly; each snapshot is a complete partial state |
| `@Generable` macro | Compile-time safety for structured generation; auto-generates `PartiallyGenerated` type |
| Single request per session | `isResponding` prevents concurrent requests; create multiple sessions if needed |
| `response.content` (not `.output`) | Correct API — always access results via `.content` property |


Persistent per-project memory for Claude Code. Auto-loads project context on session start, tracks sessions with git activity, and writes to native memory. Commands run deterministic Node.js scripts — behavior is consistent across model versions.

`/ck:resume [name|number]` — Full Briefing

Display output verbatim. Then ask: "Continue from here? Or has anything changed?"
If user reports changes → run `/ck:save` immediately.


Structured self-debugging workflow for AI agent failures using capture, diagnosis, contained recovery, and introspection reports.

Agent Introspection Debugging
Integration with ECC

Integration with ECC

Use `verification-loop` after recovery if code was changed.

Use `continuous-learning-v2` when the failure pattern is worth turning into an instinct or later skill.

Use `council` when the issue is not technical failure but decision ambiguity.

Use `workspace-surface-audit` if the failure came from conflicting local state or repo drift.


Regression testing strategies for AI-assisted development. Sandbox-mode API testing without database dependencies, automated bug-check workflows, and patterns to catch AI blind spots where the same model writes and reviews code.

AI Regression Testing

Testing patterns specifically designed for AI-assisted development, where the same model writes code and reviews it — creating systematic blind spots that only automated tests can catch.


Backend architecture patterns, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes.

Backend Development Patterns
Rate Limiting
Simple In-Memory Rate Limiter

JWT Token Validation

Role-Based Access Control

Rate Limiting

Simple In-Memory Rate Limiter


Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Links

**GitHub**: [github.com/affaan-m/agentshield](https://github.com/affaan-m/agentshield)

**npm**: [npmjs.com/package/ecc-agentshield](https://www.npmjs.com/package/ecc-agentshield)


Build reusable Manim explainers for technical concepts, graphs, system diagrams, and product walkthroughs, then hand off to the wider ECC video stack if needed. Use when the user wants a clean animated explainer rather than a generic talking-head script.

Render Conventions

default to 16:9 landscape unless the user asks for vertical

start with a low-quality smoke test render

only push to higher quality after composition and timing are stable

export one clean thumbnail frame that reads at social size


Engineering operating model for teams where AI agents generate a large share of implementation output.

AI-First Engineering

Use this skill when designing process, reviews, and architecture for teams shipping with AI-assisted code generation.


Analyze raw prompts, identify intent and gaps, match ECC components (skills/commands/agents/hooks), and output a ready-to-paste optimized prompt. Advisory role only — never executes the task itself. TRIGGER when: user says "optimize prompt", "improve my prompt", "how to write a prompt for", "help me prompt", "rewrite this prompt", or explicitly asks to enhance prompt quality. Also triggers on Chinese equivalents: "优化prompt", "改进prompt", "怎么写prompt", "帮我优化这个指令". DO NOT TRIGGER when: user wants the task executed directly, or says "just do it" / "直接做". DO NOT TRIGGER when user says "优化代码", "优化性能", "optimize performance", "optimize this code" — those are refactoring/performance tasks, not prompt optimization.

Example 1: Vague Chinese Prompt (Project Detected)

**User input:**

**Phase 0 detects:** `package.json` with Next.js 15, TypeScript, Tailwind CSS

**Optimized Prompt (Full):**


Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

Spring Boot Security Review
Authorization

Authorization

Enable method security: `@EnableMethodSecurity`

Use `@PreAuthorize("hasRole('ADMIN')")` or `@PreAuthorize("@authz.canEdit(#id)")`

Deny by default; expose only required scopes


Django testing strategies with pytest-django, TDD methodology, factory_boy, mocking, coverage, and testing Django REST Framework APIs.

Quick Reference

| Pattern | Usage |
|---------|-------|
| `@pytest.mark.django_db` | Enable database access |
| `client` | Django test client |
| `api_client` | DRF API client |
| `factory.create_batch(n)` | Create multiple objects |
| `patch('module.function')` | Mock external dependencies |
| `override_settings` | Temporarily change settings |
| `force_authenticate()` | Bypass authentication in tests |
| `assertRedirects` | Check for redirects |
| `assertTemplateUsed` | Verify template usage |
| `mail.outbox` | Check sent emails |

Remember: Tests are documentation. Good tests explain how your code should work. Keep them simple, readable, and maintainable.


Patterns and architectures for autonomous Claude Code loops — from simple sequential pipelines to RFC-driven multi-agent DAG systems.

Autonomous Loops Skill
1. Sequential Pipeline (`claude -p`)
Variations

Variations

**With model routing:**

**With environment context:**

**With `--allowedTools` restrictions:**


GAN-inspired Generator-Evaluator agent harness for building high-quality applications autonomously. Based on Anthropic's March 2026 harness design paper.

GAN-Style Harness Skill
Results: What to Expect

Results: What to Expect

Based on Anthropic's published results:

| Metric | Solo Agent | GAN Harness | Improvement |
|--------|-----------|-------------|-------------|
| Time | 20 min | 4-6 hours | 12-18x longer |
| Cost | $9 | $125-200 | 14-22x more |
| Quality | Barely functional | Production-ready | Phase change |
| Core features | Broken | All working | N/A |
| Design | Generic AI slop | Distinctive, polished | N/A |

**The tradeoff is clear:** ~20x more time and cost for a qualitative leap in output quality. This is for projects where quality matters.


Codified expertise for handling freight exceptions, shipment delays, damages, losses, and carrier disputes. Informed by logistics professionals with 15+ years operational experience. Includes escalation protocols, carrier-specific behaviors, claims procedures, and judgment frameworks. Use when handling shipping exceptions, freight claims, delivery issues, or carrier disputes.

Logistics Exception Management
Escalation Protocols
Automatic Escalation Triggers

Escalation Protocols

Automatic Escalation Triggers

| Trigger | Action | Timeline |
|---|---|---|
| Exception value > $25,000 | Notify VP Supply Chain immediately | Within 1 hour |
| Enterprise customer affected | Assign dedicated handler, notify account team | Within 2 hours |
| Carrier non-response | Escalate to carrier account manager | After 4 hours |
| Repeated carrier (3+ in 30 days) | Carrier performance review with procurement | Within 1 week |
| Potential fraud indicators | Notify compliance and halt standard processing | Immediately |
| Temperature excursion on regulated product | Notify quality/regulatory team | Within 30 minutes |
| No scan update on high-value (> $50K) | Initiate trace protocol and notify security | After 24 hours |
| Claims denied > $10,000 | Legal review of denial basis | Within 48 hours |


X/Twitter API integration for posting tweets, threads, reading timelines, search, and analytics. Covers OAuth auth patterns, rate limits, and platform-native content posting. Use when the user wants to interact with X programmatically.

When to Activate

User wants to post tweets or threads programmatically

Reading timeline, mentions, or user data from X

Searching X for content, trends, or conversations

Building X integrations or bots

Analytics and engagement tracking

User says "post to X", "tweet", "X API", or "Twitter API"


Add x402 payment execution to AI agents — per-task budgets, spending controls, and non-custodial wallets via MCP tools. Use when agents need to pay for APIs, services, or other agents.

Agent Payment Execution (x402)
When to Use

When to Use

Use when: your agent needs to pay for an API call, purchase a service, settle with another agent, enforce per-task spending limits, or manage a non-custodial wallet. Pairs naturally with cost-aware-llm-pipeline and security-review skills.


Codified expertise for quality control, non-conformance investigation, root cause analysis, corrective action, and supplier quality management in regulated manufacturing. Informed by quality engineers with 15+ years experience across FDA, IATF 16949, and AS9100 environments. Includes NCR lifecycle management, CAPA systems, SPC interpretation, and audit methodology. Use when investigating non-conformances, performing root cause analysis, managing CAPAs, interpreting SPC data, or handling supplier quality issues.

Quality & Non-Conformance Management
When to Use

When to Use

Investigating a non-conformance (NCR) from incoming inspection, in-process, or final test

Performing root cause analysis using 5-Why, Ishikawa, or fault tree methods

Determining disposition for non-conforming material (use-as-is, rework, scrap, return to vendor)

Creating or reviewing a CAPA (Corrective and Preventive Action) plan

Interpreting SPC data and control chart signals for process stability assessment

Preparing for or responding to a regulatory audit finding


Audits Claude Code context window consumption across agents, skills, MCP servers, and rules. Identifies bloat, redundant components, and produces prioritized token-savings recommendations.

