claude-skills

# Claude Code skills

> 140 Claude Code skills in 16 plugins by Muhammad Basit Ali, in one repository (https://github.com/basitalisandhu/claude-skills) that is also a Claude Code plugin marketplace named `claude-skills`.

Install with `/plugin marketplace add basitalisandhu/claude-skills` then `/plugin install <plugin>@claude-skills`, or clone the repository and run `python3 install.py --user` to copy every skill into `~/.claude/skills/`. A step-by-step guide is at https://basitalisandhu.github.io/claude-skills/guide/install-claude-code-skills/. Each skill is a SKILL.md file with optional standard-library scripts. Skills are edited in their source repositories and synced here daily.

## agent-identity-governance

Nine skills that treat AI agents, service principals, workload identities, API keys and MCP connectors as identities with an inventory, owners, recertification, expiry and an off switch: one inventory across Entra ID, AWS IAM, GitHub and a hand-kept register; a review of Entra agent identities; quarterly recertification sheets per owner; an expiry radar for secrets, certificates, keys and tokens; a register check for MCP servers and connectors; a timeline of one agent's actions from audit exports; a kill switch runbook with a coverage check; a leaked credential response pack with hashed evidence; and a hash chain that makes an agent audit log tamper-evident and shows actions it never recorded. Standard-library scripts over saved exports, no network. Source: https://github.com/basitalisandhu/agent-identity-governance-skills

- [agent-action-timeline](https://basitalisandhu.github.io/claude-skills/plugins/agent-identity-governance/agent-action-timeline/): Reconstruct every action one agent or bot identity took, in time order, from saved Entra sign-in and audit logs, CloudTrail, the GitHub audit log and application logs in JSON lines, and flag bursts, unusual first-seen actions and actions outside a declared allow list.
- [agent-audit-log-integrity](https://basitalisandhu.github.io/claude-skills/plugins/agent-identity-governance/agent-audit-log-integrity/): Seal an agent's audit log (JSON lines from a hook, MCP gateway or agent runtime) as a SHA-256 or HMAC hash chain, verify it later for edited, deleted, inserted or reordered lines and truncation against a stored head, and list actions the log never recorded.
- [agent-kill-switch-runbook](https://basitalisandhu.github.io/claude-skills/plugins/agent-identity-governance/agent-kill-switch-runbook/): Prepare the kill switch runbook to stop one agent identity fast: ordered steps to disable it, end sessions, remove credentials and grants, block it at the gateway and confirm it stopped in the audit log, each with a read-only verification command.
- [agent-recertification](https://basitalisandhu.github.io/claude-skills/plugins/agent-identity-governance/agent-recertification/): Run the quarterly recertification of agent and workload identities: one review sheet per owner to re-attest, saying what each identity can do, when it last acted and what changed, plus a tracking CSV.
- [connector-register](https://basitalisandhu.github.io/claude-skills/plugins/agent-identity-governance/connector-register/): Keep an approved register of the MCP servers, connectors and plugins your agents may use, and check every entry has an owner, purpose, data classification, permissions and review date.
- [credential-expiry-radar](https://basitalisandhu.github.io/claude-skills/plugins/agent-identity-governance/credential-expiry-radar/): Find the secrets, certificates, access keys and tokens that have expired or soon will, across Entra app and Agent ID blueprint credentials, AWS IAM, GitHub fine-grained tokens and a CSV of other keys, bucketed at 7, 30 and 90 days with an action list per owner.
- [entra-agent-id-review](https://basitalisandhu.github.io/claude-skills/plugins/agent-identity-governance/entra-agent-id-review/): Review the Entra identities and service principals your AI agents use, so each one has an owner or sponsor, only the permissions it needs (including those inherited from an Agent ID blueprint), current credentials, safe redirect URIs and Conditional Access cover.
- [leaked-credential-response](https://basitalisandhu.github.io/claude-skills/plugins/agent-identity-governance/leaked-credential-response/): Respond to a leaked agent key, API token or secret: what it could reach, what happened after the leak time, which credentials to replace first, and an evidence folder with SHA-256 hashes.
- [nhi-inventory](https://basitalisandhu.github.io/claude-skills/plugins/agent-identity-governance/nhi-inventory/): Inventory every non-human or machine identity your agents and automations run as (service principals, IAM roles and users, GitHub apps and tokens), with owner, last use, credential count and oldest credential, and flag the ownerless and the unused.

## agent-security

Security skills for LLM agents: threat model a codebase, audit agent configuration, review MCP servers, trace prompt injection to tool calls, check consequential tools for human approval gates, look up incident precedents, run security evals, scan with Semgrep, and review agent session logs for injection, misuse, egress and loops. Includes guard hooks for Bash and an optional incident-database MCP server. Source: https://github.com/basitalisandhu/agent-security-skills

- [agent-config-audit](https://basitalisandhu.github.io/claude-skills/plugins/agent-security/agent-config-audit/): Scan an AI agent configuration for risky permissions, leaked secrets, unpinned MCP servers and prompt injection in instruction files, with a bundled scanner that masks secrets.
- [agent-eval-harness](https://basitalisandhu.github.io/claude-skills/plugins/agent-security/agent-eval-harness/): Build a security evaluation for an agent with benign tasks, injections planted in tool results, and utility and attack success rate (ASR) scores, using a bundled standard-library runner and a policy hook.
- [agent-session-log-review](https://basitalisandhu.github.io/claude-skills/plugins/agent-security/agent-session-log-review/): Review an AI agent session log, transcript or chat export for signs that prompt injection took effect, tool misuse, destructive commands, denied actions retried another way, data leaving to unknown hosts and loops, with a bundled script that normalises the log and writes a timeline of flagged events.
- [agent-threat-model](https://basitalisandhu.github.io/claude-skills/plugins/agent-security/agent-threat-model/): Write a threat model or threat assessment for an LLM-agent system by drafting principals, tools, channels, data stores and controls in YAML from the code, running the atm analyser for STRIDE and OWASP findings, and summarising with incident precedents.
- [incident-lookup](https://basitalisandhu.github.io/claude-skills/plugins/agent-security/incident-lookup/): Look up 80 coded AI-agent security incidents from 2023 to 2026 (prompt injection, tool poisoning, exfiltration and more), mapped to OWASP Agentic and LLM Top 10 and MITRE ATLAS techniques, and list real precedents with sources.
- [mcp-server-review](https://basitalisandhu.github.io/claude-skills/plugins/agent-security/mcp-server-review/): Review an MCP server you wrote or plan to install for missing authentication, binding to a public interface, tool description poisoning, path traversal, SSRF, weak input validation and secrets in logs, then report a verdict per area with severity and file:line.
- [prompt-injection-review](https://basitalisandhu.github.io/claude-skills/plugins/agent-security/prompt-injection-review/): Trace untrusted input such as web pages, emails, tickets and tool results to consequential tool calls in agent code (sending replies, HTTP requests, shell, payments), and judge each path against provenance and approval rules.
- [secure-agent-checklist](https://basitalisandhu.github.io/claude-skills/plugins/agent-security/secure-agent-checklist/): Run a pre-ship security checklist for an LLM agent covering identity, least privilege, approvals, sandboxing, audit logging, kill switch, supply chain and evals, and report pass, fail or n.a. per item with evidence for a go or no-go sign-off.
- [semgrep-agentic](https://basitalisandhu.github.io/claude-skills/plugins/agent-security/semgrep-agentic/): Scan Python, JavaScript and TypeScript agent code with 36 Semgrep rules (model output flowing into shells, subprocess, SQL, paths or HTML, user input in system prompts, MCP servers without auth, leaked provider keys), with a bundled offline fallback, and triage the hits.
- [tool-approval-gate-audit](https://basitalisandhu.github.io/claude-skills/plugins/agent-security/tool-approval-gate-audit/): Find every tool a Python agent's model can call, decide which have consequential side effects (deleting files, sending email, cloud writes), and check whether a human approves each one through a deterministic gate that cannot fail open, with gaps reported per tool at file and line.

