Claude Kit SDLC

Plugin claude-kit from marketplace claude-kit in ajyadav013/claude-kit. Commands read from the repo's manifest — 1 month ago.

Skills (127)

• accessibility-review

  UI accessibility (WCAG) review — keyboard operability, focus, ARIA semantics, color contrast, touch targets. Returns prioritized fixes. Distinct from performance/visual review.

• alembic-migrations

  Alembic migration setup and patterns for async SQLAlchemy — async engine + run_sync in env.py, autogenerate, RLS/multi-tenant migrations. Use for alembic init, writing migrations, or debugging migration errors.

• anthropic-vertex-integration

  Claude on Vertex AI via the AnthropicVertex SDK — lazy ADC client init, env-based project/region resolution, async helpers, backoff retry. Use when calling Claude via GCP Vertex AI (not direct Anthropic API).

• api-and-interface-design

  Stable API and interface design patterns. Use when designing REST/GraphQL endpoints, module boundaries, type contracts between modules or frontend/backend, or changing public interfaces.

• api-integration

  Wire the app to a backend API — data fetching, caching, error handling, loading states. Use when connecting to an endpoint, adding a fetch layer, or fixing API error and loading behaviour. React-query detail lives in tanstack-react-query-patterns.

• api-pagination-filtering-sorting

  HTTP query parameter conventions for pagination, filtering, sorting, and search with standardized response metadata. Use when designing list endpoints or building repositories that turn query params into SQL.

• archive-sprint

  Archive a completed sprint's planning docs and update the backlog status.

• async-python-patterns

  Async Python for high-performance services. Use when implementing FastAPI/Temporal/Kafka async handlers, AsyncSession database access, asyncio.gather concurrency, or diagnosing event loop blocking.

• auth-and-rbac

  FastAPI auth patterns — session/JWT chains, argon2id hashing, pyotp TOTP/Email OTP, role-based access control, x-user-data gateway forwarding. Use when building auth dependencies, MFA, or role hierarchies.

• backend-repo-architecture

  Canonical backend repository structure for Python/FastAPI — multi-mode entrypoint, app factory, ConnectionManager, BaseDao, flat vs versioned layout. Use when scaffolding or reorganizing a FastAPI service.

• backlog

  Add a new feature idea to the product backlog. Use when the user wants to log a new idea, feature request, or improvement.

• browser-testing-with-devtools

  Real browser testing via Chrome DevTools MCP — DOM inspection, console analysis, network requests, performance profiling. Use when debugging anything browser-rendered. Requires the chrome-devtools MCP server.

• bug-hunt

  Proactively hunt latent defects across a feature/module by reading source and tracing data flow. Use to find bugs before they ship. Distinct from debugging a known failure or reviewing a diff.

• ci-cd-and-automation

  Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.

• ckit-command-abort

  Abort the in-progress /sdlc run — terminate its authoritative snapshot and clean its worktrees

• ckit-command-init

  Scaffold the claude-kit SDLC config (CLAUDE.md + .claude/rules, agents, skills, hooks) into this project

• ckit-command-sdlc

  Run the full autonomous SDLC pipeline on a task via the orchestrator

• ckit-command-status

  Show claude-kit working memory and installed-config status for this project

• code-review-and-quality

  Multi-axis code review (correctness, security, performance, design) before merging any change. Use to assess quality; not to refactor (use code-simplification) or hunt complexity only (use over-engineering-review).

• code-simplification

  Simplifies/refactors working code for clarity without changing behavior. Use when code is harder to read or maintain than it should be. Distinct from code-review-and-quality (assesses only) and over-engineering-review (delete-list only).

• component-design

  Create or restructure a UI component — architecture, component patterns, accessibility, design-system rules. Use when adding a new component, splitting a large one, or making one reusable. App-level work belongs to frontend-ui-engineering.

• configargparse-yaml-env-layering

  Three-layer service config — YAML defaults, configargparse CLI/env override, Pydantic BaseSettings singleton. Use for Python services with multiple runtime modes and precedence-ordered config sources.

• consolidate-learnings

  Merge duplicate and overlapping .claude/agent-memory/ learnings into one canonical entry per rule and rebuild the index. Use when the SessionStart hook nudges or user says consolidate/clean up learnings.

• containerization-and-deployment

  End-to-end containerization overview for Python/FastAPI services — entrypoint MODE dispatch, cert and keytab bootstrap, Cloud Run and k8s deploy, Makefile dev workflow. Start here for the whole picture; the dockerfile-* skills cover focused work.

• context-engineering

  Optimizes agent context setup. Use when starting a new session, when agent output quality degrades, when switching between tasks, or when you need to configure rules files and context for a project.