When to Use

Session performance feels sluggish or output quality is degrading

You've recently added many skills, agents, or MCP servers

You want to know how much context headroom you actually have

Planning to add more components and need to know if there's room

Running `/context-budget` command (this skill backs it)


Docker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration.

Docker Patterns
Volume Strategies
Common Patterns

Custom Networks

Exposing Only What's Needed

Volume Strategies

Common Patterns


Quality & Non-Conformance Management
Communication Patterns
Tone Calibration

Communication Patterns

Tone Calibration

Match communication tone to situation severity and audience:

**Routine NCR, internal team:** Direct and factual. "NCR-2025-0412: Incoming lot 4471 of part 7832-A has OD measurements at 12.52mm against a 12.45±0.05mm specification. 18 of 50 sample pieces out of spec. Material quarantined in MRB cage, Bay 3."

**Significant NCR, management reporting:** Summarize impact first — production impact, customer risk, financial exposure — then the details. Managers need to know what it means before they need to know what happened.

**Supplier notification (SCAR):** Professional, specific, and documented. State the nonconformance, the specification violated, the impact, and the expected response format and timeline. Never accusatory; the data speaks.

**Customer notification (non-conformance on shipped product):** Lead with what you know, what you've done (containment), what the customer needs to do, and the timeline for full resolution. Transparency builds trust; delay destroys it.

**Regulatory response (audit finding):** Factual, accountable, and structured per the regulatory expectation (e.g., FDA Form 483 response format). Acknowledge the observation, describe the investigation, state the corrective action, provide evidence of implementation and effectiveness.


Codified expertise for returns authorization, receipt and inspection, disposition decisions, refund processing, fraud detection, and warranty claims management. Informed by returns operations managers with 15+ years experience. Includes grading frameworks, disposition economics, fraud pattern recognition, and vendor recovery processes. Use when handling product returns, reverse logistics, refund decisions, return fraud detection, or warranty claims.

Returns & Reverse Logistics
Core Knowledge
Fraud Detection

Fraud Detection

Return fraud costs US retailers $24B+ annually. The challenge is detection without creating friction for legitimate customers:

**Wardrobing (wear and return):** Customer buys apparel or accessories, wears them for an event, returns them. Indicators: returns clustered around holidays/events, deodorant residue, makeup on collars, creased/stretched fabric inconsistent with "tried on." Countermeasure: black-light inspection for cosmetic traces, RFID security tags that customers aren't instructed to remove (if the tag is missing, the item was worn).

**Receipt fraud:** Using found, stolen, or fabricated receipts to return shoplifted merchandise for cash. Declining as digital receipt lookup replaces paper, but still occurs. Countermeasure: require ID for all cash refunds, match return to original payment method, limit no-receipt returns per ID.

**Swap fraud (return switching):** Returning a counterfeit, cheaper, or broken item in the packaging of a purchased item. Common in electronics (returning a used phone in a new phone box) and cosmetics (refilling a container with a cheaper product). Countermeasure: serial number verification at return, weight check against expected product weight, detailed inspection of high-value items before processing refund.

**Serial returners:** Customers with return rates > 30% of purchases or > $5,000 in annual returns. Not all are fraudulent — some are genuinely indecisive or bracket-shopping (buying multiple sizes to try). Segment by: return reason consistency, product condition at return, net lifetime value after returns. A customer with $50K in purchases and $18K in returns (36% rate) but $32K net revenue is worth more than a customer with $15K in purchases and zero returns.

**Bracketing:** Intentionally ordering multiple sizes/colours with the plan to return most. Legitimate shopping behavior that becomes costly at scale. Address through fit technology (size recommendation tools, AR try-on), generous exchange policies (free exchange, restocking fee on return), and education rather than punishment.

**Price arbitrage:** Purchasing during promotions/discounts, then returning at a different location or time for full-price credit. Policy must tie refund to actual purchase price regardless of current selling price. Cross-channel returns are the primary vector.

**Organised retail crime (ORC):** Coordinated theft-and-return operations across multiple stores/identities. Indicators: high-value returns from multiple IDs at the same address, returns of commonly shoplifted categories (electronics, cosmetics, health), geographic clustering. Report to LP (loss prevention) team — this is beyond standard returns operations.


Security Scan Skill
Usage
Output Formats

Basic Scan

Run against the current project's `.claude/` directory:

Output Formats


Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies.

Perl Security Patterns
Quick Security Checklist

Security Tooling

perlcritic Security Policies

Running perlcritic

Quick Security Checklist

| Check | What to Verify |
|---|---|
| Taint mode | `-T` flag on CGI/web scripts |
| Input validation | Allowlist patterns, length limits |
| File operations | Three-arg open, path traversal checks |
| Process execution | List-form system, no shell interpolation |
| SQL queries | DBI placeholders, never interpolate |
| HTML output | `encode_entities()`, template auto-escape |
| CSRF tokens | Generated, verified on state-changing requests |
| Session config | Secure, HttpOnly, SameSite cookies |
| HTTP headers | CSP, X-Frame-Options, HSTS |
| Dependencies | Pinned versions, audited modules |
| Regex safety | No nested quantifiers, anchored patterns |
| Error messages | No stack traces or paths leaked to users |


Java coding standards for Spring Boot services: naming, immutability, Optional usage, streams, exceptions, generics, and project layout.

Java Coding Standards
Formatting and Style

Project Structure (Maven/Gradle)

Formatting and Style

Use 2 or 4 spaces consistently (project standard)

One public top-level type per file

Keep methods short and focused; extract helpers

Order members: constants, fields, constructors, public methods, protected, private


Multi-platform content distribution across X, LinkedIn, Threads, and Bluesky. Adapts content per platform using content-engine patterns. Never posts identical content cross-platform. Use when the user wants to distribute content across social platforms.

Bluesky

keep it concise

preserve the author's cadence

do not rely on hashtags or feed-gaming language


Test-driven development for Laravel with PHPUnit and Pest, factories, database testing, fakes, and coverage targets.

Laravel TDD Workflow
How It Works
Database Strategy

Database Strategy

`RefreshDatabase` for most feature/integration tests (runs migrations once per test run, then wraps each test in a transaction when supported; in-memory databases may re-migrate per test)

`DatabaseTransactions` when the schema is already migrated and you only need per-test rollback

`DatabaseMigrations` when you need a full migrate/fresh for every test and can afford the cost

Use `RefreshDatabase` as the default for tests that touch the database: for databases with transaction support, it runs migrations once per test run (via a static flag) and wraps each test in a transaction; for `:memory:` SQLite or connections without transactions, it migrates before each test. Use `DatabaseTransactions` when the schema is already migrated and you only need per-test rollbacks.


Laravel TDD Workflow
Examples
Inertia Feature Tests

Authorization Tests

Inertia Feature Tests

When using Inertia.js, assert on the component name and props with the Inertia testing helpers.

Prefer `assertInertia` over raw JSON assertions to keep tests aligned with Inertia responses.


Library-agnostic Flutter/Dart code review checklist covering widget best practices, state management patterns (BLoC, Riverpod, Provider, GetX, MobX, Signals), Dart idioms, performance, accessibility, security, and clean architecture.

Flutter/Dart Code Review Best Practices
4. State Management (Library-Agnostic)
Architecture:

Architecture:

[ ] Business logic lives outside the widget layer — in a state management component (BLoC, Notifier, Controller, Store, ViewModel, etc.)

[ ] State managers receive dependencies via injection, not by constructing them internally

[ ] A service or repository layer abstracts data sources — widgets and state managers should not call APIs or databases directly

[ ] State managers have a single responsibility — no "god" managers handling unrelated concerns

[ ] Cross-component dependencies follow the solution's conventions:

In **Riverpod**: providers depending on providers via `ref.watch` is expected — flag only circular or overly tangled chains

In **BLoC**: blocs should not directly depend on other blocs — prefer shared repositories or presentation-layer coordination

In other solutions: follow the documented conventions for inter-component communication


Frontend development patterns for React, Next.js, state management, performance optimization, and UI best practices.

Frontend Development Patterns
Custom Hooks Patterns
Debounce Hook

Custom Hooks Patterns

State Management Hook

Async Data Fetching Hook

Debounce Hook


Agent Payment Execution (x402)

Enable AI agents to make autonomous payments with built-in spending controls. Uses the x402 HTTP payment protocol and MCP tools so agents can pay for external services, APIs, or other agents without custodial risk.


Apple FoundationModels framework for on-device LLM — text generation, guided generation with @Generable, tool calling, and snapshot streaming in iOS 26+.