## aws-security

AWS security skills for Claude Code: read-only account audit, SCP guardrail builder and linter, landing zone blast-radius design, IAM least-privilege review, Security Hub and GuardDuty triage, least-privilege access for AI agents with a kill switch, incident response runbooks, spend guardrails, a sandbox OU guardrail pack an audit of what an agent role session did, from CloudTrail, and a mapper from failing Security Hub controls to the SCPs, settings and IaC checks that prevent them. Scripts are standard-library Python and work offline on specs and saved aws CLI output. Source: https://github.com/basitalisandhu/aws-security-skills

- [agent-safe-aws-access](https://basitalisandhu.github.io/claude-skills/plugins/aws-security/agent-safe-aws-access/): Plan least-privilege AWS access for an AI coding agent from a short spec, producing the trust policy, task-scoped permissions, a permission boundary, an SCP backstop, the assume-role command and a kill switch, or review an existing agent role against the same rules.
- [aws-account-audit](https://basitalisandhu.github.io/claude-skills/plugins/aws-security/aws-account-audit/): Audit one AWS account for security gaps by collecting inventory with read-only aws CLI commands and evaluating 17 checks offline (root MFA and keys, CloudTrail, GuardDuty, S3 public access, open security groups, old keys, admin policies, encryption), with severity, evidence and a fix per finding.
- [aws-agent-session-audit](https://basitalisandhu.github.io/claude-skills/plugins/aws-security/aws-agent-session-audit/): Audit what an AI coding agent did in an AWS account and which permissions it never needed, from a saved CloudTrail export of the agent's role session: actions by service, writes versus reads, calls outside a declared allow list, logging tampering, destructive and IAM calls, resources touched and errors.
- [aws-incident-response-runbook](https://basitalisandhu.github.io/claude-skills/plugins/aws-security/aws-incident-response-runbook/): Write a filled-in AWS incident response runbook for a leaked access key, a compromised EC2 instance, a public S3 bucket, suspicious IAM activity, ransomware that deletes S3 objects or EBS volumes, or crypto-mining: read-only inventory first, containment commands that each need confirmation, evidence, recovery and templates; a triage mode picks the scenario from GuardDuty findings.
- [aws-spend-guardrails](https://basitalisandhu.github.io/claude-skills/plugins/aws-security/aws-spend-guardrails/): Generate AWS Budgets, a Cost Anomaly Detection monitor and a sandbox SCP that denies expensive services (large GPU instances, SageMaker and similar), then check an exported Cost Explorer report for spikes.
- [iam-least-privilege-review](https://basitalisandhu.github.io/claude-skills/plugins/aws-security/iam-least-privilege-review/): Review AWS IAM policies offline, from policy files or a get-account-authorization-details export, for over-broad permissions and privilege-escalation paths (admin, wildcards, unscoped iam:PassRole, NotAction in Allow, known escalation combinations), ranked by severity with a tightened policy per document.
- [landing-zone-blast-radius](https://basitalisandhu.github.io/claude-skills/plugins/aws-security/landing-zone-blast-radius/): Design an AWS Organizations landing zone with one account per workload and environment, and show what a compromise of each account can reach.
- [preventive-control-mapper](https://basitalisandhu.github.io/claude-skills/plugins/aws-security/preventive-control-mapper/): Turn failing Security Hub controls and Prowler checks (S3, EC2, IAM, CloudTrail, KMS, RDS and more) into the preventive controls that stop the same misconfiguration coming back: an SCP statement, an account or declarative-policy setting, an IaC check, plus the AWS Config rule that detects a regression.
- [sandbox-account-guardrail-pack](https://basitalisandhu.github.io/claude-skills/plugins/aws-security/sandbox-account-guardrail-pack/): Generate a guardrail pack for an AWS sandbox OU where engineers and AI agents experiment: SCPs that pass the bundled size checks (region allowlist, IMDSv2, no root, protected logging), AWS Budgets, a checklist for new sandbox accounts and a tag-based auto-expiry design.
- [scp-guardrails](https://basitalisandhu.github.io/claude-skills/plugins/aws-security/scp-guardrails/): Write, review and lint AWS Organizations service control policies: build SCPs from a short spec (region allowlist, break-glass roles, protected logging, no root user, IMDSv2, no public S3 ACLs) under the SCP character limit, and lint any SCP for Allow statements, region denies that break global services, NotAction misuse and size.
- [security-hub-triage](https://basitalisandhu.github.io/claude-skills/plugins/aws-security/security-hub-triage/): Turn a Security Hub or GuardDuty findings backlog into an owner-assigned next-actions list, offline from exports.

## cc-setup-tooling

Fourteen skills that keep a Claude Code setup safe and tidy: review a third-party skill or plugin before installing it (skill-scan-gate, cc-plugin-lock and an offline inventory), lint SKILL.md front matter and fix its quoting, score descriptions against labelled prompts, estimate what a project loads on every turn, merge least-privilege permission rules and test them with claude-perm-sim, review the sandbox settings across scopes and flag what leaves it open, list the tool calls that would stop an unattended run on a permission prompt, show what each subagent can reach, add up the API usage in session transcripts and show which part moved, count shell commands that failed because of zsh, PowerShell or the Windows length limit, check what each compaction summary dropped, scaffold and test hooks with cc-hooks, find skills that collide or shadow each other, and find what breaks on other hosts and operating systems. Standard-library scripts, no network. Source: https://github.com/basitalisandhu/claude-code-tooling-skills

