sriptcollector
User20 free, MIT-licensed Claude Code skills. Each written from a real defect found in production. Install with /plugin marketplace add, or npx toolbay.
Categories
Indexed Skills (38)
client-secret-sweep
Prove no secret reaches the browser, by tracing which environment variables and constants actually get compiled into your client bundle rather than trusting naming conventions. Use before a public launch, after adding any API key, or when wiring a third-party service into a frontend.
codebase-onboarding-map
Produce an accurate orientation guide to an unfamiliar codebase — how a request flows end to end, where the real rules live, what the traps are, and what to read first — grounded in the code rather than the README. Use when joining a project, inheriting a repo, returning to old code, or onboarding someone else.
commit
Write a Conventional Commits message from the staged diff, or split a messy working tree into logical commits. Use when the user asks to commit, write a commit message, or clean up the working tree before committing.
crawlability-audit
Find pages search engines cannot reach or will not trust — robots.txt rules that block real content, sitemaps contradicting robots, error pages served as HTTP 200, missing canonicals, and duplicate metadata. Use before a launch, when organic traffic is flat, after changing robots or routing, or when the user asks why a page is not indexed.
dependency-outage-audit
Find which pages die when a dependency dies — database, cache, or upstream API — and which ones lie about it by returning HTTP 200 with an empty body. Use before a launch, after an incident, when adding a page that fetches data, or when the user asks how their app behaves if the database goes down.
deploy-drift-check
Prove what is actually running in production matches the commit you think shipped, by fetching real bytes from the live site rather than trusting the deploy dashboard. Use when the user says a fix "should be live", asks why a change is not showing up, is about to debug production, or before writing any postmortem.
empty-state-audit
Find every screen that looks broken, dead, or dishonest when there is no data yet — rows of zeros, "no results" with no way forward, fake placeholder content, and stats that expose emptiness. Use before a launch, when building a new product, or when the first users are not converting.
env-drift-check
Compare the environment variables your code actually reads against what is declared and what is set where it deploys, catching the missing key that only fails in production and the silent fallback that hides it. Use before a deploy, when onboarding to a repo, after adding a config value, or when something works locally and not in production.
fake-data-guard
Find demo, seed, and fixture data that can reach a real database or a real user — fabricated users, invented metrics, placeholder testimonials, hardcoded counts — and check whether anything actually stops it. Use before a launch, before seeding any shared environment, when adding a seed script, or when the user asks whether their numbers are real.
honest-metrics-audit
Check that every number your UI shows actually means what its label claims, by tracing each displayed figure back to the query that produced it. Catches counts of the wrong entity, stale denominators, placeholder traction, and labels that quietly overstate. Use before a launch, a pricing page, or any screen that shows social proof.
migration-safety-review
Review a pending database migration for irreversible data loss and for locks that take the site down during deploy — dropped columns, narrowed types, NOT NULL without a default, and indexes built non-concurrently. Use before running any migration against a real database, or when reviewing a schema change.
n-plus-one-finder
Find database queries running inside loops — the N+1 pattern that is invisible on seed data and quadratic in production — plus unbounded queries with no limit and repeated identical reads in one request. Use when a page is slow, before a launch, after adding a list view, or when database load rises without traffic rising.
pr-reviewer
Structured three-pass review of the working diff (staged + unstaged) — correctness bugs, security, then simplification — with severity-tagged findings and a ship/no-ship verdict. Use when the user asks to review their changes, review the diff, check a PR before pushing, or says "is this safe to ship".
prompt-injection-review
Review an LLM feature for prompt injection — where untrusted text reaches the model, what the model can then do, and whether a hostile instruction inside that text could cause it. Use when adding tool calling, RAG, agents that browse or read email, or any feature that puts user or third-party content into a prompt.
release-notes-writer
Turn a range of commits into release notes written for the people affected, grouped by what changed for them rather than by commit type, with breaking changes and required actions first. Use when cutting a release, updating a CHANGELOG, writing a deploy summary, or explaining what shipped.
retry-safety-review
Decide which operations are actually safe to retry, by separating failures that definitely did nothing from failures where the work may already have happened. Use before adding a retry wrapper, configuring queue redelivery, or debugging duplicate charges, duplicate emails, or double-applied writes.
route-auth-sweep
Enumerate every API route and prove each one gates before it touches data — authentication, ownership checks, role checks, rate limiting — so no endpoint is accidentally public or leaks another user's records. Use before a launch, after adding routes, during a security review, or when the user asks whether their API is safe.
timezone-review
Find the date and time bugs that only appear for users in other timezones or on specific days, by separating true instants from calendar dates and checking where the server's local clock leaks in. Use before shipping scheduling, reporting, streaks, expiry, or anything with a daily boundary.
webhook-safety-review
Review incoming webhook handlers for the four failures that cost money — unverified signatures, missing idempotency, work done before acknowledging, and errors that make the sender retry forever. Use when adding or changing a webhook, integrating Stripe/GitHub/Slack, or after a duplicate charge or missed event.