FoundationModels: On-Device LLM (iOS 26)

Best Practices

**Always check `model.availability`** before creating a session — handle all unavailability cases

**Use `instructions`** to guide model behavior — they take priority over prompts

**Check `isResponding`** before sending a new request — sessions handle one request at a time

**Access `response.content`** for results — not `.output`

**Break large inputs into chunks** — 4,096 token limit applies to instructions + prompt + output combined

**Use `@Generable`** for structured output — stronger guarantees than parsing raw strings

**Use `GenerationOptions(temperature:)`** to tune creativity (higher = more creative)

**Monitor with Instruments** — use Xcode Instruments to profile request performance


Convene a four-voice council for ambiguous decisions, tradeoffs, and go/no-go calls. Use when multiple valid paths exist and you need structured disagreement before choosing.

Council
Workflow
5. Synthesize with bias guardrails

5. Synthesize with bias guardrails

You are both a participant and the synthesizer, so use these rules:

do not dismiss an external view without explaining why

if an external voice changed your recommendation, say so explicitly

always include the strongest dissent, even if you reject it

if two voices align against your initial position, treat that as a real signal

keep the raw positions visible before the verdict


A comprehensive verification system for Claude Code sessions.

Verification Loop Skill
Integration with Hooks

Integration with Hooks

This skill complements PostToolUse hooks but provides deeper verification.
Hooks catch issues immediately; this skill provides comprehensive review.


Go testing patterns including table-driven tests, subtests, benchmarks, fuzzing, and test coverage. Follows TDD methodology with idiomatic Go practices.

When to Activate

Writing new Go functions or methods

Adding test coverage to existing code

Creating benchmarks for performance-critical code

Implementing fuzz tests for input validation

Following TDD workflow in Go projects


Build a fully automated AI-powered data collection agent for any public source — job boards, prices, news, GitHub, sports, anything. Scrapes on a schedule, enriches data with a free LLM (Gemini Flash), stores results in Notion/Sheets/Supabase, and learns from user feedback. Runs 100% free on GitHub Actions. Use when the user wants to monitor, collect, or track any public data automatically.

Data Scraper Agent
Anti-Patterns to Avoid

Anti-Patterns to Avoid

| Anti-pattern | Problem | Fix |
|---|---|---|
| One LLM call per item | Hits rate limits instantly | Batch 5 items per call |
| Hardcoded keywords in code | Not reusable | Move all config to `config.yaml` |
| Scraping without rate limit | IP ban | Add `time.sleep(1)` between requests |
| Storing secrets in code | Security risk | Always use `.env` + GitHub Secrets |
| No deduplication | Duplicate rows pile up | Always check URL before pushing |
| Ignoring `robots.txt` | Legal/ethical risk | Respect crawl rules; use public APIs when available |
| JS-rendered sites with `requests` | Empty response | Use Playwright or look for the underlying API |
| `maxOutputTokens` too low | Truncated JSON, parse error | Use 2048+ for batch responses |


Knowledge base management, ingestion, sync, and retrieval across multiple storage layers (local files, MCP memory, vector stores, Git repos). Use when the user wants to save, organize, sync, deduplicate, or search across their knowledge systems.

Layer 3: MCP Memory Server (Structured Knowledge Graph)

**Access:** MCP memory tools (create_entities, create_relations, add_observations, search_nodes)

**Use for:** Semantic search across all stored memories, relationship mapping

**Cross-session persistence with queryable graph structure**


Core Pattern — Basic Session

Key points for instructions:

Define the model's role ("You are a mentor")

Specify what to do ("Help extract calendar events")

Set style preferences ("Respond as briefly as possible")

Add safety measures ("Respond with 'I can't help with that' for dangerous requests")


C++ coding standards based on the C++ Core Guidelines (isocpp.github.io). Use when writing, reviewing, or refactoring C++ code to enforce modern, safe, and idiomatic practices.

C++ Coding Standards (C++ Core Guidelines)

Templates & Generic Programming (T.*)

Key Rules

| Rule | Summary |
|------|---------|
| **T.1** | Use templates to raise the level of abstraction |
| **T.2** | Use templates to express algorithms for many argument types |
| **T.10** | Specify concepts for all template arguments |
| **T.11** | Use standard concepts whenever possible |
| **T.13** | Prefer shorthand notation for simple concepts |
| **T.43** | Prefer `using` over `typedef` |
| **T.120** | Use template metaprogramming only when you really need to |
| **T.144** | Don't specialize function templates (overload instead) |


X/Twitter API integration for posting tweets, threads, reading timelines, search, and analytics. Covers OAuth auth patterns, rate limits, and platform-native content posting. Use when the user wants to interact with X programmatically.

Error Handling

Security

**Never hardcode tokens.** Use environment variables or `.env` files.

**Never commit `.env` files.** Add to `.gitignore`.

**Rotate tokens** if exposed. Regenerate at developer.x.com.

**Use read-only tokens** when write access is not needed.

**Store OAuth secrets securely** — not in source code or logs.


Use this skill when writing new features, fixing bugs, or refactoring code. Enforces test-driven development with 80%+ coverage including unit, integration, and E2E tests.

Test-Driven Development Workflow
Core Principles
2. Coverage Requirements

2. Coverage Requirements

Minimum 80% coverage (unit + integration + E2E)

All edge cases covered

Error scenarios tested

Boundary conditions verified


Idiomatic Kotlin patterns, best practices, and conventions for building robust, efficient, and maintainable Kotlin applications with coroutines, null safety, and DSL builders.

Kotlin Development Patterns
Coroutines
Cancellation and Cleanup

Coroutines

Structured Concurrency

Flow for Reactive Streams

Cancellation and Cleanup


Offers the user an informed choice about how much response depth to consume before answering. Use this skill when the user explicitly wants to control response length, depth, or token budget. TRIGGER when: "token budget", "token count", "token usage", "token limit", "response length", "answer depth", "short version", "brief answer", "detailed answer", "exhaustive answer", "respuesta corta vs larga", "cuántos tokens", "ahorrar tokens", "responde al 50%", "dame la versión corta", "quiero controlar cuánto usas", or clear variants where the user is explicitly asking to control answer size or depth. DO NOT TRIGGER when: user has already specified a level in the current session (maintain it), the request is clearly a one-word answer, or "token" refers to auth/session/payment tokens rather than response size.

Token Budget Advisor (TBA)
Examples
Does Not Trigger

Does Not Trigger

"What is a JWT token?"

"The checkout flow uses a payment token."

"Is this normal?"

"Complete the refactor."

Follow-up questions after the user already chose a depth for the session


Data Scraper Agent
Workflow
Step 1: Understand the Goal

Step 1: Understand the Goal

Ask the user:

**What to collect:** "What data source? URL / API / RSS / public endpoint?"

**What to extract:** "What fields matter? Title, price, URL, date, score?"

**How to store:** "Where should results go? Notion, Google Sheets, Supabase, or local file?"

**How to enrich:** "Do you want AI to score, summarise, classify, or match each item?"

**Frequency:** "How often should it run? Every hour, daily, weekly?"

Common examples to prompt:

Job boards → score relevance to resume

Product prices → alert on drops

GitHub repos → summarise new releases

News feeds → classify by topic + sentiment

Sports results → extract stats to tracker

Events calendar → filter by interest


NestJS architecture patterns for modules, controllers, providers, DTO validation, guards, interceptors, config, and production-grade TypeScript backends.

NestJS Development Patterns
Modules, Controllers, and Providers

Modules, Controllers, and Providers

Controllers should stay thin: parse HTTP input, call a provider, return response DTOs.

Put business logic in injectable services, not controllers.

Export only the providers other modules genuinely need.


Analyze raw prompts, identify intent and gaps, match ECC components (skills/commands/agents/hooks), and output a ready-to-paste optimized prompt. Advisory role only — never executes the task itself. TRIGGER when: user says "optimize prompt", "improve my prompt", "how to write a prompt for", "help me prompt", "rewrite this prompt", or explicitly asks to enhance prompt quality. Also triggers on Chinese equivalents: "优化prompt", "改进prompt", "怎么写prompt", "帮我优化这个指令". DO NOT TRIGGER when: user wants the task executed directly, or says "just do it" / "直接做". DO NOT TRIGGER when user says "优化代码", "优化性能", "optimize performance", "optimize this code" — those are refactoring/performance tasks, not prompt optimization.

How It Works

**Advisory only — do not execute the user's task.**

Do NOT write code, create files, run commands, or take any implementation
action. Your ONLY output is an analysis plus an optimized prompt.

If the user says "just do it", "直接做", or "don't optimize, just execute",
do not switch into implementation mode inside this skill. Tell the user this
skill only produces optimized prompts, and instruct them to make a normal
task request if they want execution instead.

Run this 6-phase pipeline sequentially. Present results using the Output Format below.


Discover and evaluate Laravel packages via LaraPlugins.io MCP. Use when the user wants to find plugins, check package health, or assess Laravel/PHP compatibility.