- [compaction-loss-check](https://basitalisandhu.github.io/claude-skills/plugins/cc-setup-tooling/compaction-loss-check/): Check each compaction in a Claude Code session transcript: trigger, tokens before and after, time since the last user message, and whether the summary kept the standing rules the user gave, the files edited, branches and pull requests created and open to-dos.
- [context-budget-audit](https://basitalisandhu.github.io/claude-skills/plugins/cc-setup-tooling/context-budget-audit/): Audit what a Claude Code project puts in context on every turn (CLAUDE.md and its imports, AGENTS.md, rules files, skill descriptions, MCP tool schemas from saved tools/list output, hooks), estimate the tokens, rank the biggest items and flag duplicates and stale sections.
- [hook-author](https://basitalisandhu.github.io/claude-skills/plugins/cc-setup-tooling/hook-author/): Write and test a Claude Code hook with cc-hooks: pick the event and the decision (block, warn, allow or modify) from a table, scaffold the hook, its fixtures, a pytest file and the settings block from a short spec, then prove it with cc-hooks test.
- [permissions-builder](https://basitalisandhu.github.io/claude-skills/plugins/cc-setup-tooling/permissions-builder/): Build a least-privilege .claude/settings.json permission set from what a project actually needs: generate MCP rules with claude-mcp-allow, merge them with your own allow, ask and deny lists, put deny first, diff against the current file, then test the result with claude-perm-sim against the commands the team runs.
- [sandbox-config-review](https://basitalisandhu.github.io/claude-skills/plugins/cc-setup-tooling/sandbox-config-review/): Review a Claude Code project's sandbox settings across user, project, local and managed scopes, show what the operating system actually enforces around Bash commands, and flag what leaves it open: sandbox off, fail-open, the unsandboxed retry, broad excludedCommands, wildcard domains, readable credentials and loosening values a cloned repository ships.
- [session-usage-ledger](https://basitalisandhu.github.io/claude-skills/plugins/cc-setup-tooling/session-usage-ledger/): Add up the API usage recorded in Claude Code session transcripts per day, session, model and project (calls, input, output, cache reads, 5-minute and 1-hour cache writes, cache-hit ratio, first-call size, subagent share) and compare two periods to show which part moved.
- [shell-slip-audit](https://basitalisandhu.github.io/claude-skills/plugins/cc-setup-tooling/shell-slip-audit/): Pair every Bash and PowerShell call in Claude Code session transcripts with its result and count the calls that failed because of the shell: zsh glob, equals and syntax errors, bash syntax sent to PowerShell, commands cut at the Windows length limit, including silent failures the call did not mark as errors.
- [skill-collision-check](https://basitalisandhu.github.io/claude-skills/plugins/cc-setup-tooling/skill-collision-check/): Find installed skills that share a name, shadow each other or overlap so much in description that the wrong one gets picked, across personal, project, managed, plugin and copied folders, and say which one wins.
- [skill-description-linter](https://basitalisandhu.github.io/claude-skills/plugins/cc-setup-tooling/skill-description-linter/): Lint the front matter of your SKILL.md files so each skill is listed and picked correctly: double-quoted description under 600 characters, a verb first, a quoted trigger phrase, Use when and Not for sentences, name equal to the folder, strict-YAML safety and a Limits section, with --fix for the quoting.
- [skill-portability-check](https://basitalisandhu.github.io/claude-skills/plugins/cc-setup-tooling/skill-portability-check/): Check a skill folder for what breaks on other hosts and operating systems: unquoted YAML colons, hard-coded home paths, CLAUDE_PLUGIN_ROOT with no fallback, GNU-only or BSD-only shell, Python open calls without encoding, POSIX-only calls, Windows path separators, CRLF and symlinks, with a fix hint per file.
- [skill-supply-chain-review](https://basitalisandhu.github.io/claude-skills/plugins/cc-setup-tooling/skill-supply-chain-review/): Review a third-party skill or plugin before you install it: run skill-scan-gate on the folder, lock it with cc-plugin-lock, read every script for network and shell use with a bundled offline inventory, and write a one-page verdict.
- [skill-trigger-eval](https://basitalisandhu.github.io/claude-skills/plugins/cc-setup-tooling/skill-trigger-eval/): Measure whether a skill's description triggers on the prompts it should and stays quiet on the ones it should not, using a labelled prompt set and transparent lexical scoring, and compare two description versions by precision and recall.
- [subagent-tool-scope-review](https://basitalisandhu.github.io/claude-skills/plugins/cc-setup-tooling/subagent-tool-scope-review/): Review every Claude Code subagent file for the tools it can actually reach: agents with no tools line inherit every built-in and MCP tool, lookalike fields such as allowed-tools are ignored, and reviewers that can write or run a shell.
- [unattended-run-preflight](https://basitalisandhu.github.io/claude-skills/plugins/cc-setup-tooling/unattended-run-preflight/): Replay the tool calls of a Claude Code run (a session log or a list) against the permission rules in your settings files and show which calls would stop a scheduled task, routine, CI job or claude -p run on a prompt or a deny rule, with the narrowest allow rule for each.

## code-quality

Eight skills for keeping a codebase healthy: a review checklist, refactor planning, dead code and complexity reports, naming and error-handling audits, type coverage for Python and TypeScript, and a test gap finder. Source: https://github.com/basitalisandhu/claude-dev-skills

- [complexity-report](https://basitalisandhu.github.io/claude-skills/plugins/code-quality/complexity-report/): Rank the functions in a Python or JavaScript/TypeScript tree by cyclomatic complexity, length and nesting depth with a bundled script, then say which are most tangled and how to simplify them.
- [dead-code-finder](https://basitalisandhu.github.io/claude-skills/plugins/code-quality/dead-code-finder/): Shrink a codebase safely: a bundled script lists probably-unused functions, classes, unused methods and exports in a Python or JavaScript/TypeScript tree, each candidate is confirmed by searching for dynamic use, and the skill proposes a safe order to remove them.
- [error-handling-review](https://basitalisandhu.github.io/claude-skills/plugins/code-quality/error-handling-review/): Review how a service or library handles failures: places that swallow an exception, call out without a timeout or retry, errors without context, raw database or internal errors returned to users, inconsistent error types across layers; then propose one consistent error policy and strategy (which error types, what wraps what, what gets retried) with examples.
- [naming-audit](https://basitalisandhu.github.io/claude-skills/plugins/code-quality/naming-audit/): Audit function, variable, method and module names in a file or diff: are the names any good, consistent with how the project names things, or misleading names that lie about behaviour (a getter that creates), then propose renames with a migration path for public ones.
- [refactor-plan](https://basitalisandhu.github.io/claude-skills/plugins/code-quality/refactor-plan/): Plan a safe refactor of a module, package or large file as small, behaviour-preserving commits, with the tests that guard each step and a rollback point: split a 3000-line file into smaller units, untangle packages that import each other in a circle, or clean up code when behaviour must not change.
- [review-checklist](https://basitalisandhu.github.io/claude-skills/plugins/code-quality/review-checklist/): Review a pull request, diff, patch or branch against a fixed checklist (correctness, tests, error handling, security, performance, readability, compatibility) and give findings with file and line references and a verdict: approve or request changes.
- [test-gap-finder](https://basitalisandhu.github.io/claude-skills/plugins/code-quality/test-gap-finder/): Find the source modules that have no tests and prioritise which to cover first by risk: a bundled script maps modules to their tests by naming convention and imports and shows what is missing.
- [type-coverage](https://basitalisandhu.github.io/claude-skills/plugins/code-quality/type-coverage/): Measure how much of a Python or TypeScript codebase is type-annotated with a bundled script (parameter and return annotations per function, explicit any counts), count functions missing annotations, find the least-typed files, and plan a gradual typing rollout with a CI threshold.

