finnley07
UserCurated Claude Skills for the full software lifecycle — security, code review, architecture, testing, performance, accessibility, and DevOps.
Categories
Indexed Skills (14)
accessibility-check
Runs a comprehensive digital accessibility conformance check for a project's web frontend and/or mobile app against WCAG 2.1/2.2 (target Level AA), semantic markup and correct ARIA usage, full keyboard operability, screen-reader/assistive-technology compatibility, platform accessibility APIs (iOS VoiceOver, Android TalkBack, React Native, Flutter Semantics), and applicability of accessibility-specific EU/national law — the European Accessibility Act (EAA, Directive (EU) 2019/882) and Germany's Barrierefreiheitsstärkungsgesetz (BFSG) — then reports the results as one table (check, area, status, evidence, recommendation). Use this whenever the user asks for an "accessibility check", "accessibility audit", "a11y check", "a11y audit", "WCAG check", "WCAG conformance", "WCAG audit", "barrierefreiheitsprüfung", "barrierefreiheit check", "barrierefrei prüfen", "ist das barrierefrei", "BITV check", "BFSG check", "BFSG-konform", "BFSG readiness", "European Accessibility Act", "EAA readiness", "EAA conformance", "scree
api-design-review
Runs a structured, evidence-based review of API contract design and cross-endpoint consistency across REST, GraphQL, and gRPC surfaces — resource/endpoint naming and HTTP verb correctness, status-code correctness, request/response shape and envelope consistency, error-response format, pagination and filtering conventions, idempotency, versioning strategy, backward compatibility, and documentation/spec-vs-code drift (OpenAPI/Swagger, GraphQL SDL, .proto), plus GraphQL-specific checks (N+1-shaped resolver design, @deprecated usage, query depth/complexity limiting) and gRPC-specific checks (proto field-number stability, proto3 optional/wrappers, service/method naming). This is a design/contract-consistency review, not an authentication/access-control security review (use cybersecurity-check for that) and not a latency/throughput performance review (use performance-audit for that). Use this whenever the user asks for an "API design review", "API review", "API-Design prüfen", "API-Design-Review", "REST API check",
architecture-review
Runs a structured architecture-quality review of a system's module/service boundaries, coupling, data ownership, communication patterns, resilience, structural scalability, extensibility, documentation, pattern consistency, and versioning — evaluating structural soundness and evolvability of the design, not line-level code correctness and not measured runtime performance — then reports the results as one table (check, area, status, evidence, recommendation). Covers domain-aligned vs. arbitrary module boundaries, circular dependencies between modules/packages/services, coupling (does a change in one module ripple into unrelated ones), layering violations (a lower layer reaching up, or a domain layer importing from presentation), data ownership per service vs. shared-database distributed-monolith anti-patterns, cross-boundary consistency (sagas, eventual consistency, distributed transactions), sync-vs-async communication choices and single-points-of-failure created by synchronous call chains, event/message cont
ci-cd-pipeline-review
Reviews a project's CI/CD pipeline mechanics and deployment practice for reliability and safety — not the security content of the application itself. Covers build reproducibility (pinned tool/runtime versions, pinned third-party CI actions/plugins vs. mutable tags), test gating (does a test failure actually block merge/deploy, are required checks enforced at branch-protection level), secrets handling within the pipeline configuration (platform secret store vs. hardcoded, log-printing risk, scoping, fork-PR exposure), CI job permissions and production deployment approval gates, deployment strategy and safety (blue-green/canary/rolling vs. hard cutover, rollback path, post-deploy health checks/smoke tests, feature flags), environment parity and promotion (build-once-promote-many vs. rebuild-per-environment, config/artifact separation), artifact provenance and integrity (signing/checksums, commit-to-deploy traceability, pinned minimal base images), pipeline observability (failure notifications, run-time/failure-
code-review
Runs a structured code review of a diff, pull/merge request, branch, or file set for correctness bugs, error-handling quality, readability/maintainability, API & contract design, test coverage, documentation accuracy, and version-control hygiene — then reports the results as one table (check, area, status, evidence, recommendation). Explicitly does not cover application security (injection, auth, access control, secrets, SSRF — that's the cybersecurity-check skill) or performance/resource efficiency (algorithmic complexity, N+1 queries, memory/CPU usage — that's the performance-audit skill). Use this whenever the user asks for a "code review", "review this PR", "review this diff", "review my code", "review this pull request", "review this merge request", "MR review", "code quality check", "quality audit", "maintainability review", "readability review", "review my changes", "sanity-check this code", "code smell check", "find code smells", "refactor candidates", "test coverage review", "is this well tested", "c