When to Use

User wants to find Laravel packages for a specific feature (e.g. "auth", "permissions", "admin panel")

User asks "what package should I use for..." or "is there a Laravel package for..."

User wants to check if a package is actively maintained

User needs to verify Laravel version compatibility

User wants to assess package health before adding to a project


Head-to-head comparison of coding agents (Claude Code, Aider, Codex, etc.) on custom tasks with pass rate, cost, time, and consistency metrics

When to Activate

Comparing coding agents (Claude Code, Aider, Codex, etc.) on your own codebase

Measuring agent performance before adopting a new tool or model

Running regression checks when an agent updates its model or tooling

Producing data-backed agent selection decisions for a team


Ktor server patterns including routing DSL, plugins, authentication, Koin DI, kotlinx.serialization, WebSockets, and testApplication testing.

Ktor Server Patterns
testApplication Testing
Testing Authenticated Routes

Request Validation

WebSockets

testApplication Testing

Basic Route Testing

Testing Authenticated Routes


Capture architectural decisions made during Claude Code sessions as structured ADRs. Auto-detects decision moments, records context, alternatives considered, and rationale. Maintains an ADR log so future developers understand why the codebase is shaped the way it is.

Architecture Decision Records
Workflow
Capturing a New ADR

Workflow

Capturing a New ADR

When a decision moment is detected:

**Initialize (first time only)** — if `docs/adr/` does not exist, ask the user for confirmation before creating the directory, a `README.md` seeded with the index table header (see ADR Index Format below), and a blank `template.md` for manual use. Do not create files without explicit consent.

**Identify the decision** — extract the core architectural choice being made

**Gather context** — what problem prompted this? What constraints exist?

**Document alternatives** — what other options were considered? Why were they rejected?

**State consequences** — what are the trade-offs? What becomes easier/harder?

**Assign a number** — scan existing ADRs in `docs/adr/` and increment

**Confirm and write** — present the draft ADR to the user for review. Only write to `docs/adr/NNNN-decision-title.md` after explicit approval. If the user declines, discard the draft without writing any files.

**Update the index** — append to `docs/adr/README.md`


AI-assisted video editing workflows for cutting, structuring, and augmenting real footage. Covers the full pipeline from raw capture through FFmpeg, Remotion, ElevenLabs, fal.ai, and final polish in Descript or CapCut. Use when the user wants to edit video, cut footage, create vlogs, or build video content.

Video Editing
Scene Detection and Auto-Cut
FFmpeg scene detection

Reframe with FFmpeg

Reframe with VideoDB

Scene Detection and Auto-Cut

FFmpeg scene detection


Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies.

Session and Header Security

Output Encoding

Always encode output for its context: `HTML::Entities::encode_entities()` for HTML, `URI::Escape::uri_escape_utf8()` for URLs, `JSON::MaybeXS::encode_json()` for JSON.


Coverage Thresholds

Common Testing Mistakes to Avoid

FAIL: WRONG: Testing Implementation Details


Layer 4: Knowledge base repo / durable document store

**Use for:** curated durable notes, session exports, synthesized research, operator memory, long-form docs

**Rule:** this is the preferred durable store for cross-machine context when the content is not repo-owned code


Baseline cross-project coding conventions for naming, readability, immutability, and code-quality review. Use detailed frontend or backend skills for framework-specific patterns.

Coding Standards & Best Practices
When to Activate

When to Activate

Starting a new project or module

Reviewing code for quality and maintainability

Refactoring existing code to follow conventions

Enforcing naming, formatting, or structural consistency

Setting up linting, formatting, or type-checking rules

Onboarding new contributors to coding conventions


SwiftUI architecture patterns, state management with @Observable, view composition, navigation, performance optimization, and modern iOS/macOS UI best practices.

SwiftUI Patterns
Performance
Equatable Conformance

Equatable Conformance

For views with expensive bodies, conform to `Equatable` to skip unnecessary re-renders:


Kotlin Development Patterns
Anti-Patterns to Avoid

Anti-Patterns to Avoid

**Remember**: Kotlin code should be concise but readable. Leverage the type system for safety, prefer immutability, and use coroutines for concurrency. When in doubt, let the compiler help you.


Use up-to-date library and framework docs via Context7 MCP instead of training data. Activates for setup questions, API references, code examples, or when the user names a framework (e.g. React, Next.js, Prisma).

Documentation Lookup (Context7)
Examples
Example: Prisma query

Example: Prisma query

Call **resolve-library-id** with `libraryName: "Prisma"`, `query: "How do I query with relations?"`.

Select the official Prisma library ID (e.g. `/prisma/prisma`).

Call **query-docs** with that `libraryId` and the query.

Return the Prisma Client pattern (e.g. `include` or `select`) with a short code snippet from the docs.


RFC-driven multi-agent DAG execution pattern with quality gates, merge queues, and work unit orchestration.

Ralphinho RFC Pipeline
Unit Spec Template

Unit Spec Template

Each work unit should include:

`id`

`depends_on`

`scope`

`acceptance_tests`

`risk_level`

`rollback_plan`


Library-agnostic Flutter/Dart code review checklist covering widget best practices, state management patterns (BLoC, Riverpod, Provider, GetX, MobX, Signals), Dart idioms, performance, accessibility, security, and clean architecture.

Flutter/Dart Code Review Best Practices
9. Security
Secure storage:

9. Security

Secure storage:

[ ] Sensitive data (tokens, credentials) stored using platform-secure storage (Keychain on iOS, EncryptedSharedPreferences on Android)

[ ] Never store secrets in plaintext storage

[ ] Biometric authentication gating considered for sensitive operations


Evidence-first automation inventory and overlap audit workflow for ECC. Use when the user wants to know which jobs, hooks, connectors, MCP servers, or wrappers are live, broken, redundant, or missing before fixing anything.

Automation Audit Ops

Use this when the user asks what automations are live, which jobs are broken, where overlap exists, or what tooling and connectors are actually doing useful work right now.

This is an audit-first operator skill. The job is to produce an evidence-backed inventory and a keep / merge / cut / fix-next recommendation set before rewriting anything.


Neural search via Exa MCP for web, code, and company research. Use when the user needs web search, code examples, company intel, people lookup, or AI-powered deep research with Exa's neural search engine.

Exa Search

Neural search for web content, code, companies, and people via the Exa MCP server.


Performance

Use Lazy Containers for Large Collections

`LazyVStack` and `LazyHStack` create views only when visible:


See, Understand, Act on video and audio. See- ingest from local files, URLs, RTSP/live feeds, or live record desktop; return realtime context and playable stream links. Understand- extract frames, build visual/semantic/temporal indexes, and search moments with timestamps and auto-clips. Act- transcode and normalize (codec, fps, resolution, aspect ratio), perform timeline edits (subtitles, text/image overlays, branding, audio overlays, dubbing, translation), generate media assets (image, audio, video), and create real time alerts for events from live streams or desktop capture.

VideoDB Skill
How it works
Running Python code

Running Python code

Before running any VideoDB code, change to the project directory and load environment variables:

This reads `VIDEO_DB_API_KEY` from:

Environment (if already exported)

Project's `.env` file in current directory

If the key is missing, `videodb.connect()` raises `AuthenticationError` automatically.

Do NOT write a script file when a short inline command works.

When writing inline Python (`python -c "..."`), always use properly formatted code — use semicolons to separate statements and keep it readable. For anything longer than ~3 statements, use a heredoc instead:


Visualize whether skills, rules, and agent definitions are actually followed — auto-generates scenarios at 3 prompt strictness levels, runs agents, classifies behavioral sequences, and reports compliance rates with full tool call timelines

skill-comply: Automated Compliance Measurement

Measures whether coding agents actually follow skills, rules, or agent definitions by:

Auto-generating expected behavioral sequences (specs) from any .md file

Auto-generating scenarios with decreasing prompt strictness (supportive → neutral → competing)

Running `claude -p` and capturing tool call traces via stream-json

Classifying tool calls against spec steps using LLM (not regex)

Checking temporal ordering deterministically

Generating self-contained reports with spec, prompts, and timelines


Flutter/Dart Code Review Best Practices
State Management Quick Reference

State Management Quick Reference

The table below maps universal principles to their implementation in popular solutions. Use this to adapt review rules to whichever solution the project uses.

| Principle | BLoC/Cubit | Riverpod | Provider | GetX | MobX | Signals | Built-in |
|-----------|-----------|----------|----------|------|------|---------|----------|
| State container | `Bloc`/`Cubit` | `Notifier`/`AsyncNotifier` | `ChangeNotifier` | `GetxController` | `Store` | `signal()` | `StatefulWidget` |
| UI consumer | `BlocBuilder` | `ConsumerWidget` | `Consumer` | `Obx`/`GetBuilder` | `Observer` | `Watch` | `setState` |
| Selector | `BlocSelector`/`buildWhen` | `ref.watch(p.select(...))` | `Selector` | N/A | computed | `computed()` | N/A |
| Side effects | `BlocListener` | `ref.listen` | `Consumer` callback | `ever()`/`once()` | `reaction` | `effect()` | callbacks |
| Disposal | auto via `BlocProvider` | `.autoDispose` | auto via `Provider` | `onClose()` | `ReactionDisposer` | manual | `dispose()` |
| Testing | `blocTest()` | `ProviderContainer` | `ChangeNotifier` directly | `Get.put` in test | store directly | signal directly | widget test |


Instinct-based learning system that observes sessions via hooks, creates atomic instincts with confidence scoring, and evolves them into skills/commands/agents. v2.1 adds project-scoped instincts to prevent cross-project contamination.