## compliance-evidence

Compliance evidence skills for Claude Code: build integrity-checked evidence packs from GitHub, AWS and Microsoft 365 exports, map them to ISO 27001 and SOC 2 control identifiers, draft auditor narratives and security questionnaire answers that cite evidence or say not assessable, map a pack to the Essential Eight maturity levels, digest vendor SOC 2 reports, ISO certificates and bridge letters, map Maester results to control identifiers, plan the evidence to collect per control as a PBC list that shows what is stale, missing or overdue, and check an ISO 27001:2022 Statement of Applicability for missing controls, unjustified decisions, status, evidence and review dates. Standard-library Python scripts read exports already on disk and make no network calls. Source: https://github.com/basitalisandhu/compliance-evidence-skills

- [auditor-narrative-drafter](https://basitalisandhu.github.io/claude-skills/plugins/compliance-evidence/auditor-narrative-drafter/): Draft short ISO 27001 or SOC 2 control narratives strictly from a control map, with an inline [evidence: file#field] citation on every evidence sentence, and lint any narrative for uncited claims, citations that do not trace, contradicted states, certainty wording and pasted framework text.
- [aws-identity-and-logging-evidence](https://basitalisandhu.github.io/claude-skills/plugins/compliance-evidence/aws-identity-and-logging-evidence/): Turn saved aws CLI output from one AWS account into ISO 27001 and SOC 2 evidence rows for logging, access control and backup (CloudTrail, root and console MFA, access key age, password policy, GuardDuty, Config, S3 public access block, AWS Backup), telling AccessDenied (not assessable) apart from not configured (contradicted).
- [control-map-from-exports](https://basitalisandhu.github.io/claude-skills/plugins/compliance-evidence/control-map-from-exports/): Map the exports in an evidence pack to ISO 27001:2022 Annex A or SOC 2 control identifiers and report per control supported, contradicted or not assessable, citing the exact file, field and value, plus the gaps; every file's SHA-256 is re-checked first.
- [essential-eight-evidence-map](https://basitalisandhu.github.io/claude-skills/plugins/compliance-evidence/essential-eight-evidence-map/): Map an evidence pack to the ASD Essential Eight Maturity Model (November 2023) and show, for each of the eight strategies, which ML1 to ML3 requirements have evidence, which do not, and the maturity level the strategy can claim today, from the pack's manifest and a mapping you own.
- [evidence-collection-plan](https://basitalisandhu.github.io/claude-skills/plugins/compliance-evidence/evidence-collection-plan/): Plan what evidence to collect for each ISO 27001:2022 or SOC 2 control before collection starts: an auditor-style PBC request list with the source system, a read-only way to obtain it, how often, who owns it and the due date, then, against an evidence pack, which requests are met, stale, missing or overdue.
- [evidence-pack-builder](https://basitalisandhu.github.io/claude-skills/plugins/compliance-evidence/evidence-pack-builder/): Turn a folder of exports already on disk into an integrity-checked ISO 27001 or SOC 2 evidence pack, recording who collected each file, when, from which system and with which command, with a SHA-256 per file, a manifest and later re-verification that flags changed, missing or stale files.
- [github-change-control-evidence](https://basitalisandhu.github.io/claude-skills/plugins/compliance-evidence/github-change-control-evidence/): Turn saved gh exports of one GitHub repository into ISO 27001 and SOC 2 evidence rows for change and vulnerability management, checking branch protection or rulesets, required reviews, an approval by someone other than the author on every merged pull request, CODEOWNERS, signed commits, Dependabot and secret scanning, and separating switched off from not assessable.
- [iso27001-soa-check](https://basitalisandhu.github.io/claude-skills/plugins/compliance-evidence/iso27001-soa-check/): Check an ISO 27001:2022 Statement of Applicability exported as CSV or JSON before an assessor reads it: all 93 Annex A controls present, no unknown, duplicate or 2013-style ids, a clear yes or no, a justification for every inclusion and exclusion, status, evidence that exists, owners and review dates, with counts per theme and risks treated by excluded controls.
- [maester-control-map](https://basitalisandhu.github.io/claude-skills/plugins/compliance-evidence/maester-control-map/): Map a Maester results file (Microsoft 365 and Entra ID security tests) to ISO 27001 and SOC 2 control identifiers through a mapping you own, report each control as supported, contradicted or not assessable with the tests behind it, and add control columns to the test list.
- [security-questionnaire-drafter](https://basitalisandhu.github.io/claude-skills/plugins/compliance-evidence/security-questionnaire-drafter/): Draft answers to a customer or vendor security questionnaire only from your own evidence pack and policy folder, citing the policy section or evidence file behind every answer and marking questions with nothing behind them as not assessable instead of inventing an answer.
- [vendor-attestation-digest](https://basitalisandhu.github.io/claude-skills/plugins/compliance-evidence/vendor-attestation-digest/): Digest a register of vendor SOC 2 reports, ISO 27001 certificates and bridge letters against your vendor list: expired or expiring documents, gaps after a SOC 2 period with no bridge letter, qualified opinions, noted exceptions, services outside scope and unreviewed user entity controls, with an action list per owner.

## data

Six skills for data and API work: SQL query review, schema migration planning, CSV profiling, JSON Schema inference from samples, regex building with test cases, and OpenAPI 3 contract review. Source: https://github.com/basitalisandhu/claude-dev-skills

- [api-contract-review](https://basitalisandhu.github.io/claude-skills/plugins/data/api-contract-review/): Review an OpenAPI 3.x spec (openapi.yaml or JSON) for consistency, versioning, error responses and client friendliness after a bundled script lints it: missing operationIds, undeclared path parameters, responses without schemas, http servers, missing security schemes, dangling components, naming.
- [csv-profiler](https://basitalisandhu.github.io/claude-skills/plugins/data/csv-profiler/): Profile a CSV or TSV file with a bundled script (column types, nulls, distinct counts, ranges, candidate keys, ragged and duplicate rows, mixed types, whitespace) and turn it into import decisions: column types for a table, cleaning steps and validation rules.
- [json-schema-author](https://basitalisandhu.github.io/claude-skills/plugins/data/json-schema-author/): Write a JSON Schema (draft 2020-12) for an API payload, config file, webhook or event: a bundled script infers a draft from sample documents (types, required fields, nullability, formats, enums, bounds), then it is tightened by hand with constraints, descriptions, examples and additionalProperties.
- [regex-builder](https://basitalisandhu.github.io/claude-skills/plugins/data/regex-builder/): Write and test regular expressions that match what they should and nothing else: a bundled script runs a pattern against labelled sample lines, shows each match and captured group, and warns on patterns that can backtrack catastrophically.
- [schema-migration-plan](https://basitalisandhu.github.io/claude-skills/plugins/data/schema-migration-plan/): Plan a database schema migration on a live database as an expand and contract sequence of backwards-compatible, reversible steps that work with the running app version: lock and downtime per step, batched backfills for large tables, rollback.
- [sql-query-review](https://basitalisandhu.github.io/claude-skills/plugins/data/sql-query-review/): Review SQL queries, ORM-generated SQL and query plans for correctness and performance: injection, implicit casts, NULL logic, non-sargable predicates, missing indexes, N+1 patterns, unbounded result sets, lock contention and transaction scope, using a fixed checklist and EXPLAIN reading notes for PostgreSQL, MySQL and SQLite.

## debugging

Six skills for finding the cause of a failure: minimise a bug reproduction, cluster log lines, find flaky tests in JUnit XML, explain a stack trace, summarise a py-spy, pprof or cProfile profile, and work a memory leak checklist. Source: https://github.com/basitalisandhu/claude-dev-skills

