Threat Modeling Stride
Threat-model a system using STRIDE — Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. Walks through data flow diagrams, trust boundaries, and per-component threat enumeration with mitigations. Use before adding auth/payments/PII handling, after a near-miss, or as part of a secure SDLC.
Shrink This Pr
Take a PR that's grown too large to review and split it into mergeable, ordered chunks with a dependency graph. Use when you (or someone else) opens a PR with >500 lines, mixes refactoring with features, or touches >10 files for one logical change.
Java 8 To 21
Upgrade a Java 8 codebase to Java 21 (LTS) — module path, records, pattern matching, sealed classes, virtual threads, switch expressions, the dependency upgrades (Spring Boot 2 → 3) that ride along, and the JEPs you'll actually use day-to-day. Use when on Java 8 and ready for the multi-year-overdue jump, or staged migration through 11/17.
Graphql Relay
Build a GraphQL API following Relay specifications — schema design, global IDs, connections (cursor pagination), DataLoader for N+1, persisted queries, auth at field level, and the operational discipline that prevents schema drift. Use when designing a new GraphQL API, not when adding fields to an existing one.
Mongo To Postgres
Migrate from MongoDB to Postgres — schema design from documents, query translation, transactional cutover plan with dual-write window, JSONB for unstructured fields, and the operational shift from "no schema" to "managed schema." Use when MongoDB has become a maintenance liability or relational queries dominate access patterns.
Write Adr
Write an Architecture Decision Record — Context, Decision, Consequences, Alternatives Considered. Use when making any architecture-shaping choice (DB, framework, service boundary, vendor, data model) so the *reason* survives. ADRs are append-only and superseded, not edited.
Stripe Integration
Integrate Stripe end-to-end — Checkout, Customer Portal, subscriptions with proration, webhooks with idempotency, refunds, invoicing, tax. Use when adding Stripe to a Node/Python/Go backend or debugging webhook signature/idempotency issues. Pairs with razorpay-integration for India/SE Asia.
React Native Expo
Build a production React Native app with Expo — EAS builds, OTA updates via expo-updates, native modules without ejecting, push notifications, deep links, app store submission, and the Expo SDK upgrade discipline. Use when starting a new mobile app or when an existing RN-vanilla project should switch to Expo.
Github Actions Ci
Production GitHub Actions patterns — matrix builds, caching, OIDC to AWS/GCP, reusable workflows, secrets discipline, concurrency control, and the small fixes that turn 12-minute CI into 3-minute CI. Use when setting up CI for a new repo, optimizing slow workflows, or hardening secrets posture.
Brevo Email
Send transactional and marketing email via Brevo (formerly Sendinblue) — templates, lists, contact attributes, webhooks, bounce/complaint handling, and the inbox-deliverability setup (SPF, DKIM, DMARC, dedicated IP) that determines whether your mail lands in inbox or spam. Use when adding email to a Node, Python, or Go backend, or migrating from SendGrid/Postmark for cost.
Grpc Services
Build a gRPC service end-to-end — proto layout, code generation, streaming, interceptors (auth/logging/tracing), error handling, gRPC-Gateway for REST/JSON, deadline propagation, and the versioning discipline that keeps clients working through breaking changes. Use when building a gRPC service from scratch, not when adding RPCs to an existing one.
Soc2 Evidence
Map SOC 2 controls to actual code and CI artifacts an auditor can verify — access reviews, change management, vulnerability scanning, encryption, monitoring, incident response. Use when starting SOC 2 Type 1/Type 2 prep, working with Vanta/Drata/Secureframe, or responding to a customer security questionnaire that asks for SOC 2 evidence.
Clerk Auth
Integrate Clerk for authentication and team/org management — JWT verification on backends, organizations and roles, webhook sync to your DB, and the SSR/middleware patterns for Next.js App Router. Use when adding auth to a new app and outsourcing UI/orgs/invites instead of building Auth.js from scratch.
Dbt Data Modeling
Build a maintainable dbt project — staging/intermediate/mart layering, sources/refs, tests, macros, incremental models, snapshots, and the discipline that prevents the "1500 models, 0 tests" antipattern. Use when starting a new dbt project or refactoring one that's grown into a hairball.
Scaffold Go Microservice
Scaffold a production-ready Go HTTP microservice — chi router + sqlc + golang-migrate + structured logging + OpenTelemetry + healthchecks + Dockerfile + GitHub Actions. Use when starting a new Go service, not when adding structure to an existing one.
Supabase Backend
Use Supabase as a managed Postgres + auth + storage + realtime backend — RLS policies, edge functions, the auth-and-RLS handshake, Realtime channels, and the migration discipline that prevents prod drift. Use when starting a new app on Supabase, not when adding Supabase features piecemeal to an existing one.
Scaffold Fullstack App
Scaffold a single-tenant full-stack app — Next.js (App Router) + Postgres + Auth.js + Brevo email + Razorpay/Stripe + observability. Use for solo or small-team apps where every user owns their own data, not multi-tenant SaaS. Less ceremony than scaffold-saas-starter; no orgs, no RLS.
