craft-aiThe Craftsman standard for LLM-powered features — prompt-injection surface, key and spend protection, PII reaching model APIs, and reliability/eval discipline. Use whenever work touches an LLM integration: a chatbot or agent, a RAG pipeline, an LLM call from a route or job, tool/function-calling, or
craft-auditThe front door to the craft skills — a whole-project production-readiness orchestrator that drives the ten per-domain craft skills (ux, frontend, backend, db, security, infra, observability, testing, lint, ai) instead of auditing one surface at a time. It discovers the project's shape, plans an audi
craft-backendThe Craftsman standard for building and reviewing backend code — API routes, request validation, the authentication boundary, service/business logic, error handling, route rate-limit middleware, third-party integrations, and background jobs. Use this WHENEVER the work touches the server side: adding
craft-dbThe Craftsman standard for database work — schema design, migrations, query writing, indexing, and multi-tenant data scoping. Use this WHENEVER the work touches the database in any form: designing or changing schema, writing migrations, modeling tables or relations, writing or optimizing queries, ad
craft-fixThe Craftsman standard for driving fixes against an existing `craft-audit` workspace — "fix the findings", "fix SEC-003", "work through the audit", "start the climb". An ACTION skill, not a domain: it picks findings off the master tracker's climb sequence, re-verifies each is still real, gets the us
craft-frontendThe Craftsman standard for frontend application architecture — components, state management, data fetching, forms, routing, client/server boundaries, performance, error boundaries, and bundle size. Use this WHENEVER the work touches the application layer of a frontend: building components, wiring up
craft-infraThe Craftsman standard for production infrastructure — deployment, env/config, CI/CD, IaC, health/readiness, scaling, platform/edge rate limiting, build/release, rollback. Use WHENEVER work touches infra: deploy, CI gates, env vars, IaC, load failures, platform rate limiting, pooling runtime constra
craft-lintThe Craftsman standard for linting and static quality gates — ESLint version policy, resolved-rule extraction, typed TypeScript linting, React/Next/a11y/security rule hardening, zero-warning CI gates, pre-commit alignment, and migration from weak default configs to an enterprise-grade lint setup. Us
craft-observabilityThe Craftsman standard for production observability — error tracking (Sentry), metrics & dashboards (Grafana), structured logging, tracing, SLOs, and alerting. Use this WHENEVER the work touches observability: adding or reviewing Sentry, wiring Grafana/Prometheus/OpenTelemetry, setting up structured
craft-securityThe Craftsman standard for defensive security hardening — authorization policy (per-resource authZ, IDOR/tenant scoping), input validation & injection prevention, secrets, security headers, CORS, dependency vulnerabilities, XSS/CSRF, and data exposure. Use WHENEVER work touches security: harden an e
craft-testingCraftsman standard for automated testing: strategy, unit/integration/e2e selection, refactor-proof design, flaky tests, mocking boundaries, deterministic data, and merge-gate policy. Use WHENEVER work touches tests: writing/reviewing tests, strategy, "add tests", "why is this flaky", "what should I
craft-uxThe Craftsman standard for UI/UX — design tokens, component patterns, pixel-perfect standards, Tailwind/React implementation, motion craft, an AI-tells anti-pattern catalog, and a two-pass review protocol (static review + live browser audit). Use this whenever designing, building, reviewing, auditin