cybersecurity-check
Runs a comprehensive, EU-focused security and GDPR/DSGVO compliance check across a project's backend, frontend, and deployment configuration, then reports the results as one table (check, area, status, evidence, recommendation). Covers application security (OWASP-style: SSRF, injection, auth, access control, headers, secrets, rate limiting, ...), GDPR (Art. 5–49: legal basis, special-category data, data subject rights, international transfers, DPIA, DPA/AVV, breach handling, retention/deletion), ePrivacy/cookie & tracking consent, email authentication (SPF/DKIM/DMARC), mobile-app specifics, and applicability of adjacent EU regulations (AI Act, Accessibility Act, NIS2, DSA, PSD2). Use this whenever the user asks for a "security check", "cybersecurity check", "security audit", "sicherheitscheck", "pentest-light", "security readiness review", "DSGVO check", "GDPR compliance check", or asks about any specific item this covers (SSRF, open redirects, webhook replay, email verification, staging data, SPF/DKIM/DMARC,
database-schema-review
Runs a structured review of a project's database schema design and migration safety, then reports the results as one table (check, area, status, evidence, recommendation). Covers normalization and data modeling (under-normalized vs. unjustified over-normalization, schema matching actual business entities), data types and constraints (appropriate column types, NOT NULL usage, CHECK constraints/enums for fixed value sets), referential integrity (foreign keys declared at the DB level, ON DELETE/ON UPDATE cascade behavior, orphan-record risk), uniqueness and identity (unique constraints vs. check-then-insert races, primary key/surrogate-key/UUID choice), migration safety (backward-compatible rolling deploys, expand/contract pattern, reversibility, DDL transactions, lock/downtime impact of large-table migrations), schema-vs-application drift, auditability/soft-delete conventions, and multi-tenancy data isolation at the schema level. This is a schema-design and migration-safety review, not a query-performance-tunin
dependency-audit
Runs a comprehensive third-party dependency health check across every package manager and manifest in a project (npm/yarn/pnpm, pip/poetry/Pipenv, NuGet, Maven/Gradle, Cargo, Go modules, Composer, RubyGems, CocoaPods/SwiftPM, and container base images where relevant), then reports the results as one table (check, area, status, evidence, recommendation). Covers known vulnerabilities/CVEs (native audit tooling per ecosystem), outdated packages (patch/minor vs. major, migration risk), license compliance (copyleft/GPL/AGPL/LGPL conflicts with closed-source distribution, missing/unknown licenses), unused and dead dependencies, lockfile integrity and manifest/lockfile drift, reproducibility of installs, and supply-chain risk signals (unmaintained packages, single-maintainer risk, suspicious/low-download additions, install/postinstall scripts as an attack vector, typosquatting-risk names), plus whether automated update tooling (Dependabot/Renovate or equivalent) is configured. Use this whenever the user asks for a "
i18n-check
Runs a comprehensive internationalization (i18n) and localization (l10n) readiness check across a project's web frontend, backend, and mobile app, then reports the results as one table (check, area, status, evidence, recommendation). Covers string externalization vs. hardcoded UI/backend text, translation completeness across all supported locales, correct pluralization (ICU MessageFormat/gettext ngettext/framework-native vs. naive English-only concatenation), sentence construction via string concatenation that breaks word order across languages, locale-aware date/time/number/currency/unit formatting vs. hardcoded formats, text-expansion and layout resilience for longer/shorter/differently-scripted translations, RTL (right-to-left) layout support for Arabic/Hebrew/Farsi/Urdu locales, character encoding (UTF-8 end-to-end) and font-fallback coverage for non-Latin scripts, locale detection/switching/persistence and regional-variant fallback chains (e.g. de-CH -> de -> default locale), translation-file/source-key
observability-audit
