Use to justify and scaffold a NEW pack area for this catalogue — test that it is additive and fits the target catalogue's declared coverage model and applicable Charter admission path, then scaffold the pack shell and emit an RFC with a per-primitive inventory, or reject it as non-additive. Triggers on "should we add a pack for <area>", "propose a new pack", "justify a <vendor/domain> pack". Do NOT use to ingest units (use assimilate-primitive or assimilate-repo).
Use this skill when a workflow step or a user needs bounded, attributed repository evidence to settle a pending decision — which files a plan must touch, whether a rename or removal is safe, where a bad value enters before a fix, or whether a fix reaches a live code path. It owns that inquiry for the caller. It records the question and stopping rule, uses an already-exposed capability only when its native action fits, otherwise answers from repository search, and checks load-bearing claims against source. The caller keeps the decision, and no provider is required. Do NOT use it to plan, build, or fix the change itself — the calling workflow owns that. Route path-seeded "what governs these paths?" questions to repository-grounding instead.
Use this skill to answer "what already governs these paths?" before writing a spec, plan, or implementation. Probes the paths a change will touch and reports governing files, references, phrase pins, gates, co-change partners, and dead links — selected by stage. Use it at discovery to orient before authoring and at review to check what the authored artifacts reference. It can add attributed evidence from an already-exposed code-intelligence capability, but never needs one. Do NOT use it to install, index, or refresh a provider, or for any inquiry that mutates repository state.
Progressive-disclosure security-depth modules for the security-reviewer. Holds boundary-keyed checklists (access-control, authn-session, injection, path-and-file, secrets-and-crypto, outbound-ssrf, supply-chain, config-misconfig, exceptional-conditions, llm-agent, agentic-skills) as references/, each anchored on a current standard (OWASP Top 10:2025, ASVS 5.0, API Security Top 10:2023, Proactive Controls 2024, CWE Top 25, OWASP LLM Top 10:2025, OWASP Top 10 for Agentic Applications:2026, OWASP Agentic Skills Top 10 v1.0 (AST01–AST10)). The work-loop's orchestrator loads only the boundary-matching modules and inlines them into the security-reviewer's brief; the subagent never self-discovers this skill. Not a reviewer prompt itself — it is the depth library the reviewer reasons from.
Use for a raw or ambiguous work request, source acquisition or refresh, or generic intake-safety handling. Explicit status, artifact, skill, product-shaping, architecture-design, and defect requests route directly to their owners.
Use when implementing or resuming a non-trivial repository change: a feature, a fix whose cause is established (use `bug-fix` first to diagnose a defect whose cause is not), refactor, migration, framework or dependency upgrade, schema or API change, performance work, infrastructure or build-system change, reversion, or an existing build spec under `docs/specs/`. Also use for bare continuation commands ('resume', 'continue', 'keep going', 'pick up where I left off', 'let's get going') when conversation or workspace context identifies active build work. Do not use for shaping, research, strategy, product planning, design exploration, monitoring or status-only work, review-only, explanation-only, specification-authoring-only, spike-only or throwaway exploration, or trivial edits that are cosmetic, tightly local, behavior-preserving, and have obvious verification.
Use this skill to orient at session start, check initiative queue state, or see what's ready to work on next. Reads workspace.toml and surfaces ready-to-start items, blocked items with reason, parallel candidates, and active signals. Triggers on "workspace status", "where am I", "orient me", "session start", "what's ready", "show the queue", "what's next", "what should I work on", "check workspace", or any cold-start orientation request. Offers to initialise workspace.toml if absent. Also reconciles and repairs workspace.toml drift, and executes an independently authorized prune of explicitly selected delivery artifacts and their memberships. Triggers on "clean up stale specs", "run repair-plan", "apply the workspace repair plan", "fix queue drift", "reconcile workspace", "preview a workspace prune", "prune selected specs", or any workspace repair or cleanup request.
Use this skill when the user wants to fix a defect — a deviation between current behavior and intended behavior in existing code. Triggers on "fix bug", "fix this bug", "diagnose and fix", "investigate this regression", "this is broken", "crash", "wrong output", "perf regression". For defect-shaped tasks that touch more than one file. Do NOT use for new features (use `new-spec`) or refactors unrelated to fixing incorrect behavior.
125mo agoReviewMountCreate a free account to mount
Use this skill when the user asks to create, write, draft, or open a new ADR (architecture decision record). Triggers on phrases like "new ADR", "write an ADR for…", "record this decision", "let's ADR this". Do NOT use for RFCs (use `new-rfc`) or feature specs (use `new-spec`).
125mo agoReviewMountCreate a free account to mount
Use this skill when the user asks to propose, draft, or open an RFC (request for comments). Triggers on "RFC", "propose a change to…", "let's get input on…", "draft a proposal". Do NOT use for already-decided things (use `new-adr`) or single-feature specs (use `new-spec`).
125mo agoReviewMountCreate a free account to mount
Use this skill when the user wants to start a new feature with a spec, or wants to write a spec for something they're about to build. Triggers on "new spec", "write a spec for X", "let's spec this out", "start a feature for…". Spec-driven development; the spec drives implementation. Do NOT use for cross-cutting proposals (use `new-rfc`) or recording decisions (use `new-adr`).
125mo agoReviewMountCreate a free account to mount
Progressive-disclosure security-depth modules for the security-reviewer. Holds ten boundary-keyed checklists (access-control, authn-session, injection, path-and-file, secrets-and-crypto, outbound-ssrf, supply-chain, config-misconfig, exceptional-conditions, llm-agent) as references/, each anchored on a current standard (OWASP Top 10:2025, ASVS 5.0, API Security Top 10:2023, Proactive Controls 2024, CWE Top 25, OWASP LLM Top 10:2025). The work-loop's orchestrator loads only the boundary-matching modules and inlines them into the security-reviewer's brief; the subagent never self-discovers this skill. Not a reviewer prompt itself — it is the depth library the reviewer reasons from.
125mo agoReviewMountCreate a free account to mount
Use this skill when the user wants to substantively change `docs/CONVENTIONS.md` — modify how the team works in this repo. Triggers on "change the convention for…", "update the rules", "amend our process", "let's revise how we do X". Substantive convention changes go through RFC review, not a direct PR. Typo and broken-link fixes don't count — those land as normal PRs.
125mo agoReviewMountCreate a free account to mount
Use this skill whenever you're implementing a non-trivial change — a feature, a multi-file bug fix, a refactor, a migration, a framework or dependency upgrade, a schema or API change, performance work, an infrastructure or build-system edit, or anything spec-driven. It enforces the project's plan → execute → self-review → fix loop with mechanical gates (lint, typecheck, tests) and adversarial review. Default to this skill for any task larger than a one-line edit.
125mo agoReviewMountCreate a free account to mount
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
How do I use one I find here?
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
What do the warnings mean?
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Which skills worked for people?
Open a skill to see its discussion. Reports from people and their agents are coming.
eugenelimSkill