Desenvolvimento

Create an initial Claude Code setup for a brownfield project with monorepo topology (including hybrid submodular configurations).

Audits an existing PagoKit integration in the current project. Checks .gitignore covers .env, that env vars are present and use test-key prefixes, that the webhook secret looks valid, that the webhook handler verifies signatures, that the minimum events for the integrated provider are routed, and that PAGOKIT_INTEGRATION.md exists. Used by /pagokit:doctor. Read-only — never writes files.

Amend an existing Claude Code setup to replace the Bash tool with structured MCP tools, reducing agent reliance on unstructured shell access.

建立新技能、修改和改進現有技能、衡量技能效能。當使用者想要從零開始建立技能、編輯或優化現有技能、執行評估測試、進行基準測試效能分析、或優化技能描述以提升觸發準確度時使用此技能。請確保在使用者提到建立技能、撰寫 skill、skill 開發、技能測試、技能優化、或想要將工作流程轉換為可重複使用的技能時啟用此技能。

Quick test suite to verify Hive tools are working correctly

Use this skill when reviewing mobile code that handles card data, payment tokenization, or third-party payment SDK integrations (Braintree, Stripe, Adyen, Google Pay, Apple Pay, FirstData-style iframe encryptors). The skill catalogues the high-signal attack patterns vuln-scout detects in mobile payment flows — server-controlled tokenization URLs, JavaScript-injection-into-WebView card-data exfiltr

Um tutor socrático que ensina a compreensão de bases de código através de questionamento, desafios e recordação ativa. Use /learn-codebase para integrar-se a um novo código ou aprofundar o entendimento, e ele manterá um diário de aprendizado para rastrear o domínio e agendar revisões.

Build falsifiable causal hypotheses: DAGs, FPCI, equivalence testing.

Use this skill when the user asks for OWASP Top 10 mapping, CWE alignment, or standards-oriented reporting. The directory name stays `owasp-2025` for backward compatibility, but external reports should use official OWASP Top 10 names.

Use when implementing any feature or bugfix, before writing implementation code

GAN-style identity verification -- tests clone fidelity by comparing clone responses against real user messages. Run /twin-test to start a blind taste test, or /twin-test score to see your fidelity score over time.

Detect postMessage handlers that trust unvalidated origins or write attacker-controlled data to dangerous DOM sinks.