Claude Code Skills · page 142

Review code for best practices, bugs, and security issues.

AI pair programming with real-time screen and audio context. Use when the user wants to record their screen, start/stop recording, or get context from what they're doing.

>

Comprehensive review of local uncommitted changes using specialized agents with code improvement suggestions

Comprehensive pull request review using specialized agents

Token-efficient smart contract security auditing via Behavioral State Analysis (BSA). Scopes analysis to contract type, runs only relevant threat engines, and uses tiered output depth. Use for auditing smart contracts, security reviews, or DeFi threat modeling.

Blue-team release-gate analysis for smart contract deployment and upgrade readiness. Classifies repositories, checks deploy/upgrade execution paths, CI/CD trust boundaries, config drift, secrets/signer operational security, and outputs evidence-backed release verdicts.

Detects Denial of Service and griefing vulnerabilities in smart contracts. Covers unbounded loop DoS, block gas limit exhaustion, external call failure DoS, insufficient gas griefing (63/64 rule), storage bloat attacks, timestamp griefing, self-destruct force-feeding, and push vs pull payment pattern analysis. Use when auditing contracts with batch operations, loops over user data, reward distribution, dividend systems, or any logic that depends on address(this).balance or iterates over growing collections.

Detects unsafe external call patterns and token integration vulnerabilities in smart contracts. Covers unchecked call/delegatecall/staticcall return values, fee-on-transfer tokens, rebasing tokens, tokens with missing return values (USDT), ERC-777 callback risks, unsafe approve race conditions, return data bombs, gas stipend limitations, and push vs pull payment patterns. Use when auditing contracts that interact with external contracts, integrate arbitrary ERC20 tokens, distribute payments, or make low-level calls.

Detects input validation failures and arithmetic vulnerabilities in smart contracts. Covers missing zero-address and zero-amount checks, division-before-multiplication precision loss, rounding direction exploitation, ERC4626 vault share inflation attacks, unsafe integer casting, dust amount exploitation, and Solidity 0.8+ unchecked block edge cases. Use when auditing contracts with fee calculations, share pricing, exchange rates, unchecked blocks, or any public-facing functions that accept user input.

Detects price oracle manipulation and flash loan attack vectors in DeFi smart contracts. Classifies oracle trust models (Chainlink, TWAP, spot price, custom), identifies stale price risks, circular price dependencies, and flash loan atomicity exploitation patterns. Use when auditing DeFi protocols that depend on price data, oracle integrations, lending protocols, DEXs, derivatives, or any contract where flash loans could manipulate state within a single transaction.

Detects vulnerabilities in upgradeable proxy smart contracts including storage layout collisions, uninitialized implementations, function selector clashing, delegatecall context issues, and upgrade path safety. Covers Transparent Proxy, UUPS (EIP-1822), Beacon, Diamond (EIP-2535), and Minimal Proxy (EIP-1167) patterns. Use when auditing upgradeable contracts, reviewing implementation upgrades, analyzing delegatecall architectures, or verifying proxy pattern compliance.

Systematically detects all reentrancy vulnerability variants in smart contracts — classic, cross-function, cross-contract, and read-only reentrancy. Builds call graphs, verifies CEI (Checks-Effects-Interactions) pattern compliance, traces state changes relative to external calls, and identifies callback vectors through ERC-777/ERC-1155 hooks. Use when auditing contracts that make external calls, transfer ETH or tokens, interact with callback-enabled standards, or have complex multi-contract architectures.

Detects logic vulnerabilities in smart contracts by analyzing guard-state consistency patterns. Identifies functions that bypass security checks (require, modifiers) that other functions consistently apply. Uses the Consistency Principle — a contract is its own specification. Use when auditing smart contracts for missing access controls, inconsistent pause checks, logic bugs, forgotten modifiers, or when traditional tools report no issues but logic errors may exist.

Detects signature replay vulnerabilities in smart contracts — affecting 19.63% of signature-using contracts. Covers five replay types (same-chain, cross-chain, cross-contract, nonce-skip, expired-signature), EIP-712 domain separator verification, nonce management analysis, ecrecover edge cases (address(0), malleability, s-value), permit/permit2 safety, ERC-1271 contract wallet support, and meta-transaction security. Use when auditing contracts with ecrecover, ECDSA, EIP-712, permit, meta-transactions, multi-sig, or any off-chain signature verification.

Detects broken mathematical relationships between state variables in smart contracts. Automatically infers invariants (totalSupply = sum(balances), conservation laws, ratio constraints) then finds functions that violate them. Catches unauthorized minting, broken tokenomics, accounting desynchronization, and state drift. Use when auditing for state-state invariant violations, broken accounting, supply mismatches, desynchronized state variables, or conservation law violations in smart contracts.

Guide for creating effective skills. This skill should be used when users want

This skill should be used when writing in the distinctive style of David Heinemeier Hansson (DHH). It applies when creating blog posts, technical articles, business content, manifestos, or any prose requiring a clear, punchy, opinionated style.