Continuous Learning v2.1 - Instinct
Project Detection

How It Works

Project Detection

The system automatically detects your current project:

**`CLAUDE_PROJECT_DIR` env var** (highest priority)

**`git remote get-url origin`** -- hashed to create a portable project ID (same repo on different machines gets the same ID)

**`git rev-parse --show-toplevel`** -- fallback using repo path (machine-specific)

**Global fallback** -- if no project is detected, instincts go to global scope

Each project gets a 12-character hash ID (e.g., `a1b2c3d4e5f6`). A registry file at `~/.claude/homunculus/projects.json` maps IDs to human-readable names.


Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.

Django Security Best Practices
API Security
Rate Limiting

File Upload Security

File Validation

Secure File Storage

API Security

Rate Limiting


Record polished UI demo videos using Playwright. Use when the user asks to create a demo, walkthrough, screen recording, or tutorial video of a web application. Produces WebM videos with visible cursor, natural pacing, and professional feel.

UI Demo Video Recorder
Phase 2: Rehearse
Why

Why

Silent selector failures are the main reason demo recordings break. Rehearsal catches them before you waste a recording.


Multi-agent adversarial verification with convergence loop. Two independent review agents must both pass before output ships.

Santa Method
Implementation Patterns
Pattern B: Sequential Inline (Fallback)

Pattern B: Sequential Inline (Fallback)

When subagents aren't available, simulate isolation with explicit context resets:

Generate output

New context: "You are Reviewer 1. Evaluate ONLY against this rubric. Find problems."

Record findings verbatim

Clear context completely

New context: "You are Reviewer 2. Evaluate ONLY against this rubric. Find problems."

Compare both reviews, fix, repeat

The subagent pattern is strictly superior — inline simulation risks context bleed between reviewers.


Patterns and architectures for autonomous Claude Code loops — from simple sequential pipelines to RFC-driven multi-agent DAG systems.

Autonomous Loops Skill
4. Continuous Claude PR Loop
Key Configuration

Key Configuration

| Flag | Purpose |
|------|---------|
| `--max-runs N` | Stop after N successful iterations |
| `--max-cost $X` | Stop after spending $X |
| `--max-duration 2h` | Stop after time elapsed |
| `--merge-strategy squash` | squash, merge, or rebase |
| `--worktree <name>` | Parallel execution via git worktrees |
| `--disable-commits` | Dry-run mode (no git operations) |
| `--review-prompt "..."` | Add reviewer pass per iteration |
| `--ci-retry-max N` | Auto-fix CI failures (default: 1) |


Laravel security best practices for authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.

Laravel Security Best Practices
Signed URLs

Signed URLs

Use signed routes for temporary, tamper-proof links.


Automatically extract reusable patterns from Claude Code sessions and save them as learned skills for future use.

Continuous Learning Skill
When to Activate

When to Activate

Setting up automatic pattern extraction from Claude Code sessions

Configuring the Stop hook for session evaluation

Reviewing or curating learned skills in `~/.claude/skills/learned/`

Adjusting extraction thresholds or pattern categories

Comparing v1 (this) vs v2 (instinct-based) approaches


Codified expertise for returns authorization, receipt and inspection, disposition decisions, refund processing, fraud detection, and warranty claims management. Informed by returns operations managers with 15+ years experience. Includes grading frameworks, disposition economics, fraud pattern recognition, and vendor recovery processes. Use when handling product returns, reverse logistics, refund decisions, return fraud detection, or warranty claims.

Returns & Reverse Logistics
Key Edge Cases

Key Edge Cases

These are situations where standard workflows fail. Brief summaries are included here so you can expand them into project-specific playbooks if needed.

**High-value electronics with firmware wiped:** Customer returns a laptop claiming defect, but the unit has been factory-reset and shows 6 months of battery cycle count. The device was used extensively and is now being returned as "defective" — grading must look beyond the clean software state.

**Hazmat return with improper packaging:** Customer returns a product containing lithium batteries or chemicals without the required DOT packaging. Accepting creates regulatory liability; refusing creates a customer service problem. The product cannot go back through standard parcel return shipping.

**Cross-border return with duty implications:** An international customer returns a product that was exported with duty paid. The duty drawback claim requires specific documentation that the customer doesn't have. The return shipping cost may exceed the product value.

**Influencer bulk return post-content-creation:** A social media influencer purchases 20+ items, creates content, returns all but one. Technically within policy, but the brand value was extracted. Restocking challenges compound because unboxing videos show the exact items.

**Warranty claim on product modified by customer:** Customer replaced a component in a product (e.g., upgraded RAM in a laptop), then claims a warranty defect in an unrelated component (e.g., screen failure). The modification may or may not void the warranty for the claimed defect.

**Serial returner who is also a high-value customer:** Customer with $80K annual spend and a 42% return rate. Banning them from returns loses a profitable customer; accepting the behavior encourages continuation. Requires nuanced segmentation beyond simple return rate.

**Return of a recalled product:** Customer returns a product that is subject to an active safety recall. The standard return process is wrong — recalled products follow the recall programme, not the returns programme. Mixing them creates liability and reporting errors.

**Gift receipt return where current price exceeds purchase price:** The gift recipient brings a gift receipt. The item is now selling for $30 more than the gift-giver paid. Policy says refund at purchase price, but the customer sees the shelf price and expects that amount.


Thread-safe data persistence in Swift using actors — in-memory cache with file-backed storage, eliminating data races by design.

Swift Actors for Thread-Safe Persistence

Key Design Decisions

| Decision | Rationale |
|----------|-----------|
| Actor (not class + lock) | Compiler-enforced thread safety, no manual synchronization |
| In-memory cache + file persistence | Fast reads from cache, durable writes to disk |
| Synchronous init loading | Avoids async initialization complexity |
| Dictionary keyed by ID | O(1) lookups by identifier |
| Generic over `Codable & Identifiable` | Reusable across any model type |
| Atomic file writes (`.atomic`) | Prevents partial writes on crash |


Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

Security Review Skill
Security Checklist
1. Secrets Management

Security Checklist

1. Secrets Management

FAIL: NEVER Do This

FAIL: NEVER Do This

PASS: ALWAYS Do This

PASS: ALWAYS Do This

Verification Steps

Verification Steps

[ ] No hardcoded API keys, tokens, or passwords

[ ] All secrets in environment variables

[ ] `.env.local` in .gitignore

[ ] No secrets in git history

[ ] Production secrets in hosting platform (Vercel, Railway)


Convene a four-voice council for ambiguous decisions, tradeoffs, and go/no-go calls. Use when multiple valid paths exist and you need structured disagreement before choosing.

Example

Question:

Likely council shape:

Architect pushes for structural integrity and avoiding a confused surface

Skeptic questions whether the UI is actually the gating factor

Pragmatist asks what can be shipped now without harming trust

Critic focuses on support burden, expectation debt, and rollout confusion

The value is not unanimity. The value is making the disagreement legible before choosing.


Go testing patterns including table-driven tests, subtests, benchmarks, fuzzing, and test coverage. Follows TDD methodology with idiomatic Go practices.

Go Testing Patterns
Test Helpers
Temporary Files and Directories

Parallel Subtests

Test Helpers

Helper Functions

Temporary Files and Directories


Build a fully automated AI-powered data collection agent for any public source — job boards, prices, news, GitHub, sports, anything. Scrapes on a schedule, enriches data with a free LLM (Gemini Flash), stores results in Notion/Sheets/Supabase, and learns from user feedback. Runs 100% free on GitHub Actions. Use when the user wants to monitor, collect, or track any public data automatically.

Data Scraper Agent
Common Scraping Patterns
Pattern 1: REST API (easiest)

Step 10: config.yaml Template

Common Scraping Patterns

Pattern 1: REST API (easiest)


Apple FoundationModels framework for on-device LLM — text generation, guided generation with @Generable, tool calling, and snapshot streaming in iOS 26+.

