pr-safety

Plugin pr-safety from marketplace clankerkit in SlipstreamAI/ClankerKit. Commands read from the repo's manifest — 26 days ago.

Skills (44)

• accessibility-audit

  Audits a UI change against keyboard, name, contrast, and error-state checks with evidence. Use when a screen changes and someone needs a WCAG-oriented pass that says what was actually exercised.

• agent-eval-harness

  Sets up an evaluation harness for an agent or LLM feature with explicit cases and graders. Use when an agent prompt, tool, or model change needs a repeatable pass rate instead of a single impressive example.

• api-contract-check

  Compares an API or schema change with its consumers and flags breaking changes. Use when a pull request changes request or response shapes, status codes, OpenAPI, protobuf, or shared types.

• blast-radius-scan

  Estimates change impact across code, runtime boundaries, and operational workflows. Use when a diff looks small but shared types, config, or data paths may spread the effect.

• ci-failure-triage

  Reads a failing CI log, separates infrastructure failures from product failures, and proposes the smallest fix. Use when a pull request or main branch check is red and the log is the evidence you have.

• code-review

  Reviews a diff and returns severity-ranked findings tied to files and behavior. Use when a human or agent asks for a code review before merge and wants defects, risks, and missing tests rather than a style rewrite.

• db-migration-safety

  Reviews a database migration for lock risk, expand-contract safety, and a reversible or forward-fix plan. Use when a pull request adds SQL or a migration framework change that alters tables, indexes, or backfills.

• dependency-upgrade

  Plans and verifies a dependency bump, including majors, using the changelog and the project's tests. Use when upgrading a direct dependency, especially across a major version, and you need a rollback path.

• deterministic-execution-lane

  Runs a resumable, fail-closed implementation lane with explicit checkpoints. Use when a multi-step change must continue until done or blocked, without silent skips.

• dockerize-and-deploy

  Prepares a container build and deploy checklist with a smoke-test receipt. Use when adding a Dockerfile or shipping an image and you need build, run, and rollback evidence.

• docs-from-code

  Updates README or API docs so the commands and interfaces match the code. Use when docs drift from flags, routes, or setup steps, or when a change needs docs that were verified by running them.

• escalation-and-blockers

  Sets explicit escalation triggers, blocker definitions, and pause boundaries. Use when an agent must decide whether to continue, stop, or hand the work to a human.

• evidence-research-flywheel

  Turns research into confidence-scored claims while keeping sources attached. Use when gathering repo or external evidence and handing off a bounded plan without dropping provenance.

• find-the-real-entrypoints

  Separates true runtime entrypoints from scaffolds, demos, and tests. Use when you need the path a real user, job, or caller hits before changing behavior.

• fix-flaky-test

  Reproduces a flaky test, classifies the cause, and proves a de-flake with repeated runs. Use when a test fails intermittently and quarantine or a rerun is being treated as the fix.

• frontend-ui-verify

  Verifies a user-visible UI change by exercising the flow and recording screenshot or trace evidence. Use when a pull request claims a screen, component, or interaction changed and unit tests are the only proof.

• gate-and-done

  Defines the evidence contract, evaluates explicit merge or release gates, and checks definition-of-done across code, proof, docs, and handoff. Use when a change is called ready and reviewers need one pass or fail contract instead of separate evidence, gate, and done checks.

• incident-postmortem

  Writes a blameless incident postmortem with a timeline, impact, and owned action items. Use when an incident is over or stable and the team needs a record that separates evidence from guesswork.

• legacy-code-archaeology

  Recovers the intent of legacy code from git history, callers, and tests. Use when you must change old code and the reason it exists is not in the current comments.

• map-the-system

  Maps entrypoints, boundaries, dependencies, and blast radius before broad edits. Use when the repo is unfamiliar or a change could cross service, package, or runtime boundaries.

• mcp-server-builder

  Builds or changes an MCP server and proves a tool call against a local transport. Use when adding an MCP tool, resource, or prompt and you need a schema plus a real invocation receipt.

• merge-train-governor

  Governs a single-lane merge queue with triage, readiness gates, and review hygiene. Use when several changes are competing to merge and promotion order must be explicit.