Opentelemetry Instrument
Instrument a service with OpenTelemetry — traces, metrics, and logs unified, with one OTLP collector and one vendor (Grafana Cloud, Honeycomb, Datadog). Covers Node, Go, Python, and the cardinality/sampling discipline that keeps bills sane. Use when adding observability to a service for the first time, or replacing fragmented Prometheus/Jaeger/loki setups.
Webpack To Vite
Migrate from Webpack to Vite — config translation, plugin equivalents, dev-server differences (HMR), env var handling, asset imports, the issues unique to React/Vue/Svelte migrations. Use when an existing webpack project's dev experience is too slow or maintenance burden too high.
Find Real Bug
Trace a bug to its root cause instead of patching the symptom. Refuses shortcuts like "wrap in try/catch", "add a null check", or "just retry it" until the actual cause is understood. Use when a test is failing intermittently, a metric just spiked, an error appears in logs, or a user reports something "weird.
Scaffold Saas Starter
Scaffold a production-ready multi-tenant SaaS starter — Next.js (App Router) + Postgres with row-level security + Clerk organizations + Razorpay/Stripe billing + Brevo email + observability. Use when starting a new SaaS app and you want the boring decisions made well, not when adding tenancy to an existing app.
Sentry Monitoring
Set up Sentry error and performance monitoring — SDK config, sourcemaps, release tracking, sampling, alerts, the noise-reduction patterns that prevent Sentry fatigue, and PII redaction for compliance. Use when adding error monitoring to a new app or cleaning up a noisy Sentry account where every push triggers 200 alerts.
Triage Stack Trace
Take a raw stack trace (or error log) and produce a ranked list of hypotheses + the single file most worth opening first. Use when an error appears in logs, a Sentry issue lands, or a user reports a stack trace from production. Pairs with find-real-bug for the deeper investigation.
Extract Skill From Session
Take a finished workflow you found yourself doing and convert it into a reusable SKILL.md file. Captures the pattern, anti-patterns, and verification checklist before the knowledge fades. Use after solving a non-trivial problem you'll likely face again, or after teaching someone the same thing twice.
Nextjs Pages To App
Migrate a Next.js Pages-router app to App-router incrementally — coexistence strategy, data-fetching translation (getServerSideProps → Server Components, getStaticProps → static), layouts, auth middleware, API routes → route handlers. Use when migrating an existing Pages-router app, not when starting greenfield.
Pci Dss Checklist
PCI DSS 4.0 engineering checklist — scope reduction first (what you hand to Stripe/Razorpay vs. keep), SAQ tier selection, the controls you actually own, network segmentation, and how to keep PAN data out of your systems. Use when a customer asks "are you PCI compliant?" or before designing payment integration.
Find Dead Code
Locate unused code with confidence tiers — definitely dead, probably dead, risky to touch. Uses static analysis (knip, ts-prune, ruff, deadcode) plus reflection-aware heuristics for things tools miss (DI, JSON config, dynamic imports). Use during periodic cleanup, before a refactor, or when onboarding to figure out what's still load-bearing.
Cloudflare Workers
Build production apps on Cloudflare Workers — Workers + KV + D1 + R2 + Durable Objects + Queues, wrangler config, bindings, the runtime constraints (no Node APIs, no long-running compute), and the patterns that exploit edge architecture instead of fighting it. Use when building a new edge-deployed service or migrating from Lambda for cost.
Spec From Conversation
Take a messy back-and-forth (Slack thread, meeting notes, ad-hoc requirements) and produce a clean PRD/spec — goals, non-goals, user flows, edge cases, acceptance criteria. Use when someone says "just build X" with no written spec, or before a multi-week feature when the requirements live in five Slack threads.
Write Commit Message
Write a Conventional Commit message from a staged diff — type, scope, subject, body that explains *why*, footer for breaking changes and issue refs. Use after staging changes when the auto-generated message would be a useless "update files" or generic bullet list.
Hipaa Audit
Audit a SaaS product against HIPAA Security Rule + Privacy Rule — PHI inventory, BAA boundaries, technical safeguards (access, audit, encryption, integrity, transmission), administrative safeguards, breach notification. Use when serving US healthcare customers, processing PHI, or onboarding to a healthcare-adjacent product. Covers Security Rule technical specs in engineering depth.
Python 2 To 3
Migrate a Python 2 codebase to Python 3.12+ — `2to3` baseline, the parts the tool misses (bytes/str semantics, dict ordering, divisions, exception syntax), encoding handling, and the dependency upgrades. Use only when stuck on legacy Py2 — Python 2 has been EOL since 2020 but lives on in regulated/government/embedded.
Plan The Rollback
Before any risky change — schema migration, deploy, infra cutover, vendor swap — write the rollback plan first. Use proactively before "let's just push it" moments. Refuses to proceed without a documented undo path or a deliberate, justified accept-the-risk decision.
