Write and implement API handoff documents (Markdown) between frontend and backend. Backend → Frontend: documents the endpoint the frontend must consume. Frontend → Backend: specifies the endpoint the backend must build. Every endpoint gets its purpose, method and full path, auth, params, headers, the exact request body (field table + JSON example that must match), every success and error response, side effects and testable acceptance criteria, all extracted from real code (never invented; unknowns become TBD + open questions). Uses a fixed template with YAML front matter and ships a validator script, so any other Claude session can implement the handoff exactly and report contract mismatches. Trigger on "handoff", "write a handoff for the frontend", "handoff to backend", "implement this handoff", or /api-handoff.
10 skills
Reviews a file or folder to check whether it follows the conventions of the design or architectural pattern it is meant to use (layered, MVC, MVVM, Clean, Hexagonal, feature modules, CQRS, Repository, Redux, GoF patterns...) and the SOLID principles. The expected pattern is never assumed: it comes from the user, the repo's docs or lint boundaries, the framework, or the repo's own convention, and its source is stated. When the code does not follow it, identifies the pattern it actually uses (including anti-patterns such as big ball of mud, god object, fat controller or anemic model) with file:line evidence, says whether the drift is deliberate or accidental, and recommends incremental improvements grouped into quick wins, planned refactors and strategic moves. Also inventories technical debt (design, code, tests, dependencies, docs, build/config) with a bundled scanner, each item with interest, effort and priority. Read-only: never edits code during the review. Each report is saved to .dev/pattern-review/YYYY-MM-DD-<scope>.md (the folder is created if missing) and never committed. Trigger on "review the architecture", "does this follow the pattern", "¿cumple SOLID?", "revisa el patrón de esta carpeta", "qué deuda técnica tiene", or /code-pattern-review.
10 skills
Human-in-the-loop orchestrator for multi-step dev tasks with a two-level agent hierarchy. Recognized automatically: a UserPromptSubmit hook routes any prompt that asks for a plan or multi-step dev work, and every prompt in plan mode, to this skill first, without having to invoke it. Adopts the Lead's plan, or, when none is given, has a read-only Planner Agent on Opus (orch-planner) draft one for the Lead to approve. Execution runs on the latest Opus. Maps step dependencies and asks whether to run as a single session or multi-agent. In multi-agent mode each step gets a Task Agent on the latest Opus, in its own terminal (orch-sN-name) or inline for small steps and in its own git worktree (each finished step is applied to the Lead's tree as a checked, uncommitted patch), and starts as soon as its dependencies finish. A terminal Task Agent session closes by itself once it writes its result (a Stop hook ends it). Every question reaches the Lead directly in the main session (AskUserQuestion on Claude Code), never left in the plan or another file: the Planner's open questions are asked before the plan is shown, and Task Agents relay theirs through a Blocked result. Task Agents reuse the orchestrator's research and may spawn read-only Research Sub-agents (Sonnet 5) that use graphify first. When the ponytail code-minimalism skill is available, every agent that writes code loads it to avoid unnecessary code, without ever dropping part of a step. Never runs tests: checks run once at the end. Never creates unit tests unless the Lead asks for tests. The orchestrator automatically commits every finished step as its own commit, as the logged-in git user (never with the agent as author or co-author), using Conventional Commits 1.0.0 messages, and never pushes; push, merge, rebase and PRs stay with the Lead. Never guesses on ambiguity, architecture, or destructive actions: escalates to the Lead. Trigger phrases: "create a plan", "crea un plan", "planifica", "orchestrate this", "use
10 skills
White-box security audit of an API's endpoints and the functions behind them. Builds a route map (method, full path, handler, middleware chain, auth) with a bundled route-inventory script, then traces every request input through the handler and every service, repository and helper it calls, checking broken authentication, object- and function-level authorization (BOLA/IDOR, BFLA), SQL/NoSQL/command injection, path traversal and unsafe uploads, SSRF, mass assignment, data and server-path exposure, rate limits and money-flow logic (negative amounts, races, idempotency). Every finding has file:line evidence, the triggering request, severity, OWASP API Top 10 + CWE mapping and a concrete fix; uncertain items are listed separately. Static and read-only: never attacks a running system. Each report is saved to .dev/security/YYYY-MM-DD-<scope>.md (the folder is created if missing) and never committed. Trigger on "audit the endpoints", "security review of the API", "is this route safe", "audita los endpoints", "revisa la seguridad de las rutas", or /endpoint-security-audit.
10 skills
QA agent suite: qa-orchestrator runs QA sessions (spawns test agents in parallel, collects results, triages bugs, generates reports); qa-happy-path tests the main UI flows with Playwright; qa-api-adversary tries to break the API (auth, input validation, duplicates, race conditions, malformed requests); qa-debugger applies minimal fixes for reported bugs; qa-personality-builder creates project-specific QA personalities. Installed together so the orchestrator always has the agents it spawns. Trigger with /qa-orchestrator, "run QA", "start QA session" or "test the PR".
10 skills
Generate strict, isolated unit tests that follow the repo's own runner, mocking library and factories. Test data comes from Faker or existing factories (never hand-written objects), collaborators are mocked with the repo's mocking framework, data and time are seeded and deterministic, and every suite covers happy paths, branches, invalid input, boundaries, errors and side effects with the AAA pattern, and requires at least 90% line, statement, branch and function coverage on the unit under test. Never changes production code; reports suspected bugs instead. Trigger on "write unit tests for", "generate tests", "add test coverage", "refactor these tests", or /unit-test-generator.
10 skills
Clawd, the Claude pet from the desktop app, sits right above the Claude Code CLI prompt, on the right, with its laptop: it waves when you are around, turns sideways, pulls its laptop out and types with sparks flying while Claude works, wears a hard hat in plan mode, brings a smaller helper in its own color next to it for each running subagent (glasses for research, a blue hard hat for planning, a teal laptop for coding), gets knocked out when a command fails, and falls asleep with a floating "Zzz" when you stop typing (60 s by default, set idleSeconds in /config). Type anything to wake it; /pet hides or shows it, and /pet color (or /config) changes its color: a palette name or any hex.