- [bug-repro-minimiser](https://basitalisandhu.github.io/claude-skills/plugins/debugging/bug-repro-minimiser/): Turn a vague bug report or a long failing script into the smallest reliable reproduction: reduce it to a single command or test that fails every time and still shows the bug, with the environment, input and expected versus actual result pinned down.
- [flaky-test-hunter](https://basitalisandhu.github.io/claude-skills/plugins/debugging/flaky-test-hunter/): Find tests that pass and fail without code changes by comparing JUnit XML reports from several runs with a bundled script, then classify each flaky test by cause (ordering, timing, shared state, resources, environment) and prescribe the fix.
- [log-triage](https://basitalisandhu.github.io/claude-skills/plugins/debugging/log-triage/): Reduce a large log file or production log dump to its distinct message templates with counts, levels, first and last occurrence and attached stack traces using a bundled clustering script, then rank what to look at first.
- [memory-leak-checklist](https://basitalisandhu.github.io/claude-skills/plugins/debugging/memory-leak-checklist/): Diagnose a service whose memory keeps growing or only goes up, with a fixed checklist: confirm it is a real leak and not a cache warming up or fragmentation, measure with heap tools (tracemalloc, objgraph, Node heap snapshots, Go pprof heap, JVM histograms), follow the retaining paths to what holds the objects, and fix the usual causes (unbounded caches, listeners, closures, registries, pools).
- [perf-profile-reader](https://basitalisandhu.github.io/claude-skills/plugins/debugging/perf-profile-reader/): Read a captured CPU profile (py-spy collapsed stacks or dump, Go pprof text output, Python cProfile output) with a bundled script, find the few functions and calls that hold the time, say whether it is real work or waiting, and what to optimise or fix first.
- [stack-trace-explainer](https://basitalisandhu.github.io/claude-skills/plugins/debugging/stack-trace-explainer/): Explain a stack trace, traceback, panic or crash from Python, JavaScript and Node, Java and the JVM, Go, Rust, .NET, Ruby or PHP: which frame holds the real fault versus where it surfaced (including a Caused by chain), what the error type means, and what to check next.

## devops

Nine skills for shipping and operating software: Dockerfile hardening, GitHub Actions workflow authoring and validation, Kubernetes manifest review, Terraform review, a Terraform apply gate against a written policy, crontab diagnosis, .env key diffs, release notes from git history and a semver advisor. Source: https://github.com/basitalisandhu/claude-dev-skills

- [cron-doctor](https://basitalisandhu.github.io/claude-skills/plugins/devops/cron-doctor/): Make cron jobs run when they should: a bundled script validates every crontab line, explains each schedule in plain words with its next runs, and flags missing output redirection, unescaped percent signs, PATH assumptions, day-of-month plus day-of-week confusion, DST-sensitive hours, overlaps and duplicates; then the entries are fixed with locking and logging.
- [dockerfile-hardening](https://basitalisandhu.github.io/claude-skills/plugins/devops/dockerfile-hardening/): Harden a Dockerfile before the image ships: a bundled script flags running as root, unpinned base images or the latest tag, secrets in ENV or ARG, remote scripts piped to a shell, uncleaned apt layers, world-writable files and no HEALTHCHECK, and the file is rewritten as a smaller, pinned, non-root multi-stage build.
- [env-diff](https://basitalisandhu.github.io/claude-skills/plugins/devops/env-diff/): Compare the keys of .env.example against real .env files with a bundled script, listing missing, extra, empty and duplicate keys without ever printing a value.
- [github-actions-author](https://basitalisandhu.github.io/claude-skills/plugins/devops/github-actions-author/): Write or review GitHub Actions workflows in .github/workflows with least-privilege permissions, SHA-pinned actions, timeouts, concurrency and caching, checked by a bundled linter for missing or too permissive permissions, pull_request_target checkout of forks, expression injection in run steps, unpinned actions and literal secrets.
- [k8s-manifest-review](https://basitalisandhu.github.io/claude-skills/plugins/devops/k8s-manifest-review/): Review Kubernetes manifests (Deployments, StatefulSets, DaemonSets, Jobs, CronJobs, Pods, Services, Secrets) with a bundled script for missing limits and probes, privileged or root containers, latest or mutable image tags, host namespaces, hostPath mounts, inline secrets and no seccomp, then write corrected, production-ready YAML.
- [release-notes](https://basitalisandhu.github.io/claude-skills/plugins/devops/release-notes/): Generate release notes from a git commit range with a bundled script that groups commits by Conventional Commits type (breaking, features, fixes, performance, docs, build), links commits and issues, and lists contributors; then edit them into notes a user can read.
- [semver-advisor](https://basitalisandhu.github.io/claude-skills/plugins/devops/semver-advisor/): Decide the next version number (major, minor, patch or a pre-release) for a library, service, REST API, CLI or schema from the actual changes, with a table of what counts as a breaking change for each, and explain the bump with evidence.
- [terraform-apply-gate](https://basitalisandhu.github.io/claude-skills/plugins/devops/terraform-apply-gate/): Decide whether a saved Terraform plan may be applied under the team's written rules: a bundled script checks the plan JSON against a small YAML policy (forbidden destroys by type, required tags, a replacement ceiling, protected names, allowed providers) and prints allow, ask or block with a reason per resource.
- [terraform-review](https://basitalisandhu.github.io/claude-skills/plugins/devops/terraform-review/): Review Terraform or OpenTofu files (main.tf, modules, variables) against a checklist: state and backend safety, version pinning, typed and validated variables, secrets in variables, public exposure (open security groups, public buckets, 0.0.0.0/0), missing encryption and logging defaults, lifecycle and destroy protection.

## docs

Six skills for writing documentation that stays accurate: README author, ADR writer, changelog keeper, onboarding doc, API docs extracted from docstrings and JSDoc, and a postmortem writer. Source: https://github.com/basitalisandhu/claude-dev-skills

- [adr-writer](https://basitalisandhu.github.io/claude-skills/plugins/docs/adr-writer/): Write an Architecture Decision Record for a technical choice, with context, the options considered and their trade-offs, the decision and its consequences, in a fixed format with a status lifecycle (proposed, accepted, superseded), numbered and stored in the repository.
- [api-docs-from-code](https://basitalisandhu.github.io/claude-skills/plugins/docs/api-docs-from-code/): Generate an API reference from source: a bundled script extracts Python docstrings and JavaScript or TypeScript JSDoc into Markdown or JSON, lists public functions and classes with no docstring and gives a documentation coverage number; then fill the gaps and wire it into the docs build.
- [changelog-keeper](https://basitalisandhu.github.io/claude-skills/plugins/docs/changelog-keeper/): Maintain CHANGELOG.md in the Keep a Changelog format with a bundled script that validates the structure, adds entries under Unreleased in the right category, cuts a release (version, date, compare links) and prints a version's section.
- [onboarding-doc](https://basitalisandhu.github.io/claude-skills/plugins/docs/onboarding-doc/): Write a developer onboarding doc that takes a new developer from a clean laptop to their first merged change: setup verified step by step, how the code is organised, how to run, test, deploy and ship the project, the configuration it needs, who owns what, and first tasks.
- [postmortem-writer](https://basitalisandhu.github.io/claude-skills/plugins/docs/postmortem-writer/): Write a blameless incident postmortem from the timeline, logs, chat transcript and metrics: impact with numbers, a minute-by-minute timeline, contributing causes found with a structured analysis rather than a single root cause, what went well and what did not, and action items with owners, deadlines and a check that they would have prevented or shortened the incident.
- [readme-author](https://basitalisandhu.github.io/claude-skills/plugins/docs/readme-author/): Write or rewrite a README that answers what the project is, who it is for, how to install and use it in under five minutes, and where everything else lives, using a fixed section order and a quality checklist (first screen, copy-pasteable commands verified to work, no stale claims).