client-secret-sweep
Prove no secret reaches the browser, by tracing which environment variables and constants actually get compiled into your client bundle rather than trusting naming conventions. Use before a public launch, after adding any API key, or when wiring a third-party service into a frontend.
codebase-onboarding-map
Produce an accurate orientation guide to an unfamiliar codebase — how a request flows end to end, where the real rules live, what the traps are, and what to read first — grounded in the code rather than the README. Use when joining a project, inheriting a repo, returning to old code, or onboarding someone else.
commit
Write a Conventional Commits message from the staged diff, or split a messy working tree into logical commits. Use when the user asks to commit, write a commit message, or clean up the working tree before committing.
crawlability-audit
Find pages search engines cannot reach or will not trust — robots.txt rules that block real content, sitemaps contradicting robots, error pages served as HTTP 200, missing canonicals, and duplicate metadata. Use before a launch, when organic traffic is flat, after changing robots or routing, or when the user asks why a page is not indexed.
dependency-outage-audit
Find which pages die when a dependency dies — database, cache, or upstream API — and which ones lie about it by returning HTTP 200 with an empty body. Use before a launch, after an incident, when adding a page that fetches data, or when the user asks how their app behaves if the database goes down.
deploy-drift-check
Prove what is actually running in production matches the commit you think shipped, by fetching real bytes from the live site rather than trusting the deploy dashboard. Use when the user says a fix "should be live", asks why a change is not showing up, is about to debug production, or before writing any postmortem.
empty-state-audit
Find every screen that looks broken, dead, or dishonest when there is no data yet — rows of zeros, "no results" with no way forward, fake placeholder content, and stats that expose emptiness. Use before a launch, when building a new product, or when the first users are not converting.
env-drift-check
Compare the environment variables your code actually reads against what is declared and what is set where it deploys, catching the missing key that only fails in production and the silent fallback that hides it. Use before a deploy, when onboarding to a repo, after adding a config value, or when something works locally and not in production.
fake-data-guard
Find demo, seed, and fixture data that can reach a real database or a real user — fabricated users, invented metrics, placeholder testimonials, hardcoded counts — and check whether anything actually stops it. Use before a launch, before seeding any shared environment, when adding a seed script, or when the user asks whether their numbers are real.
honest-metrics-audit
Check that every number your UI shows actually means what its label claims, by tracing each displayed figure back to the query that produced it. Catches counts of the wrong entity, stale denominators, placeholder traction, and labels that quietly overstate. Use before a launch, a pricing page, or any screen that shows social proof.
migration-safety-review
Review a pending database migration for irreversible data loss and for locks that take the site down during deploy — dropped columns, narrowed types, NOT NULL without a default, and indexes built non-concurrently. Use before running any migration against a real database, or when reviewing a schema change.
n-plus-one-finder
Find database queries running inside loops — the N+1 pattern that is invisible on seed data and quadratic in production — plus unbounded queries with no limit and repeated identical reads in one request. Use when a page is slow, before a launch, after adding a list view, or when database load rises without traffic rising.
pr-reviewer
Structured three-pass review of the working diff (staged + unstaged) — correctness bugs, security, then simplification — with severity-tagged findings and a ship/no-ship verdict. Use when the user asks to review their changes, review the diff, check a PR before pushing, or says "is this safe to ship".
prompt-injection-review
Review an LLM feature for prompt injection — where untrusted text reaches the model, what the model can then do, and whether a hostile instruction inside that text could cause it. Use when adding tool calling, RAG, agents that browse or read email, or any feature that puts user or third-party content into a prompt.
release-notes-writer
Turn a range of commits into release notes written for the people affected, grouped by what changed for them rather than by commit type, with breaking changes and required actions first. Use when cutting a release, updating a CHANGELOG, writing a deploy summary, or explaining what shipped.
retry-safety-review
Decide which operations are actually safe to retry, by separating failures that definitely did nothing from failures where the work may already have happened. Use before adding a retry wrapper, configuring queue redelivery, or debugging duplicate charges, duplicate emails, or double-applied writes.
route-auth-sweep
Enumerate every API route and prove each one gates before it touches data — authentication, ownership checks, role checks, rate limiting — so no endpoint is accidentally public or leaks another user's records. Use before a launch, after adding routes, during a security review, or when the user asks whether their API is safe.
timezone-review
Find the date and time bugs that only appear for users in other timezones or on specific days, by separating true instants from calendar dates and checking where the server's local clock leaks in. Use before shipping scheduling, reporting, streaks, expiry, or anything with a daily boundary.
webhook-safety-review
Review incoming webhook handlers for the four failures that cost money — unverified signatures, missing idempotency, work done before acknowledging, and errors that make the sender retry forever. Use when adding or changing a webhook, integrating Stripe/GitHub/Slack, or after a duplicate charge or missed event.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.