FoundationModels: On-Device LLM (iOS 26)

Core Pattern — Guided Generation with @Generable

1. Define a Generable Type

2. Request Structured Output

Supported @Guide Constraints

`.range(0...20)` — numeric range

`.count(3)` — array element count

`description:` — semantic guidance for generation


Use this skill to automate visual testing and UI interaction verification using browser automation after deploying features.

Browser QA — Automated Visual Testing & Interaction

When to Use

After deploying a feature to staging/preview

When you need to verify UI behavior across pages

Before shipping — confirm layouts, forms, interactions actually work

When reviewing PRs that touch frontend code

Accessibility audits and responsive testing


Library-agnostic Flutter/Dart code review checklist covering widget best practices, state management patterns (BLoC, Riverpod, Provider, GetX, MobX, Signals), Dart idioms, performance, accessibility, security, and clean architecture.

Key rules to verify regardless of lint package:

[ ] `prefer_const_constructors` — performance in widget trees

[ ] `avoid_print` — use proper logging

[ ] `unawaited_futures` — prevent fire-and-forget async bugs

[ ] `prefer_final_locals` — immutability at variable level

[ ] `always_declare_return_types` — explicit contracts

[ ] `avoid_catches_without_on_clauses` — specific error handling

[ ] `always_use_package_imports` — consistent import style


Scan skills to extract cross-cutting principles and distill them into rules — append, revise, or create new rule files

Rules Distill

Scan installed skills, extract cross-cutting principles that appear in multiple skills, and distill them into rules — appending to existing rule files, revising outdated content, or creating new rule files.

Applies the "deterministic collection + LLM judgment" principle: scripts collect facts exhaustively, then an LLM cross-reads the full context and produces verdicts.


Codified expertise for demand forecasting, safety stock optimization, replenishment planning, and promotional lift estimation at multi-location retailers. Informed by demand planners with 15+ years experience managing hundreds of SKUs. Includes forecasting method selection, ABC/XYZ analysis, seasonal transition management, and vendor negotiation frameworks. Use when forecasting demand, setting safety stock, planning replenishment, managing promotions, or optimizing inventory levels.

Examples

**Seasonal promotion planning**: Merchandising plans a 3-week BOGO promotion on a top-20 SKU. Estimate promotional lift using historical promo elasticity, calculate the forward buy quantity, coordinate with the vendor on advance PO and logistics capacity, and plan the post-promo demand dip.

**New SKU launch**: No demand history available. Use analog SKU mapping (similar category, price point, brand) to generate an initial forecast, set conservative safety stock at 2 weeks of projected sales, and define the review cadence for the first 8 weeks.

**DC replenishment under lead time change**: Key vendor extends lead time from 14 to 21 days due to port congestion. Recalculate safety stock across all affected SKUs, identify which are at risk of stockout before the new POs arrive, and recommend bridge orders or substitute sourcing.


Returns & Reverse Logistics
Communication Patterns
Tone Calibration

Communication Patterns

Tone Calibration

**Standard refund confirmation:** Warm, efficient. Lead with the resolution amount and timeline, not the process.

**Denial of return:** Empathetic but clear. Explain the specific policy, offer alternatives (exchange, store credit, warranty claim), provide escalation path. Never leave the customer with no options.

**Fraud investigation hold:** Neutral, factual. "We need additional time to process your return" — never say "fraud" or "investigation" to the customer. Provide a timeline. Internal communications are where you document the fraud indicators.

**Restocking fee explanation:** Transparent. Explain what the fee covers (inspection, repackaging, value loss) and confirm the net refund amount before processing so there are no surprises.

**Vendor RTV claim:** Professional, evidence-based. Include defect data, photos, return volumes by SKU, and reference the vendor agreement section that covers defect claims.


Unified media generation via fal.ai MCP — image, video, and audio. Covers text-to-image (Nano Banana), text/image-to-video (Seedance, Kling, Veo 3), text-to-speech (CSM-1B), and video-to-audio (ThinkSound). Use when the user wants to generate images, videos, or audio with AI.

Related Skills

`videodb` — Video processing, editing, and streaming

`video-editing` — AI-powered video editing workflows

`content-engine` — Content creation for social platforms


REST API design patterns including resource naming, status codes, pagination, filtering, error responses, versioning, and rate limiting for production APIs.

API Design Patterns
Response Format
Collection Response (with Pagination)

Status Code Reference

Common Mistakes

Response Format

Success Response

Collection Response (with Pagination)


Idiomatic C# and .NET patterns, conventions, dependency injection, async/await, and best practices for building robust, maintainable .NET applications.

Repository Pattern with EF Core

Middleware and Pipeline

Minimal API Patterns

Guard Clauses


Translate PRD intent, roadmap asks, or product discussions into an implementation-ready capability plan that exposes constraints, invariants, interfaces, and unresolved decisions before multi-service work starts. Use when the user needs an ECC-native PRD-to-SRS lane instead of vague planning prose.

Canonical Artifact

If the repo has a durable product-context file such as `PRODUCT.md`, `docs/product/`, or a program-spec directory, update it there.

If no capability manifest exists yet, create one using the template at:

`docs/examples/product-capability-template.md`

The goal is not to create another planning stack. The goal is to make hidden capability constraints durable and reusable.


Engineering operating model for teams where AI agents generate a large share of implementation output.

Process Shifts

Planning quality matters more than typing speed.

Eval coverage matters more than anecdotal confidence.

Review focus shifts from syntax to system behavior.


Flutter/Dart Code Review Best Practices
1. General Project Health

1. General Project Health

[ ] Project follows consistent folder structure (feature-first or layer-first)

[ ] Proper separation of concerns: UI, business logic, data layers

[ ] No business logic in widgets; widgets are purely presentational

[ ] `pubspec.yaml` is clean — no unused dependencies, versions pinned appropriately

[ ] `analysis_options.yaml` includes a strict lint set with strict analyzer settings enabled

[ ] No `print()` statements in production code — use `dart:developer` `log()` or a logging package

[ ] Generated files (`.g.dart`, `.freezed.dart`, `.gr.dart`) are up-to-date or in `.gitignore`

[ ] Platform-specific code isolated behind abstractions


Trace every user-facing button/touchpoint through its full state change sequence to find bugs where functions individually work but cancel each other out, produce wrong final state, or leave the UI in an inconsistent state. Use when: systematic debugging found no bugs but users report broken buttons, or after any major refactor touching shared state stores.

/click-path-audit — Behavioural Flow Audit

Integration with Other Skills

Run AFTER `/superpowers:systematic-debugging` (which finds the other 54 bug types)

Run BEFORE `/superpowers:verification-before-completion` (which verifies fixes work)

Feeds into `/superpowers:test-driven-development` — every bug found here should get a test


Verification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness.

Laravel Verification Loop
Phase 1: Environment Checks

Phase 1: Environment Checks

Verify `.env` is present and required keys exist

Confirm `APP_DEBUG=false` for production environments

Confirm `APP_ENV` matches the target deployment (`production`, `staging`)

If using Laravel Sail locally:


Codified expertise for production scheduling, job sequencing, line balancing, changeover optimization, and bottleneck resolution in discrete and batch manufacturing. Informed by production schedulers with 15+ years experience. Includes TOC/drum-buffer-rope, SMED, OEE analysis, disruption response frameworks, and ERP/MES interaction patterns. Use when scheduling production, resolving bottlenecks, optimizing changeovers, responding to disruptions, or balancing manufacturing lines.

Production Scheduling

Role and Context

You are a senior production scheduler at a discrete and batch manufacturing facility operating 3–8 production lines with 50–300 direct-labor headcount per shift. You manage job sequencing, line balancing, changeover optimization, and disruption response across work centers that include machining, assembly, finishing, and packaging. Your systems include an ERP (SAP PP, Oracle Manufacturing, or Epicor), a finite-capacity scheduling tool (Preactor, PlanetTogether, or Opcenter APS), an MES for shop floor execution and real-time reporting, and a CMMS for maintenance coordination. You sit between production management (which owns output targets and headcount), planning (which releases work orders from MRP), quality (which gates product release), and maintenance (which owns equipment availability). Your job is to translate a set of work orders with due dates, routings, and BOMs into a minute-by-minute execution sequence that maximizes throughput at the constraint while meeting customer delivery commitments, labor rules, and quality requirements.


EMR/EHR development patterns for healthcare applications. Clinical safety, encounter workflows, prescription generation, clinical decision support integration, and accessibility-first UI for medical data entry.

Healthcare EMR Development Patterns
Examples
Example 3: Locked Encounter + Addendum


Use only when writing/updating/fixing C++ tests, configuring GoogleTest/CTest, diagnosing failing or flaky tests, or adding coverage/sanitizers.