• cron-and-scheduled-jobs

  Scheduled jobs across two mechanisms — Kubernetes CronJobs (schedule in Helm values, MODE=cron) and Temporal Schedules. Use when adding periodic jobs or choosing between k8s and Temporal.

• data-engineering-bigquery-gcs

  BigQuery medallion architecture (bronze/silver/gold), parameterized queries, MERGE upserts, partitioning, CDC dedup, Temporal orchestration. Use when building batch ETL pipelines or BigQuery schemas.

• debugging-and-error-recovery

  Guides systematic root-cause debugging. Use when tests fail, builds break, behavior doesn't match expectations, or you encounter any unexpected error. Use when you need a systematic approach to finding and fixing the root cause rather than guessing.

• decision

  Record an architecture decision as an ADR. Use when making significant technology choices, pattern adoptions, or convention changes.

• dependency-verification

  Pre-install check that a package NAME exists and isn't a typosquat, plus intake vetting for third-party agent config (skills, MCP entries, hooks). NOT for judging worth (library-review) or CVE audits (dependency-scanner).

• deploy

  Deploy-and-verify loop — commit, trigger the deployment, watch the pipeline, verify the running instances, test, fix, repeat until clean. Interviews you once for your delivery setup. Use when asked to deploy, ship, or run the ship loop.

• deprecation-and-migration

  Manages deprecation and migration. Use when removing old systems, APIs, or features. Use when migrating users from one implementation to another. Use when deciding whether to maintain or sunset existing code.

• design-patterns-and-conventions

  Cross-cutting design patterns, naming, folder layout, and anti-patterns for production Python/FastAPI backends. Use when architecting services, refactoring, reviewing structure, or debugging session leaks.

• design-system-ops

  Operate a design system over time — drift detection, token architecture, adoption, governance, AI-readiness. Use for system-wide health audits. Do NOT use to build/style components (use component-design).

• distributed-systems-patterns

  Distributed data placement and replication — consistent hashing/vnodes, sharding, N/W/R quorums, KV-store and cache anatomy, gossip failure detection, B-tree vs LSM engines. Use when designing a sharded, replicated, or cached data tier.

• django-async-patterns

  Async Django — when ASGI beats WSGI, async views, the a-prefixed QuerySet API, disabling CONN_MAX_AGE, sync_to_async vs database_sync_to_async, Tasks vs Celery, async DRF via adrf. Use when adding async views or choosing ASGI.

• django-migrations

  Django migration safety — schema and data never mixed, idempotent RunPython, atomic=False, batched backfills, expand/contract for zero downtime, the safe squash sequence, a CI drift check. Use when changing models or writing a migration.

• django-react-integration

  Wiring a React or SPA frontend to Django — same-origin vs separate-origin topologies, CorsMiddleware ordering, session vs JWT auth, a typed client from drf-spectacular, static/media split. Use when a Django project has a React/SPA frontend.

• django-rest-framework-packages

  Pick the right Django REST Framework third-party package instead of hand-rolling. Maps a need — auth, OpenAPI schema, filtering, async, errors — to a vetted package with maintenance status. Use when adding DRF capability or auditing dependencies.

• django-rest-framework-patterns

  Django REST Framework — ViewSets and routers, serializer boundaries, the request-flow ladder, fixing serializer N+1 in get_queryset, drf-spectacular, django-filter, SimpleJWT, pagination. Use when building or reviewing a Django REST API.

• django-service-patterns

  Django project structure — two-tier layout, split settings, apps as domain units, fat models and thin views, a services layer, custom user model, pytest-django, cookiecutter bootstrap. Use when building or restructuring a Django project.

• doc-consolidation

  Harvest ephemeral agent-run reports (REPORT/ANALYSIS/AUDIT/SUMMARY, scratch notes) into canonical committed docs, then delete sources. Do NOT use to author new docs or judge prose (use documentation-and-adrs).

• docker-compose

  Docker Compose for local dev and multi-service orchestration. Use when setting up local infrastructure (postgres/redis/kafka/temporal), one-image-many-roles containers, or env-specific compose files.