This skill should be used when reviewing or editing copy to ensure adherence to Every's style guide. It provides a systematic line-by-line review process for grammar, punctuation, mechanics, and style guide compliance.

This skill should be used when writing technical content in the style of Hunt/Thomas (The Pragmatic Programmer) and Joel Spolsky (Joel on Software). It applies when creating technical essays, documentation, tutorials, or explanatory content that needs to be clear, engaging, and actionable.

This skill should be used when extracting voice profiles from sample text, creating voice documentation, or matching a specific writing style. It applies when users provide sample text and want to capture the voice for future use.

This skill should be used when orchestrating complex writing workflows with multiple phases. It provides two-agent orchestration patterns, the two-gate content readiness assessment, 10 baseline writing strategies, 20+ situational strategies, and quality checkpoints. Inspired by the Spiral Writing System.

Collaborative brainstorming partner for multi-session ideation projects. Use

Expert documentation generator for coding projects. Analyzes codebases to

Develop ebook ideas into structured concepts ready for architecture. Use when

Surface ebook ideas you didn't know you had. Use when ready to discover what

Create a structured session handoff document for continuity across sessions.

Generate platform-specific, actionable growth playbooks for mobile apps. Use

Systematically analyze app reviews for competitor research or own-app

Optimize iOS App Store and Google Play Store listings for maximum

Full-pipeline iOS App Store opportunity research. Discovers underserved

Orchestrate iOS/macOS app scaffolding and optional skill adoption for existing projects. Use when users want a guided wizard that can scaffold with XcodeGen and optionally install xcode-makefiles and simple-tasks.

Install a fast local task workflow for single-project planning with `scripts/task.sh` (claim, done, status, reporting) backed by `tasks/TASKS.md` and optional `tasks/details/` notes. Use for lightweight in-progress task coordination, not full team issue tracking.

Install strict Xcode Makefile tooling for iOS/macOS projects, including build/run/test scripts with AGENT_NAME-based per-agent isolation under build/. Use when a project needs reproducible local CLI builds without full app scaffolding.

Comprehensive step-by-step launch checklist for shipping mobile apps to the

Design effective paywalls, structure subscription tiers, and optimize pricing

Design the structural and emotional architecture for nonfiction books. Use

Stress-test book concepts against existing research before committing to

Develop raw book ideas into structured nonfiction book concepts. Use when the

Assess commercial viability of book concepts for Amazon KDP self-publishing.

Plan, orchestrate, and validate deep research for nonfiction books. Use when

Plan and architect a single chapter at beat-level granularity. Use when you

Produce first drafts that match a writer's authentic voice using their Voice

Capture a writer's voice DNA through collaborative interview and sample

Refresh a repo's documentation for a live production system — audit stale docs, rebuild a focused doc set with diagrams, update AI-agent knowledge bases, and improve code-level docstrings

Read all atomic guidelines in wiki-twobatch/guidelines/ and propose themed clusters that group near-duplicates. Writes cluster pages and updates _config.yaml; originals are preserved with a `superseded_by:` backref.

Consult an agent-wiki for guidelines relevant to the task at hand. The wiki itself documents how to retrieve from it (AGENTS.md). Use this skill once you know what task or sub-task you're about to do — not at session start.

Read a normalized Claude Code trajectory JSON and extract reusable guidelines into wiki-twobatch/guidelines/. Use when mining saved trajectories for reusable lessons.

Ingest one or more agent trajectories (raw bob/claude traces or normalized JSON) into an agent-wiki end-to-end — convert, summarize, extract guidelines, synthesize skills, consolidate into clusters, and catalog. Use when you have a batch of traces to turn into a wiki in one pass.

Read a normalized Claude Code trajectory JSON and write an episodic summary page to wiki-twobatch/summaries/. Use when summarizing one or more saved trajectories into the agent wiki.

Read a normalized Claude Code trajectory JSON and produce a wiki-resident SKILL.md page that future agents can invoke. Use when a trajectory captured a non-trivial successful workflow worth promoting from a free-text guideline to an executable, callable artifact.

Discover task families across summaries and write per-family comparison pages with findings narrative. Updates wiki-twobatch/_config.yaml task definitions and writes tasks/<slug>__task.md.

Must be used near the end of any non-trivial turn that produced potentially reusable tools, guidance, errors, workarounds, or workflows, so those lessons are saved for future turns.

Analyze saved trajectories and recall audit events offline to record whether recalled guidelines influenced completed sessions.

Publish a private guideline to a configured write-scope repo.

Must be used at the start of any non-trivial task involving code changes, debugging, repo exploration, file inspection, or environment/tooling investigation to surface stored guidance before analysis or tool use.

Save the current conversation as a trajectory JSON file in OpenAI chat completion format for analysis and fine-tuning

Captures the current session's successful workflow and saves it as a reusable skill with SKILL.md and helper scripts

Add a shared guidelines repo (read-scope subscription or write-scope publish target) to the unified repos list.

Pull the latest guidelines from every configured repo (read- and write-scope).