C++ Testing (Agent Skill)
Best Practices
Common Pitfalls

Common Pitfalls

**Using fixed temp paths** → Generate unique temp directories per test and clean them.

**Relying on wall clock time** → Inject a clock or use fake time sources.

**Flaky concurrency tests** → Use condition variables/latches and bounded waits.

**Hidden global state** → Reset global state in fixtures or remove globals.

**Over-mocking** → Prefer fakes for stateful behavior and only mock interactions.

**Missing sanitizer runs** → Add ASan/UBSan/TSan builds in CI.

**Coverage on debug-only builds** → Ensure coverage targets use consistent flags.


Write-time code quality enforcement using Plankton — auto-formatting, linting, and Claude-powered fixes on every file edit via hooks.

Plankton Code Quality Skill
Pairing with ECC
Complementary, Not Overlapping

Pairing with ECC

Complementary, Not Overlapping

| Concern | ECC | Plankton |
|---------|-----|----------|
| Code quality enforcement | PostToolUse hooks (Prettier, tsc) | PostToolUse hooks (20+ linters + subprocess fixes) |
| Security scanning | AgentShield, security-reviewer agent | Bandit (Python), Semgrep (TypeScript) |
| Config protection | — | PreToolUse blocks + Stop hook detection |
| Package manager | Detection + setup | Enforcement (blocks legacy PMs) |
| CI integration | — | Pre-commit hooks for git |
| Model routing | Manual (`/model opus`) | Automatic (violation complexity → tier) |


Analyze an unfamiliar codebase and generate a structured onboarding guide with architecture map, key entry points, conventions, and a starter CLAUDE.md. Use when joining a new project or setting up Claude Code for the first time in a repo.

Codebase Onboarding
How It Works
Phase 3: Convention Detection

Phase 3: Convention Detection

Identify patterns the codebase already follows:

**Naming Conventions**

File naming: kebab-case, camelCase, PascalCase, snake_case

Component/class naming patterns

Test file naming: `*.test.ts`, `*.spec.ts`, `*_test.go`

**Code Patterns**

Error handling style: try/catch, Result types, error codes

Dependency injection or direct imports

State management approach

Async patterns: callbacks, promises, async/await, channels

**Git Conventions**

Branch naming from recent branches

Commit message style from recent commits

PR workflow (squash, merge, rebase)

If the repo has no commits yet or only a shallow history (e.g. `git clone --depth 1`), skip this section and note "Git history unavailable or too shallow to detect conventions"


Modern Perl 5.36+ idioms, best practices, and conventions for building robust, maintainable Perl applications.

Exporter Patterns

Tooling

perltidy Configuration (.perltidyrc)

perlcritic Configuration (.perlcriticrc)


Next.js 16+ and Turbopack — incremental bundling, FS caching, dev speed, and when to use Turbopack vs webpack.

Best Practices

Stay on a recent Next.js 16.x for stable Turbopack and caching behavior.

If dev is slow, ensure you're on Turbopack (default) and that the cache isn't being cleared unnecessarily.

For production bundle size issues, use the official Next.js bundle analysis tooling for your version.


Visualize whether skills, rules, and agent definitions are actually followed — auto-generates scenarios at 3 prompt strictness levels, runs agents, classifies behavioral sequences, and reports compliance rates with full tool call timelines

skill-comply: Automated Compliance Measurement

Advanced (optional)

For users familiar with hooks, reports also include hook promotion recommendations for steps with low compliance. This is informational — the main value is the compliance visibility itself.


Knowledge base management, ingestion, sync, and retrieval across multiple storage layers (local files, MCP memory, vector stores, Git repos). Use when the user wants to save, organize, sync, deduplicate, or search across their knowledge systems.

Layer 2: Claude Code Memory (Quick Access)

**Path:** `~/.claude/projects/*/memory/`

**Format:** Markdown files with frontmatter

**Types:** user preferences, feedback, project context, reference

**Use for:** quick-access context that persists across conversations

**Automatically loaded at session start**


Build an evidence-backed ECC install plan for a specific repo by sorting skills, commands, rules, hooks, and extras into DAILY vs LIBRARY buckets using parallel repo-aware review passes. Use when ECC should be trimmed to what a project actually needs instead of loading the full bundle.

Agent Sort

Use this skill when a repo needs a project-specific ECC surface instead of the default full install.

The goal is not to guess what "feels useful." The goal is to classify ECC components with evidence from the actual codebase.


Use this skill to validate the "why" before building, run product diagnostics, and pressure-test product direction before the request becomes an implementation contract.

Product Lens — Think Before You Build
Output

Mode 4: Feature Prioritization

When you have 10 ideas and need to pick 2:

Output

All modes output actionable docs, not essays. Every recommendation has a specific next step.


Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies, and production readiness checklists for web applications.

Deployment Patterns
Rollback Strategy
Rollback Checklist

Rollback Checklist

[ ] Previous image/artifact is available and tagged

[ ] Database migrations are backward-compatible (no destructive changes)

[ ] Feature flags can disable new features without deploy

[ ] Monitoring alerts configured for error rate spikes

[ ] Rollback tested in staging before production release


Conduct market research, competitive analysis, investor due diligence, and industry intelligence with source attribution and decision-oriented summaries. Use when the user wants market sizing, competitor comparisons, fund research, technology scans, or research that informs business decisions.

When to Activate

researching a market, category, company, investor, or technology trend

building TAM/SAM/SOM estimates

comparing competitors or adjacent products

preparing investor dossiers before outreach

pressure-testing a thesis before building, funding, or entering a market


Clean Architecture patterns for Android and Kotlin Multiplatform projects — module structure, dependency rules, UseCases, Repositories, and data layer patterns.

Android Clean Architecture
Data Layer
Room Database (Android)

Mapper Pattern

Keep mappers as extension functions near the data models:

Room Database (Android)


Audits Claude Code context window consumption across agents, skills, MCP servers, and rules. Identifies bloat, redundant components, and produces prioritized token-savings recommendations.

Context Budget
How It Works
Phase 1: Inventory

How It Works

Phase 1: Inventory

Scan all component directories and estimate token consumption:

**Agents** (`agents/*.md`)

Count lines and tokens per file (words × 1.3)

Extract `description` frontmatter length

Flag: files >200 lines (heavy), description >30 words (bloated frontmatter)

**Skills** (`skills/*/SKILL.md`)

Count tokens per SKILL.md

Flag: files >400 lines

Check for duplicate copies in `.agents/skills/` — skip identical copies to avoid double-counting

**Rules** (`rules/**/*.md`)

Count tokens per file

Flag: files >100 lines

Detect content overlap between rule files in the same language module

**MCP Servers** (`.mcp.json` or active MCP config)

Count configured servers and total tool count

Estimate schema overhead at ~500 tokens per tool

Flag: servers with >20 tools, servers that wrap simple CLI commands (`gh`, `git`, `npm`, `supabase`, `vercel`)

**CLAUDE.md** (project + user-level)

Count tokens per file in the CLAUDE.md chain

Flag: combined total >300 lines


GAN-inspired Generator-Evaluator agent harness for building high-quality applications autonomously. Based on Anthropic's March 2026 harness design paper.

When to Use

Building complete applications from a one-line prompt

Frontend design tasks requiring high visual quality

Full-stack projects that need working features, not just code

Any task where "AI slop" aesthetics are unacceptable

Projects where you want to invest $50-200 for production-quality output


Discover and evaluate Laravel packages via LaraPlugins.io MCP. Use when the user wants to find plugins, check package health, or assess Laravel/PHP compatibility.

Laravel Plugin Discovery
How It Works
Evaluating Packages

Evaluating Packages

When the user wants to assess a specific package:

Use `GetPluginDetailsTool` with the package name

Review health score, last updated date, Laravel version support

Check vendor reputation and risk indicators


Hunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings.

When to Use

Scanning a repository for exploitable vulnerabilities

Preparing a Huntr, HackerOne, or similar bounty submission

Triage where the question is "does this actually pay?" rather than "is this theoretically unsafe?"


Baseline cross-project coding conventions for naming, readability, immutability, and code-quality review. Use detailed frontend or backend skills for framework-specific patterns.

Coding Standards & Best Practices
Code Quality Principles
3. DRY (Don't Repeat Yourself)

3. DRY (Don't Repeat Yourself)

Extract common logic into functions

Create reusable components

Share utilities across modules

Avoid copy-paste programming


C++ coding standards based on the C++ Core Guidelines (isocpp.github.io). Use when writing, reviewing, or refactoring C++ code to enforce modern, safe, and idiomatic practices.