## github-manager

Engineering manager skills that compute from exported GitHub data: a stuck-PR and review-queue digest with next actions, an iteration report with shipped, carried-over and newly opened work plus cycle time and review turnaround, a blameless incident postmortem timeline, and an issue triage digest (unlabelled, unanswered, possible duplicates, stale, popular, suggested labels). Every number and row cites the PR, issue, comment or event it came from; team level only, no per-person scoring. Source: https://github.com/basitalisandhu/github-manager-skills

- [incident-postmortem-timeline](https://basitalisandhu.github.io/claude-skills/plugins/github-manager/incident-postmortem-timeline/): Build a blameless, cited postmortem timeline and document skeleton from a saved incident issue export, ordering label changes, comments, cross-references, PR merges and the close by time, deriving detected, acknowledged, mitigated and resolved, listing people as roles and writing contributing factors as questions.
- [issue-triage-digest](https://basitalisandhu.github.io/claude-skills/plugins/github-manager/issue-triage-digest/): Prepare open-issue triage from a saved gh issue list export: flag unlabelled issues, issues nobody but the author has answered for N days, probable duplicates by title similarity, stale issues and issues with many thumbs-up, and suggest a label per issue from a keyword map kept in a YAML file.
- [iteration-report](https://basitalisandhu.github.io/claude-skills/plugins/github-manager/iteration-report/): Write a team-level sprint or iteration report from saved gh pull request, issue and milestone exports: what shipped or merged, what carried over or slipped, what was opened or closed as not planned, with cycle time (median and p90) and review turnaround, every number cited to its rows.
- [pr-queue-digest](https://basitalisandhu.github.io/claude-skills/plugins/github-manager/pr-queue-digest/): Find stuck pull requests and review bottlenecks from a saved gh pr list export: PRs waiting on review, blocked on one reviewer, changes requested with no new commits, failing checks, conflicts, approved but not merged, no reviewer, or stale drafts, with one next action per PR and queue counts per reviewer.

## m365-governance

Microsoft 365 governance skills for Claude Code: Graph permission preflight for apps and connectors, Entra ID posture review, Conditional Access gap analysis, privileged access review, guest and external sharing review, licence and service plan audit, Intune baseline check, Teams and group sprawl report, a quarterly access review pack, and a Copilot oversharing readiness score with fixes by site owner. Scripts are standard-library Python and evaluate exported Microsoft Graph JSON offline. Source: https://github.com/basitalisandhu/m365-governance-skills

- [access-review-pack](https://basitalisandhu.github.io/claude-skills/plugins/m365-governance/access-review-pack/): Build a quarterly Microsoft 365 access review package from read-only Graph exports, listing directory role holders (active and PIM-eligible) with last sign-in, app owners and apps with no owner, owners of sensitive groups, guests per group and app secrets and certificates about to expire, with a reviewer checklist and a sign-off CSV.
- [conditional-access-gap-analysis](https://basitalisandhu.github.io/claude-skills/plugins/m365-governance/conditional-access-gap-analysis/): Find gaps, overlaps and exclusion problems in Microsoft Entra Conditional Access from read-only Graph exports, resolving who each policy really covers and checking MFA for all users and admins, legacy authentication, device and risk policies, break-glass accounts and exclusions nobody can explain, report-only and self-cancelling policies, with a coverage matrix by persona.
- [copilot-oversharing-readiness](https://basitalisandhu.github.io/claude-skills/plugins/m365-governance/copilot-oversharing-readiness/): Score a Microsoft 365 tenant's readiness for a Copilot rollout against Microsoft's oversharing checks and produce a fix list per site owner, from read-only exports of SharePoint sites, sensitivity labels, Everyone grants, sharing links and DLP policies.
- [entra-posture-review](https://basitalisandhu.github.io/claude-skills/plugins/m365-governance/entra-posture-review/): Review a Microsoft Entra ID tenant's identity posture from read-only Graph exports: Conditional Access basics, security defaults, standing Global Administrators, guests with roles, stale guests, long-lived app secrets, high-risk Graph application permissions, consent and invitation settings and legacy sign-ins.
- [graph-permission-preflight](https://basitalisandhu.github.io/claude-skills/plugins/m365-governance/graph-permission-preflight/): Check the Microsoft Graph permissions or scopes an app, connector or MCP server requests or holds against a needs manifest of what it actually uses, flag high-risk, .All, write-where-read-suffices and unused grants, and propose a least-privilege set.
- [guest-and-external-sharing-review](https://basitalisandhu.github.io/claude-skills/plugins/m365-governance/guest-and-external-sharing-review/): Review guest accounts and external sharing in Microsoft 365 from read-only exports, reporting guests from blocked domains or in sensitive groups, stale and unaccepted invitations, anyone links and links that never expire, guest resharing and open Teams external access, with a per-guest access map and a draft removal list.
- [intune-baseline-check](https://basitalisandhu.github.io/claude-skills/plugins/m365-governance/intune-baseline-check/): Check a Microsoft Intune estate against a device baseline from read-only Graph exports, reporting non-compliant, stale (not checked in for 30 days by default), unencrypted, jailbroken and outdated-OS laptops and phones, personal devices, compliance policies not assigned, platforms missing baseline controls and the no-policy-means-compliant setting, per platform.
- [license-and-service-plan-audit](https://basitalisandhu.github.io/claude-skills/plugins/m365-governance/license-and-service-plan-audit/): Find wasted Microsoft 365 licences from read-only Graph exports, reporting licences on disabled, never-signed-in or inactive accounts, overlapping SKUs (such as E3 and E5 on one user), unwanted service plans, group-based licensing errors and unassigned units, with a draft reclaim list per SKU; costs appear only when you supply unit prices.
- [privileged-access-review](https://basitalisandhu.github.io/claude-skills/plugins/m365-governance/privileged-access-review/): Review privileged Microsoft Entra ID role holders from read-only Graph exports and score each admin account, reporting permanent privileged assignments, never-activated PIM eligibility, admins without phishing-resistant MFA, admin accounts used daily, stale or synchronised admins, and service principals and groups in roles.
- [teams-and-groups-sprawl](https://basitalisandhu.github.io/claude-skills/plugins/m365-governance/teams-and-groups-sprawl/): Report Microsoft Teams and Microsoft 365 group sprawl from read-only Graph exports: ownerless and single-owner groups, guest owners or members, public and inactive teams, empty groups, naming violations and groups missing an expiration policy, with owners proposed from member managers as a draft.

## mac-maintenance

Mac cleanup skills: survey what takes space and memory without changing anything, remove only the caches and leftovers that programs recreate, find byte-identical duplicate files and park the obvious copies in the Trash, and find data, login items and launch agents left by uninstalled apps. Every deletion of user data is a decision the user makes from a written list. Source: https://github.com/basitalisandhu/mac-maintenance-skills

- [mac-app-leftovers](https://basitalisandhu.github.io/claude-skills/plugins/mac-maintenance/mac-app-leftovers/): Find what uninstalled apps left behind on a Mac (Application Support and container folders, caches, preferences, saved state, logs, and login items or launch agents that point at nothing), deciding what is installed from app bundles, PATH, Homebrew and Spotlight, and move only the candidates you name into a dated Trash folder.
- [mac-cleanup](https://basitalisandhu.github.io/claude-skills/plugins/mac-maintenance/mac-cleanup/): Free disk space and speed up a Mac safely: survey it read-only, clear only what programs recreate (npm, Xcode and other package and build caches, Docker build cache, old logs), and write a decision list for everything else.
- [mac-duplicate-finder](https://basitalisandhu.github.io/claude-skills/plugins/mac-maintenance/mac-duplicate-finder/): Find byte-for-byte duplicate files in a Mac's user folders, report the largest groups and folders that mirror each other, and move verified suffix copies, the (1) copies of videos and photos (IMG_1 (1).MOV next to an identical IMG_1.MOV), to a dated Trash folder after a second hash check.