Jest To Vitest
Migrate a Jest test suite to Vitest — config, mocks, timers, ESM compatibility, snapshot diff, the API differences and global vs imported usage. Use when test runs are slow, when migrating to Vite (Vitest is the natural pair), or when fighting Jest's ESM support.
Bun Runtime
Use Bun as runtime, package manager, bundler, and test runner — when to choose Bun over Node, the Node.js compatibility gotchas, migration from npm/pnpm, the built-in HTTP server, SQLite, and Bun's built-in test runner. Use when starting a new TS/JS project or evaluating a switch from Node.
Node Version Upgrade
Upgrade Node.js (16 → 18 → 20 → 22) — what breaks, what improves, ESM transitions, dependency compatibility, Docker base image swaps, CI matrix updates. Use when a Node version is going EOL or you want native fetch/test runner. Covers Node 16 EOL (2023), 18 EOL (2025), 20 LTS, 22 LTS.
Audit Tautological Tests
Find tests that pass without exercising the code under test — over-mocked tests where the mock is the implementation, snapshot tests with no behavioral checks, tests that assert on the mock's return value. Use proactively after a bug ships to "well-tested" code, or when test coverage is high but bug rate is too.
Terraform Patterns
Terraform module layout, remote state, environments, drift detection, and the small-team patterns that don't appear in the official docs. Use when starting a new Terraform repo, adding a second environment, or untangling a Terraform repo that has grown into a hairball.
Explain This Diff
Read a git diff and produce a plain-English narrative for a reviewer who wasn't in the original conversation — what changed, why, what's risky, what to spot-check. Use when the diff is non-trivial and the PR description is missing or auto-generated, or when handing context to a reviewer who's joining late.
Blame Archaeology
Trace why a piece of code exists via git history — original commit, the PR, the issue, the discussion, the constraints. Use when about to delete or refactor old-looking code, when behavior is mysterious, or when bisecting a regression. Refuses surface-level "this looks ancient, delete it" decisions.
Kubernetes Helm
Production Helm chart layout — values structure, probes, HPA, NetworkPolicies, PodSecurity, secrets via External Secrets Operator, and the small-team patterns the official tutorial skips. Use when packaging a service for Kubernetes, not when authoring a public chart for a registry.
Scaffold Cli Tool
Scaffold a production-grade CLI — Cobra (Go) or Commander (TS/Node) with config, structured logging, subcommands, shell completion, signed releases via goreleaser/np, and homebrew/scoop tap. Use when starting a new CLI you intend to ship to other people; not for one-off scripts.
Scaffold New App
Interactive scaffolder that picks a stack from a few questions, then bootstraps the right project (SaaS / fullstack / Go service / CLI / etc) wired end-to-end. Routes to the matching scaffold-* skill. Use when starting any new project — saves the "should I use Next.js or just Express?" decision spiral.
Write Pr Description
Write a PR description that gets reviewed quickly — the change in one sentence, the why, the test plan, the rollback. Use when opening any non-trivial PR, or when an existing PR description is "see commits" / auto-generated bullet list.
Wcag Accessibility Audit
Audit a web app against WCAG 2.2 AA — automated tooling (axe, Pa11y, Lighthouse), the manual checks tools miss (keyboard, screen reader, focus, color, motion), and the engineering fixes. Use when adding accessibility to a product, before public launch, after legal pressure, or to satisfy procurement requirements.
Algolia Search
Production Algolia setup — index design, attribute configuration, ranking and relevance, faceting, secured API keys (per-user filters), search-as-you-type UI patterns, and the cost discipline that prevents bill shocks. Use when adding search to a SaaS product or replacing Elasticsearch with managed search.
Fastapi Production
Production FastAPI patterns — async DB with SQLAlchemy 2.x, dependency injection, JWT auth, structured logging, OpenAPI hardening, error handling, rate limiting, and deployment via uvicorn+gunicorn. Use when building a production FastAPI service, not when prototyping a single-file demo.
Gdpr Dpia
Conduct a GDPR Data Protection Impact Assessment from code, data flows, and processing purposes — identify high-risk processing, document mitigations, ROPA (records of processing activities). Use when EU users are involved and you're starting new processing, or when an audit asks for the DPIA you don't have.
Razorpay Integration
Integrate Razorpay payments end-to-end — orders, subscriptions, webhooks, refunds, signature verification, and the India-specific gotchas (RBI auto-debit mandates, GST invoices, partial COD). Use when adding Razorpay to a Node.js, Python, or Go backend, or when debugging webhook signature failures, subscription state machines, or KYC/onboarding flows.
India Dpdp Act
Implement India's Digital Personal Data Protection Act 2023 — consent management, data fiduciary obligations, breach notification, data principal rights, cross-border transfer rules, and the architectural choices for Indian data residency. Use when building or auditing a product serving Indian users; few Claude resources cover this and the penalties for non-compliance are real (₹250 crore max).