Runs a structured, evidence-based audit of a system's observability — logging, metrics, tracing, alerting, dashboards, SLOs/error budgets, runbooks/on-call readiness, health checks, and log/metric retention & cost — then reports the results as one table (check, area, status, evidence, recommendation). Covers structured logging and log-level discipline, correlation/request/trace IDs threaded through a request's lifecycle, golden-signal (RED/USE) metrics coverage for request-driven paths and background/async jobs, distributed trace-context propagation across service and queue boundaries plus sampling strategy, dashboard existence and content (golden signals vs. raw infra graphs, a clear "is the system healthy" entry point), alert quality (symptom-based vs. cause-based, alert fatigue, ownership/runbook links), SLO/error-budget definition and whether it's measured against real production data, on-call runbook coverage and escalation-path documentation, liveness/readiness health-check depth and whether they're act
performance-audit
Runs a structured performance and resource-usage audit across a project's backend, frontend, database, and infrastructure/deployment configuration, then reports the results as one table (check, area, status, evidence, recommendation). Covers backend hot-path efficiency (algorithmic complexity, N+1 queries, missing indexes, connection pooling, caching, blocking I/O, missing timeouts, unbounded pagination, serialization overhead, hot-path logging), frontend performance (bundle size/code-splitting, unnecessary re-renders, image optimization, render-blocking resources, duplicate/unparallelized network requests, Core Web Vitals-relevant patterns), and infrastructure/cost (container resource requests & limits, autoscaling/HPA config, database sizing, connection-pool-vs-max-connections mismatches, CDN/caching-layer usage, serverless cold starts, queue backpressure, always-on cost waste). This is a performance/throughput/latency/memory/CPU/cost review, not a security review and not a general code-quality/readability
test-plan-generator
Generates a structured, concrete test plan (test cases) for a specific feature, change, user story, requirements document, API contract, or code diff — the generative counterpart to this repo's audit skills. Given real source material (acceptance criteria, a user story, a requirements doc, an API/schema contract, or the actual code diff/implementation), it produces a document with prioritized (P0/P1/P2) test cases covering happy-path, negative, boundary/edge, and state-transition scenarios, plus assumptions, scope, test data needs, non-functional flags, and requirement-to-test-case traceability. It does NOT produce an audit findings table and does NOT review a project's overall test strategy/infrastructure — that is `test-strategy-audit`'s job; this skill is scoped to one feature/change, not the whole project. Use this whenever the user asks to "generate a test plan", "write test cases", "create test cases for this feature", "write a test plan for X", "test case generator", "QA test plan", "acceptance test pl
test-strategy-audit
Audits a project's overall test strategy, infrastructure, and process from a tester/QA perspective — test pyramid balance (unit vs. integration vs. e2e ratio and execution time), real coverage numbers per module from the ecosystem's actual coverage tool (jest --coverage, pytest-cov, dotnet test /p:CollectCoverage, go test -cover, etc.) cross-referenced against high-change-frequency files, test quality (assertion-free tests, over-mocked tests, unreviewed snapshots, long-skipped/disabled tests via git blame), flaky-test evidence (CI retry configuration, sleep/timeout-based waits, ordering dependencies), test data & environment management (fixtures/factories vs. hardcoded duplication, isolated test DB vs. shared/prod-adjacent state, real vs. mocked external calls), existence of contract/load/performance/accessibility/security test automation, whether CI actually gates merges on test failure and coverage thresholds or just runs tests informationally (continue-on-error, allowed-to-fail, excluded required-checks),
ui-consistency-check
Runs a structured visual/UI design-system consistency check across a project's web and/or mobile frontend — design token usage (colors, spacing, typography scale, border-radius, shadows) sourced from a single system rather than hardcoded per component, component reuse vs. visually inconsistent duplicate implementations (buttons, modals, form fields, cards, badges), typography and font-family consistency, spacing/layout-grid and responsive-breakpoint consistency, semantic color and dark-mode/theme-token consistency, interaction-state (hover/focus/active/disabled) and iconography consistency, design-system-to-code drift (Storybook/Figma/style-guide vs. shipped implementation), cross-platform (web/iOS/Android) token consistency, motion/animation timing consistency, and empty/loading/error-state pattern consistency — then reports the results as one table (check, area, status, evidence, recommendation). Explicitly does not cover color-contrast ratios, focus-indicator visibility, or other accessibility-specific vis
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.