C++ Coding Standards (C++ Core Guidelines)

Expressions & Statements (ES.*)

Key Rules

| Rule | Summary |
|------|---------|
| **ES.5** | Keep scopes small |
| **ES.20** | Always initialize an object |
| **ES.23** | Prefer `{}` initializer syntax |
| **ES.25** | Declare objects `const` or `constexpr` unless modification is intended |
| **ES.28** | Use lambdas for complex initialization of `const` variables |
| **ES.45** | Avoid magic constants; use symbolic constants |
| **ES.46** | Avoid narrowing/lossy arithmetic conversions |
| **ES.47** | Use `nullptr` rather than `0` or `NULL` |
| **ES.48** | Avoid casts |
| **ES.50** | Don't cast away `const` |


Codified expertise for customs documentation, tariff classification, duty optimization, restricted party screening, and regulatory compliance across multiple jurisdictions. Informed by trade compliance specialists with 15+ years experience. Includes HS classification logic, Incoterms application, FTA utilization, and penalty mitigation. Use when handling customs clearance, tariff classification, trade compliance, import/export documentation, or duty optimization.

Customs & Trade Compliance
Decision Frameworks
Valuation Method Selection

Valuation Method Selection

Customs valuation follows the WTO Agreement on Customs Valuation (based on GATT Article VII). Methods are applied in hierarchical order — you only proceed to the next method when the prior method cannot be applied:

**Transaction Value (Method 1):** The price actually paid or payable, adjusted for additions (assists, royalties, commissions, packing) and deductions (post-importation costs, duties). This is used for ~90% of entries. Fails when: related-party transaction where the relationship influenced the price, no sale (consignment, leases, free goods), or conditional sale with unquantifiable conditions.

**Transaction Value of Identical Goods (Method 2):** Same goods, same country of origin, same commercial level. Rarely available because "identical" is strictly defined.

**Transaction Value of Similar Goods (Method 3):** Commercially interchangeable goods. Broader than Method 2 but still requires same country of origin.

**Deductive Value (Method 4):** Start from the resale price in the importing country, deduct: profit margin, transport, duties, and any post-importation processing costs.

**Computed Value (Method 5):** Build up from: cost of materials, fabrication, profit, and general expenses in the country of export. Only available if the exporter cooperates with cost data.

**Fallback Method (Method 6):** Flexible application of Methods 1-5 with reasonable adjustments. Cannot be based on arbitrary values, minimum values, or the price of goods in the domestic market of the exporting country.


Git workflow patterns including branching strategies, commit conventions, merge vs rebase, conflict resolution, and collaborative development best practices for teams of all sizes.

Anti-Patterns

Quick Reference

| Task | Command |
|------|---------|
| Create branch | `git checkout -b feature/name` |
| Switch branch | `git checkout branch-name` |
| Delete branch | `git branch -d branch-name` |
| Merge branch | `git merge branch-name` |
| Rebase branch | `git rebase main` |
| View history | `git log --oneline --graph` |
| View changes | `git diff` |
| Stage changes | `git add .` or `git add -p` |
| Commit | `git commit -m "message"` |
| Push | `git push origin branch-name` |
| Pull | `git pull origin branch-name` |
| Stash | `git stash push -m "message"` |
| Undo last commit | `git reset --soft HEAD~1` |
| Revert commit | `git revert HEAD` |


Evidence-first live messaging workflow for ECC. Use when the user wants to read texts or DMs, recover a recent one-time code, inspect a thread before replying, or prove which message source was actually checked.

Messages Ops
Workflow
4. Report exact evidence

4. Report exact evidence

Return:

source used

thread or sender when possible

time window

exact status:

read

code-found

blocked

awaiting reply draft


Kotlin Coroutines and Flow patterns for Android and KMP — structured concurrency, Flow operators, StateFlow, error handling, and testing.

Combining Multiple Flows

Flow Operators

SharedFlow for One-Time Events

Dispatchers

In KMP, use `Dispatchers.Default` and `Dispatchers.Main` (available on all platforms). `Dispatchers.IO` is JVM/Android only — use `Dispatchers.Default` on other platforms or provide via DI.


Idiomatic Kotlin patterns, best practices, and conventions for building robust, efficient, and maintainable Kotlin applications with coroutines, null safety, and DSL builders.

Kotlin Development Patterns
Quick Reference: Kotlin Idioms

Collection Operations

Idiomatic Collection Processing

Quick Reference: Kotlin Idioms

| Idiom | Description |
|-------|-------------|
| `val` over `var` | Prefer immutable variables |
| `data class` | For value objects with equals/hashCode/copy |
| `sealed class/interface` | For restricted type hierarchies |
| `value class` | For type-safe wrappers with zero overhead |
| Expression `when` | Exhaustive pattern matching |
| Safe call `?.` | Null-safe member access |
| Elvis `?:` | Default value for nullables |
| `let`/`apply`/`also`/`run`/`with` | Scope functions for clean code |
| Extension functions | Add behavior without inheritance |
| `copy()` | Immutable updates on data classes |
| `require`/`check` | Precondition assertions |
| Coroutine `async`/`await` | Structured concurrent execution |
| `Flow` | Cold reactive streams |
| `sequence` | Lazy evaluation |
| Delegation `by` | Reuse implementation without inheritance |


Interactive installer for Everything Claude Code — guides users through selecting and installing skills and rules to user-level or project-level directories, verifies paths, and optionally optimizes installed files.

Configure Everything Claude Code (ECC)
When to Activate

When to Activate

User says "configure ecc", "install ecc", "setup everything claude code", or similar

User wants to selectively install skills or rules from this project

User wants to verify or fix an existing ECC installation

User wants to optimize installed skills or rules for their project


C# and .NET testing patterns with xUnit, FluentAssertions, mocking, integration tests, and test organization best practices.

C# Testing Patterns
Common Anti-Patterns

Test Organization

Test Data Builders

Common Anti-Patterns

| Anti-Pattern | Fix |
|---|---|
| Testing implementation details | Test behavior and outcomes |
| Shared mutable test state | Fresh instance per test (xUnit does this via constructors) |
| `Thread.Sleep` in async tests | Use `Task.Delay` with timeout, or polling helpers |
| Asserting on `ToString()` output | Assert on typed properties |
| One giant assertion per test | One logical assertion per test |
| Test names describing implementation | Name by behavior: `Method_ExpectedResult_WhenCondition` |
| Ignoring `CancellationToken` | Always pass and verify cancellation |


Use this skill when retrieving Jira tickets, analyzing requirements, updating ticket status, adding comments, or transitioning issues. Provides Jira API patterns via MCP or direct REST calls.

Jira Integration Skill

Retrieve, analyze, and update Jira tickets directly from your AI coding workflow. Supports both **MCP-based** (recommended) and **direct REST API** approaches.


Python testing strategies using pytest, TDD methodology, fixtures, mocking, parametrization, and coverage requirements.

Python Testing Patterns

Comprehensive testing strategies for Python applications using pytest, TDD methodology, and best practices.


Codified expertise for demand forecasting, safety stock optimization, replenishment planning, and promotional lift estimation at multi-location retailers. Informed by demand planners with 15+ years experience managing hundreds of SKUs. Includes forecasting method selection, ABC/XYZ analysis, seasonal transition management, and vendor negotiation frameworks. Use when forecasting demand, setting safety stock, planning replenishment, managing promotions, or optimizing inventory levels.

Inventory Demand Planning
Core Knowledge
Reorder Logic

Reorder Logic

**Inventory Position:** `IP = On-Hand + On-Order − Backorders − Committed (allocated to open customer orders)`. Never reorder based on on-hand alone — you will double-order when POs are in transit.

**Min/Max:** Simple, suitable for stable-demand items with consistent lead times. Min = average demand during lead time + safety stock. Max = Min + EOQ. When IP drops to Min, order up to Max. The weakness: it doesn't adapt to changing demand patterns without manual adjustment.

**Reorder Point / EOQ:** ROP = average demand during lead time + safety stock. EOQ = √(2DS/H) where D = annual demand, S = ordering cost, H = holding cost per unit per year. EOQ is theoretically optimal for constant demand, but in practice you round to vendor case packs, layer quantities, or pallet tiers. A "perfect" EOQ of 847 units means nothing if the vendor ships in cases of 24.

**Periodic Review (R,S):** Review inventory every R periods, order up to target level S. Better when you consolidate orders to a vendor on fixed days (e.g., Tuesday orders for Thursday pickup). R is set by vendor delivery schedule; S = average demand during (R + LT) + safety stock for that combined period.

**Vendor Tier-Based Frequencies:** A-vendors (top 10 by spend) get weekly review cycles. B-vendors (next 20) get bi-weekly. C-vendors (remaining) get monthly. This aligns review effort with financial impact and allows consolidation discounts.