## repo-engineering

Repository engineering skills: verify documentation claims against the working tree, run an audit whose every finding cites a resolvable path:line, write AGENTS.md and CLAUDE.md that hold only what code cannot say, check a README's first screen, rank untested functions and entry points, write onboarding guides only from cited facts, plan restructures from the import graph, mine ADRs from git history, run offline hygiene checks with SARIF, check release notes against the commits between two tags, sweep stale branches with delete commands printed for review, check an implementation plan for required sections and unanswered questions, and check an MCP server's server.json and package files against the MCP Registry's publish rules before publishing. Source: https://github.com/basitalisandhu/repo-engineering-skills

- [adr-miner](https://basitalisandhu.github.io/claude-skills/plugins/repo-engineering/adr-miner/): Recover design decisions that were made but never written down by mining git history, manifest and config changes and rationale comments, then draft MADR stubs (status proposed) that cite a commit SHA on every line; a second script lints an existing docs/adr folder for numbering, status and superseded-link problems.
- [agent-context-writer](https://basitalisandhu.github.io/claude-skills/plugins/repo-engineering/agent-context-writer/): Write or refresh AGENTS.md and CLAUDE.md so they hold only what an agent cannot learn from the code, and lint them for lines that restate manifests, scripts, dependency lists or directory trees, paths that do not exist, generic advice and length over a budget.
- [cited-codebase-audit](https://basitalisandhu.github.io/claude-skills/plugins/repo-engineering/cited-codebase-audit/): Audit a whole repository against a fixed checklist (structure, entry points, dependency hygiene, dead code, test coverage, secrets and config, CI health) where every finding cites a path:line with a quoted snippet, and a bundled validator rejects findings whose citation does not resolve.
- [docs-truth-check](https://basitalisandhu.github.io/claude-skills/plugins/repo-engineering/docs-truth-check/): Verify that a repository's README, docs/, AGENTS.md and CLAUDE.md still match the code, checking file paths, links, CLI flags and defaults, environment variables, symbol names, config keys, npm and make targets and version strings against the working tree.
- [mcp-registry-publish-preflight](https://basitalisandhu.github.io/claude-skills/plugins/repo-engineering/mcp-registry-publish-preflight/): Check an MCP server repository offline before mcp-publisher publish: a bundled script reads server.json and the local package.json, pyproject.toml and README, Cargo.toml, .csproj and Dockerfile, and reports what the official MCP Registry's documented rules would reject (name, description, version ranges, registry URLs, ownership markers, _meta size), plus DNS or HTTP proof record format.
- [plan-grill](https://basitalisandhu.github.io/claude-skills/plugins/repo-engineering/plan-grill/): Stress-test an implementation plan before anyone writes code: put a fixed set of questions to the author (scope, interfaces, data, failure modes, rollout, tests, open questions), fold the answers into the plan, then run a bundled script that checks the Markdown for the required sections, placeholders, a missing rollback and questions with no owner or answer, listing each gap with its line.
- [readme-who-what-why](https://basitalisandhu.github.io/claude-skills/plugins/repo-engineering/readme-who-what-why/): Check whether a README's first screen answers six questions (what it is, who it is for, why it exists, how to install, one example, where to ask), flag hype words, list the gaps as a to-do list, then fix them with verified text.
- [release-notes-verifier](https://basitalisandhu.github.io/claude-skills/plugins/repo-engineering/release-notes-verifier/): Check a release's notes against what changed between two tags, flagging notes that match no commit, commits with no note (chores excluded by a pattern), manifest versions that disagree with the tag, and missing compare links; pull request titles are read only when asked.
- [repo-hygiene-bundle](https://basitalisandhu.github.io/claude-skills/plugins/repo-engineering/repo-hygiene-bundle/): Run one offline hygiene pass over a repository and report findings with severity as a table, JSON or SARIF with a CI exit code, covering manifests without lockfiles, lockfile drift, version splits across workspaces, missing licence or SPDX fields, redacted secret-shaped strings, actions pinned by tag, write-all workflows, missing SECURITY.md, and large or built files.
- [repo-onboarding-guide](https://basitalisandhu.github.io/claude-skills/plugins/repo-engineering/repo-onboarding-guide/): Write an onboarding guide for a repository (how to run and test it, where things live, which services it needs, who owns what) only from facts a bundled script extracted with a path:line citation each, then lint the guide so every command, path, variable, service or owner matches a fact.
- [restructure-planner](https://basitalisandhu.github.io/claude-skills/plugins/repo-engineering/restructure-planner/): Plan a repository restructure (split or merge packages, fix module boundaries) from the real import dependency graph of Python, JavaScript and TypeScript files, reporting the most coupled files, import cycles and god modules, and proposing a move plan with blast radius and git mv commands it prints and never runs.
- [stale-branch-sweep](https://basitalisandhu.github.io/claude-skills/plugins/repo-engineering/stale-branch-sweep/): Clean up a repository's branch list safely: a bundled script joins saved gh and git exports (remote branches, for-each-ref dates and committers, merged refs, PR list) and reports merged branches never deleted, branches idle for N days, branches with an open PR and protected ones, with the last committer as owner, then writes the exact git push --delete commands as a list to review and never runs them.
- [untested-entry-points](https://basitalisandhu.github.io/claude-skills/plugins/repo-engineering/untested-entry-points/): Find public functions, classes and CLI entry points that no test mentions in Python, JavaScript and TypeScript code, rank them (entry points first, then size and fan-in), and write characterisation test stubs in the project's framework.

## security-basics

Seven lightweight security skills for everyday development: secrets hygiene scan, npm audit and pip-audit reader, HTTP security header check, JWT inspector, CORS review, auth flow review and a security review of a diff. Agent and MCP security lives in the agent-security-skills marketplace. Source: https://github.com/basitalisandhu/claude-dev-skills

- [auth-flow-review](https://basitalisandhu.github.io/claude-skills/plugins/security-basics/auth-flow-review/): Find the weaknesses in an application's whole sign-in, login and session design (passwords, sessions and cookies, OAuth and OIDC with PKCE, state and redirect URIs, MFA, password reset, account enumeration, rate limiting), then report findings by severity with the corrected flow.
- [cors-review](https://basitalisandhu.github.io/claude-skills/plugins/security-basics/cors-review/): Review a CORS configuration (allowed origins, Access-Control-Allow-Origin with credentials, methods, headers, preflight caching, exposed headers) against the mistakes that leak data cross-site or break real clients, and write the correct config for Express, nginx or the gateway in use.
- [dependency-audit-reader](https://basitalisandhu.github.io/claude-skills/plugins/security-basics/dependency-audit-reader/): Read the JSON output of npm audit, yarn audit, pip-audit or cargo audit with a bundled script that ranks vulnerable packages by severity, separates fixable from unfixable and direct from transitive, and names the packages to upgrade first; then plan the upgrades, overrides and accepted risks with expiry dates.
- [diff-security-review](https://basitalisandhu.github.io/claude-skills/plugins/security-basics/diff-security-review/): Review a change for what it adds to the attack surface before it merges: a bundled script scans only the added lines of a saved git or gh diff for new network calls, shell and process execution, unsafe deserialisation, SQL built from strings, credential-shaped literals, disabled TLS checks and new permissions in workflows and manifests, with file and line.
- [http-security-headers](https://basitalisandhu.github.io/claude-skills/plugins/security-basics/http-security-headers/): Grade the security headers in a saved HTTP response (HSTS, CSP, nosniff, frame protection, Referrer-Policy, Permissions-Policy, cookie flags, disclosure, caching) with a bundled script, then write the header config for nginx, the server or the framework.
- [jwt-inspector](https://basitalisandhu.github.io/claude-skills/plugins/security-basics/jwt-inspector/): Decode a JWT or bearer access token without verifying it, with a bundled script that prints the header, claims and expiry, and flags unsafe settings (alg none, empty signature, long or missing expiry, jku or x5u, suspicious kid, HS256 and other symmetric algorithms, email or other sensitive claims in the payload); then check whether the token design is safe.
- [secrets-hygiene](https://basitalisandhu.github.io/claude-skills/plugins/security-basics/secrets-hygiene/): Find leaked credentials (cloud and SaaS keys, private keys, tokens, connection strings, high-entropy assignments) in a repository, directory or staged files with a bundled script that redacts them, check .env files are ignored, keep a baseline of accepted findings, and guide rotation and cleanup.