• observability-add

  Adds logs, metrics, or traces that answer a specific production question, without leaking secrets. Use when a feature is shipping and operators could not tell whether it worked or failed.

• onboard-to-repo

  Produces a first-hour orientation of a repository: how it starts, how it is tested, and which entrypoints are real. Use when an agent or human is new to a repo and needs a map before editing.

• operator-handoff

  Writes a handoff another human or agent can continue without hidden chat context. Use when work is pausing, swapping owners, or leaving a session that held the only copy of the plan.

• orchestrator-hardening

  Bootstraps a deterministic orchestration contract for lane routing, escalation, and stop boundaries. Use when an agent session needs capability routing, continuation rules, or a missing control loop in AGENTS.md.

• performance-profile

  Measures a performance claim before and after a change, using the same workload. Use when someone wants a speed or cost improvement and the only evidence so far is a feeling or a single anecdote.

• production-readiness-pass

  Audits resilience, observability, rollback, and runtime assumptions before release. Use when a change is headed to production and operational failure modes are still unproven.

• prompt-injection-hardening

  Hardens features that pass untrusted text into an LLM by separating instructions from data and testing a benign injection fixture. Use when building or reviewing retrieval, email, ticket, or web content that a model will read.

• refactor-safely

  Refactors code while pinning current behavior with characterization tests. Use when renaming, splitting, or moving code and the behavior must stay the same.

• release-notes-and-changelog

  Drafts release notes and a changelog from merged commits or pull requests, and makes a semver call with reasons. Use when cutting a release or updating a changelog and the notes must match the history.

• runtime-proof

  Tests whether a runtime-visible claim is proven by runtime-relevant evidence instead of a synthetic harness. Use when a fix, feature, or deploy claim depends on real execution and a green suite is the only receipt offered.

• safe-pr-prep

  Prepares a pull request with risk framing, proof receipts, and a reviewer-ready summary. Use when opening or updating a PR and the diff needs a claim-to-evidence handoff.

• secrets-and-config-audit

  Audits environment variables, config files, and committed secrets against 12-factor hygiene. Use when reviewing how an app is configured, before deploy, or after a secret may have landed in a file.

• security-review

  Reviews a diff for secrets, injection sinks, and missing authorization on new entrypoints. Use when a change touches auth, user input, queries, shell, files, deserialization, or dependencies and needs severity-ranked findings.

• skill-creator

  Authors a new ClankerKit skill that follows the Agent Skills spec and the local evidence contract. Use when creating or reshaping a SKILL.md, including its frontmatter trigger, metadata, and handoff.

• skill-intake-gate

  Screens a contributed skill for safety, determinism, and Agent Skills spec shape before acceptance. Use when reviewing a new or changed SKILL.md, helper script, or skill proposed for this catalog.

• skill-security-scan

  Reviews a third-party skill directory for unsafe instructions and suspicious scripts before install. Use when adding a skill from outside this catalog, or when skill-intake-gate needs a file-level safety pass.

• tdd-loop

  Runs a red-green-refactor loop and records the command receipt for each step. Use when implementing a behavior and you want the test to fail for the right reason before production code changes.

• test-surface-skeptic

  Judges whether tests prove behavior on real risk surfaces or only the shape of a harness. Use when coverage looks broad but the assertions may be mocks, snapshots, or tautologies.

• trace-the-failure

  Reproduces a failure and traces it boundary by boundary until the cause is evidenced. Use when a bug, red test, or incident needs a deterministic repro before any fix.

• truth-recovery-program

  Runs one parent audit of merged truth, intent drift, and queue quality. Use when history, open work, or prior merges can no longer be trusted at face value.

• truthforge

  Detects false-confidence tests, synthetic evidence, and completion claims that lack runtime-relevant proof. Use when a PR, incident, or agent says a runtime-visible change works or is done and the evidence may be mocked, shallow, or incomplete.

• write-real-tests

  Adds behavior tests that fail for a real reason before the fix and pass after it. Use when a change needs coverage that proves behavior, especially when existing tests only assert mocks, snapshots, or implementation details.

Similar plugins