Remove a repo from the unified repos list and delete its local clone.

Must be used near the end of any non-trivial turn that produced potentially reusable tools, guidance, errors, workarounds, or workflows, so those lessons are saved for future turns.

Analyze saved trajectories and recall audit events offline to record whether recalled guidelines influenced completed sessions.

Publish a private guideline to a configured write-scope repo.

Must be used at the start of any non-trivial task involving code changes, debugging, repo exploration, file inspection, or environment/tooling investigation to surface stored guidance before analysis or tool use.

Save the current conversation as a trajectory JSON file in OpenAI chat completion format for analysis and fine-tuning

Captures the current session's successful workflow and saves it as a reusable skill with SKILL.md and helper scripts

Add a shared guidelines repo (read-scope subscription or write-scope publish target) to the unified repos list.

Pull the latest guidelines from every configured repo (read- and write-scope).

Remove a repo from the unified repos list and delete its local clone.

测试 use-persona 的角色扮演一致性。给定 persona + 10 个对话场景，生成回复并按 5 个维度评分，输出一致性报告。

测试 use-self 替身会议的辩论质量。给定 persona + 3 个决策场景，运行完整三阶段辩论并按 5 个维度评分，输出质量报告。

蒸馏一个你身边的人。通过聊天记录、朋友圈、描述等素材，生成 ta 的人格档案，让 ta 以自己的方式和你对话。

蒸馏你自己的数字替身。通过多轮对话和素材导入，生成你的人格底座，用于私人决策辅助。

以某个人的身份和你对话。用 ta 的语气、习惯、互动方式回应你。

召唤你的数字替身进行决策辅助。多个版本的你同时分析一个决定，帮你看清局中看不清的自己。

Show all your installed skills. Deprecated alias — use /janitor-report --brief.

Find new skills on GitHub or check a specific skill before installing. Use when the user wants to search for skills, evaluate a skill URL, check overlap with existing skills before installing, or compare a local skill against alternatives.

Automatically fix skill problems (safe preview first). Also use with --prune to find and remove broken symlinks, empty directories, and orphaned skills.

Check if a new skill overlaps with existing ones before installing. Deprecated alias — use /janitor-discover with a URL or path.

Full health check of all your skills in one report. Use when the user wants to check for errors, find duplicates, detect broken skills, or get a complete overview of skill health. Pass --brief for inventory only.

Search GitHub for new skills to install. Deprecated alias — use /janitor-discover (combines search + pre-install check).

Show how many context window tokens each skill consumes. Deprecated alias — use /janitor-value (which combines tokens with usage).

Show which skills you use. Deprecated alias — use /janitor-value (which now combines usage + token cost).

Show whether each skill is earning its context-window cost — combined tokens-used view sorted by waste. Use when the user asks 'are my skills worth it', 'what's my context budget', 'which skills are dead weight', or anything about skill value, token cost, or usage.

>-

>-

>

CRE Asset Management analysis suite — 9 specialist skills for post-acquisition multifamily operations including annual budgeting, monthly variance analysis, rent collection, renewal decisions, lease-up tracking, capex execution, NOI improvement, hold/sell/refi scenario analysis, and quarterly asset review memos.

CRE Brokerage Investment Sales v1 - 8 specialist skills for U.S. seller-side commercial investment sales brokers, covering assignment intake, broker opinion of value, listing proposal, OM and teaser drafting, buyer process management, bid leveling, negotiation support, and PSA-to-close coordination.

CRE Closing management suite — 2 specialist skills for closing checklist coordination and funds flow preparation for multifamily acquisitions.

CRE Document Ingestion suite — 4 specialist skills for classifying and extracting structured data from deal documents including rent rolls, T-12 financials, and offering memoranda.

CRE Due Diligence analysis suite — 7 specialist skills for multifamily property analysis including rent roll validation, expense benchmarking, market study, physical inspection, environmental review, title review, and tenant credit assessment.

CRE Financing analysis suite — 3 specialist skills for lender identification, quote comparison, and term sheet assembly for multifamily acquisition debt sourcing.

CRE Industrial analysis suite - 8 specialist skills for U.S. industrial acquisitions, covering market study, lease roster analysis, lease abstraction, tenant credit, physical inspection, underwriting, financing fit, and investment committee memo writing.

CRE Legal review suite — 6 specialist skills for PSA review, title & survey analysis, estoppel tracking, loan document review, insurance coordination, and transfer document preparation for multifamily acquisitions.

CRE Underwriting analysis suite — 3 specialist skills for building pro formas, running sensitivity scenarios, and writing investment committee memos for multifamily acquisitions.

Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction.

Answer questions about code, architecture, and technical decisions — no implementation. Trigger on questions asking 'why', 'what does this do', 'what is the purpose of', 'explain', 'what's the difference', 'compare', or 'what are the tradeoffs' — even when referencing specific files, code snippets, or inline code. The key signal is the user wants to UNDERSTAND something, not change it. Do NOT trigger for requests to build, fix, plan, review, research, or add/modify code.