Spec-Driven Skills

Thorough code review — checks correctness, security, performance, readability, and test coverage. Gives actionable feedback ranked by severity.

UI design system toolkit for Senior UI Designer including design token generation, component documentation, responsive design calculations, and developer handoff tools. Use for creating design systems, maintaining visual consistency, and facilitating design-dev collaboration.

Frontend development skill for React, Next.js, TypeScript, and Tailwind CSS applications. Use when building React components, optimizing Next.js performance, analyzing bundle sizes, scaffolding frontend projects, implementing accessibility, or reviewing frontend code quality.

Convert heterogeneous documents and selected URIs to Markdown with Microsoft MarkItDown for text analysis, search, and LLM/RAG ingestion. Covers safe local conversion, streams, Office/PDF/data formats, batch workflows, plugins, vision OCR, Azure extraction, and the official MCP server.

A comprehensive autonomous web research agent that performs targeted searches, fetches and parses web content, summarizes findings, and generates structured reports, adhering to industry best practices for accuracy, security, and robustness.

Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one. Helps with aesthetic direction, typography, and making choices that don't read as templated defaults.

Workflow orchestrator. Decomposes a task into ordered steps, finds or installs the right skill for each step, runs the chain, and offers to save it as a reusable skill.

Curate Claude Code's auto-memory into durable project knowledge. Analyze MEMORY.md for patterns, promote proven learnings to CLAUDE.md and .claude/rules/, extract recurring solutions into reusable skills. Use when: (1) reviewing what Claude has learned about your project, (2) graduating a pattern from notes to enforced rules, (3) turning a debugging solution into a skill, (4) checking memory health and capacity.

Zero to power user in one invoke — detects OS, installs Homebrew/apt/Node.js/Python, sets up Claude Code, authenticates skills-hub CLI, connects MCP servers, and installs recommended skills based on your project. Cross-platform (macOS, Linux, WSL). Idempotent. Use when: 'quickstart', 'setup machine', 'new machine setup', 'install everything', 'get started', 'onboard me', 'setup skills-hub', 'fresh install'.

Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions

Systematic code refactoring — extract functions, reduce complexity, eliminate duplication, improve naming, and split large files. Preserves behavior with tests.

Security audit and vulnerability assessment for any codebase. Scans for authentication bypasses, missing auth middleware, broken JWT validation (algorithm confusion, weak secrets, missing expiry), OAuth state and PKCE flaws, IDOR and horizontal privilege escalation, vertical privilege escalation via role manipulation, SQL injection, NoSQL injection, XSS (stored, reflected, DOM), command injection, path traversal, SSRF, CSRF, hardcoded secrets and API keys (sk_live_, AKIA, ghp_), .env and credential file exposure, PII leaking in logs and error responses, overfetching sensitive fields, CORS misconfiguration, session fixation, missing secure/httpOnly/sameSite cookie flags, and Firebase/Firestore rule weaknesses. Produces a severity-ranked findings report with exploit scenarios and fix recommendations. Covers OWASP Top 10.