• docker-shared
• dockerfile-backend
• dockerfile-frontend
• documentation-and-adrs
• doubt-driven-development
• edge-to-service-trust-boundary
• execute
• express
• fastapi-service-patterns
• file-export-and-reporting
• frontend-repo-architecture
• frontend-ui-engineering
• gcp-cloud-run-github-actions
• gcs-file-storage-patterns
• git-workflow-and-versioning
• grafana-dashboards-and-alerts
• graphql-patterns
• idea-refine
• incident-postmortem
• incremental-implementation
• interview-me
• kafka-config-driven
• kubectl-operations
• kubernetes-workload-hardening
• langfuse-llm-tracing
• library-review
• llm-caching-strategies
• llm-gateway-and-routing
• llm-inference-optimization
• load-testing
• maker-checker
• manual-test
• modernization-and-migration
• multi-tenancy-patterns
• node-express-service
• node-objection-knex
• notifications-and-messaging
• object-oriented-design
• observability-and-logging
• otel-tracing
• over-engineering-review
• pentesterflow-pentest
• performance-optimization
• planning-and-task-breakdown
• playwright-verification
• pydantic-schema-patterns
• python-dao-and-database
• radix-tailwind-component-patterns
• rag-and-model-tuning
• react-hook-form-zod-patterns
• redis-caching-patterns
• refresh-docs
• remember
• safety-critical-patterns
• scope
• sdlc
• security-and-hardening
• security-verification
• shannon-ai-pentest
• shell-review
• shipping-and-launch
• simplification-debt
• smoke-test
• source-driven-development
• spec-driven-development
• sprint
• strix-ai-pentest
• system-design-patterns
• tanstack-react-query-patterns
• task-tracker-sync
• temporal-config-driven
• temporal-developer
• test-driven-development
• test-plan-review
• testing-conventions
• threat-model
• ticketing-and-traceability
• triage
• ui-ux-design
• unit-test
• using-agent-skills
• vitest-rtl-msw-patterns
• zap-vapt-scanning
• zustand-state-patterns

Slash commands (4)

• /claude-kit:abort

  Abort the in-progress /sdlc run — terminate its authoritative snapshot and clean its worktrees

• /claude-kit:init

  Scaffold the claude-kit SDLC config (CLAUDE.md + .claude/rules, agents, skills, hooks) into this project

• /claude-kit:sdlc

  Run the full autonomous SDLC pipeline on a task via the orchestrator

• /claude-kit:status

  Show claude-kit working memory and installed-config status for this project

Subagents (33)

• acceptance-reviewer

  Checks delivered work against every acceptance criterion in the spec, end to end, and confirms all prior gates actually passed. Use when work claims to be done and needs independent sign-off. Read-only accept/reject verdict.

• auditor

  Uses Chrome DevTools MCP to audit pages for accessibility, performance, responsive layout, and console errors. Read-only — produces audit reports.

• dependency-scanner

  Security sub-scanner agent. Audits project dependencies (backend and frontend) for known CVEs — direct and transitive — flags deprecated/outdated packages, and recommends pinned upgrades. Reports only; never edits code.

• developer

  Writes production code from approved specs. Works in an isolated git worktree and responds to code review feedback. Handles backend, frontend, or full-stack implementation depending on the project.

• devils-advocate

  Anti-sycophancy adversarial reviewer. Critiques a plan/spec before approval, and when a gate reaches unanimous PASS. Returns findings, a premortem, and a merits-and-costs balance sheet. Gates the pipeline — nothing is final until it confirms.

• devops-engineer

  Delivery & operability agent. Owns the CI pipeline, build & packaging, release/rollback, environment & secrets, database migrations, and local dev experience for any stack. Container-optional.

• e2e-tester

  Writes end-to-end integration tests simulating real user interactions and validating full user journeys across the application.

• em-reviewer

  Engineering Manager planning adjudicator. De-duplicates one blind specialist panel, applies explicit decision rights, and issues the sole planning PASS or consolidated FAIL before code is written.

• incident-responder

  Production incident commander. Use when prod is broken — errors spiking, latency breach, dependency down, bad deploy. Triages severity, gathers signals, drives mitigation (rollback/flag) FIRST, then root cause.

• maker-checker-maker

  Produces code, design, or specification artifacts for the managed maker-checker loop through a constrained output channel. It cannot mutate the workspace, run commands, delegate, or cause external effects.

• maker-checker-reviewer

  Independently reviews the current code, design, or specification artifact against its frozen contract and returns an evidence-backed verdict. It is read-only, nondelegating, and cannot cause external effects.

• merge-reviewer

  Verifies that parallel work streams (e.g., backend + frontend, or any independent development lanes) are consistent, compatible, and integration-ready. Gates pipeline progression at join points.

• observability-engineer

  Makes a service observable in production — SLOs and SLIs, health and readiness checks, structured logging, alert rules, request tracing. Use when a change needs monitoring or operational readiness. Owns the Observability Ready gate.

• orchestrator

  SDLC Pipeline Controller. Never writes code — only delegates, coordinates, and gates agent progression. Supports parallel execution lanes for independent work streams.

• owasp-reviewer

  Security sub-scanner. Reviews the change against the OWASP Top 10 (2021), tuned to the project's stack — access control (A01), injection (A03), authentication (A07), logging (A09). Reports findings with file:line and remediation; never edits code.

• pentest-scanner

  Dynamic security sub-scanner — runs a penetration test with an authorized installed tool (Strix, Shannon, PentesterFlow, or ZAP) and validates findings with real PoCs. Only for systems you are authorized to test; reports only, never edits code.