## ways-of-working

Thirteen ways-of-working skills that compute from files you already have: a CAB-style change record from a Terraform plan or PR export, one action ledger across meeting notes, a security exception register lint, a quarterly risk register refresh against findings exports, an RFC writer with a lifecycle lint, a one-file-per-decision log, a weekly status note from git and gh exports, a private 1:1 ledger, meeting load and focus blocks from a calendar export, a weighted vendor scorecard with a sensitivity check, a check of a team's working agreement against GitHub settings exports, a shift handover note from incident and alert exports, and one ranked do-next list from saved mail and chat exports across work and personal accounts. Standard-library scripts, no network, no rating of people. Source: https://github.com/basitalisandhu/ways-of-working-skills

- [change-request-writer](https://basitalisandhu.github.io/claude-skills/plugins/ways-of-working/change-request-writer/): Write a CAB-style change record (change request or change ticket) for an infra change from a saved terraform show -json plan or a PR (gh pr view export): counts to add, change, destroy and replace, IAM, security group, KMS, S3 policy and network changes flagged for a reviewer, a risk tier by a stated rule, rollback and verification steps, and who needs to approve.
- [decision-log](https://basitalisandhu.github.io/claude-skills/plugins/ways-of-working/decision-log/): Record operational decisions as one Markdown file each (context, decision, who decided, date, review date, status, supersede links) and lint the folder for overdue reviews, broken or one-way supersede links, cycles and missing fields, rendering an INDEX.md table.
- [focus-plan](https://basitalisandhu.github.io/claude-skills/plugins/ways-of-working/focus-plan/): Find focus time in a meeting-heavy week from a saved .ics calendar export (Outlook, Google Calendar or Apple): meetings and hours per day, back-to-back runs, the longest free blocks inside working hours for deep work, recurring series with counts, and a plain focus plan; recurring rules it cannot expand are listed, never guessed.
- [meeting-actions-ledger](https://basitalisandhu.github.io/claude-skills/plugins/ways-of-working/meeting-actions-ledger/): Track the action items agreed across project meetings in one ledger, from a folder of Markdown or text notes: each action with its owner and due date, the same action carried over from meeting to meeting merged into one, overdue, unowned and thrice-carried items flagged, every item cited to file and line, written to ledger.md and ledger.json.
- [next-actions-sweep](https://basitalisandhu.github.io/claude-skills/plugins/ways-of-working/next-actions-sweep/): Turn saved exports of emails and chats from several inboxes (Microsoft Graph mail and Teams JSON, Slack export, CSV; work and personal accounts together) into one ranked do-next list: each message labelled reply, decide, do or FYI with the reason, any stated deadline and the source link, duplicates across accounts merged, and what is waiting on you versus waiting on others.
- [one-on-one-ledger](https://basitalisandhu.github.io/claude-skills/plugins/ways-of-working/one-on-one-ledger/): Prepare for 1:1s (one to one or one-on-one catch-ups) from your own local notes: days since the last 1:1 against a cadence, open commitments on each side (what you promised first, overdue marked) and topics that keep coming up, as a ledger per person or a prep sheet for one.
- [rfc-lifecycle](https://basitalisandhu.github.io/claude-skills/plugins/ways-of-working/rfc-lifecycle/): Draft a design proposal (RFC or design doc) with a fixed section list and a security review checklist, then lint a folder of RFCs for the status header, review questions with no answer, open questions left in review or accepted RFCs, a missing decision date or section, and RFCs stuck in review over 14 days.
- [risk-exception-register](https://basitalisandhu.github.io/claude-skills/plugins/ways-of-working/risk-exception-register/): Review a register of time-bound security exceptions, waivers and risk acceptances (CSV or Markdown table): flags expired exceptions and those that expire in the next 30 days, missing approvers or compensating controls, approvers who signed off their own request, and repeated renewals, then prints a review agenda with a blank decision line per item.
- [risk-register-refresh](https://basitalisandhu.github.io/claude-skills/plugins/ways-of-working/risk-register-refresh/): Prepare the quarterly risk review from a register CSV, saved findings (Security Hub ASFF JSON, generic JSON or CSV) and last quarter's snapshot: new findings with no register entry, risks with no supporting finding, risks whose rating moved since the snapshot, overdue reviews, risks without an owner, and a refresh agenda.
- [shift-handover](https://basitalisandhu.github.io/claude-skills/plugins/ways-of-working/shift-handover/): Write an on-call or shift handover note from saved incident and alert exports (JSON or CSV) and the outgoing shift's notes: open incidents by age, incidents with no recent update or no owner, noisy alerts and silences or mutes that expire next shift, framed as what is open, what to watch and what is silenced until when, for the incoming on-call.
- [vendor-scorecard](https://basitalisandhu.github.io/claude-skills/plugins/ways-of-working/vendor-scorecard/): Compare vendors, tools or suppliers on agreed weighted criteria from a CSV (criterion, weight, a 1 to 5 score column per vendor): weighted scores and ranking, which one wins, whether the winner changes when each weight moves one step, ties for first, data problems, and a Markdown scorecard with a blank decision line.
- [weekly-status-rollup](https://basitalisandhu.github.io/claude-skills/plugins/ways-of-working/weekly-status-rollup/): Write one lead's weekly update from saved git log text, gh pr and issue list JSON and last week's note: shipped, in review, in progress, blocked and carried over with weeks carried, plus Decisions needed and Risks left for the author, never invented; a daily mode gives a standup update from yesterday's commits.
- [working-agreement-check](https://basitalisandhu.github.io/claude-skills/plugins/ways-of-working/working-agreement-check/): Check whether repository settings in GitHub match a team's written working agreement (rules such as 'PRs need one review' or 'main is protected') using saved branch protection and rulesets JSON, CODEOWNERS and the workflow list: each written rule met, not met (not enforced) or not checkable, with evidence, and unrecognised rules listed.

## Guides

- [How to install Claude Code skills (three ways)](https://basitalisandhu.github.io/claude-skills/guide/install-claude-code-skills/): marketplace, clone and install.py, or npx skills add, with troubleshooting and uninstall steps

## Optional

- [llms-full.txt](https://basitalisandhu.github.io/claude-skills/llms-full.txt): the full text of every SKILL.md
- [catalog.json](https://github.com/basitalisandhu/claude-skills/blob/main/catalog.json): machine-readable catalog
- [SOURCES.json](https://github.com/basitalisandhu/claude-skills/blob/main/SOURCES.json): source repository and commit for each plugin