• policy-validator

  Security sub-scanner. Validates required security policies — CORS allowlist, auth-endpoint rate limiting, secure session cookies, security headers, input validation, authz chain. PASS/FAIL. Reports only.

• pr-raiser

  Final pipeline agent that runs lint, build, and tests, then creates a structured pull request with proper commit formatting.

• risk-classifier

  Classifies a task or change as low / medium / high / restricted risk and states the required protocol. Read-only — gates how much caution, review, and human approval the work needs before it proceeds.

• sdlc-code-reviewer

  Reviews code changes for bugs, security, performance, and spec compliance. Gates the pipeline — testing cannot start without reviewer approval.

• secret-scanner

  Security sub-scanner. Detects hardcoded secrets, API keys, tokens, passwords, connection strings, and private keys in code, config, compose, CI, and tests — plus accidental .env commits and secrets in git history. Reports only; never edits code.

• security-reviewer

  Reviews a change for security problems — hardcoded secrets, vulnerable dependencies, OWASP Top 10 issues, missing security policies — via four parallel sub-scanners. Use when a change needs a security review. Owns the Security Clear gate.

• senior-backend-dev

  Senior backend developer agent. Handles API endpoint design, database work, migrations, authentication, authorization, and backend testing for any stack.

• senior-backend-reviewer

  Independently reviews one frozen planning artifact for backend feasibility, contracts, data safety, authorization, failure handling, and testability, then performs only assigned finding rechecks.

• senior-frontend-dev

  Senior frontend developer agent handling UI/UX, component architecture, API integration, client state, routing, testing, and performance. Stack-agnostic — adapts to the project's framework and build tool.

• senior-frontend-reviewer

  Independently reviews one frozen planning artifact for frontend states, component and data flow, API fit, accessibility, responsiveness, and testability, then performs only assigned finding rechecks.

• senior-tester

  Independently verifies the tester's coverage, findings, and conclusions. Can be spawned in parallel with a verification lane focus. Testing is not complete without senior tester sign-off.

• spec-doc-writer

  Transforms requirements into a structured specification with developer documentation — API contracts, data models, and implementation steps — in a single pass for any stack.

• story-planner

  Breaks an approved spec into an ordered, dependency-aware set of small implementable stories, and identifies which can run in parallel. Use when work needs splitting into tickets, sequencing, or a parallelisation plan.

• technical-architect

  Reviews a spec or design for architectural soundness — system design, scalability, integration patterns, feasibility, failure modes. Use when a design needs an architecture review before it is built.

• tester

  Validates backend APIs together with the frontend. Verifies API correctness, request/response behavior, UI rendering against spec, integration, error states, and edge cases. Can be spawned in parallel with a testing lane focus.

• ui-designer

  Drafts and self-reviews UI/UX design specs for frontend work. Combines designer and design specialist roles — produces a complete, reviewed design spec in one pass.

• unit-tester

  Writes comprehensive unit test suites for the project. Covers happy paths, edge cases, and error scenarios using the project's test framework.

Hooks (16)

• SessionStart

  bash "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/load-continuity.sh"

• SessionStart

  bash "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/load-learnings.sh"

• SessionStart

  bash "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/load-autonomy.sh"

• PreToolUse

  command -v jq >/dev/null 2>&1 || exit 0; CMD=$(jq -r '.tool_input.command' 2>/dev/null || true); if printf '%s' "$CMD" | grep -qE '(^|[^[:alnum:]_])rm([[:space:]]|$)' && printf '%s' "$CMD" | grep -qE

• PreToolUse

  bash "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/guard-push-main.sh"

• PreToolUse

  bash "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/guard-destructive-git.sh"

• PreToolUse

  bash "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/guard-secrets.sh"

• PreToolUse

  bash "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/guard-kubectl-delete.sh"

• PreToolUse

  command -v jq >/dev/null 2>&1 || exit 0; FP=$(jq -r '.tool_input.file_path // empty' 2>/dev/null || true); if echo "$FP" | grep -qE '(^|/)\.env$|\.pem$|\.key$|(^|/)id_rsa|(^|/)id_ed25519|(^|/)credenti

• PreToolUse

  bash "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/warn-shared-modules.sh"

• PreToolUse

  bash "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/warn-llm-io.sh"

• PreToolUse

  bash "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/warn-sensitive-files.sh"

• PreToolUse

  bash "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/validate-settings.sh"

• Stop

  bash "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/lint-fix.sh"

• Stop

  bash "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/type-check.sh"

• Stop

  bash "${CLAUDE_PLUGIN_ROOT}/hooks/scripts/verify-continuity-writeback.sh"

Similar plugins