> Evaluate and compare technology stacks with TCO analysis, security assessment, and ecosystem health scoring. Use when comparing frameworks, calculating total cost of ownership, assessing migration paths, or analyzing ecosystem viability.
npx skills add https://github.com/borghei/Claude-Skills --skill tech-stack-evaluator
Evaluate and compare technologies, frameworks, and cloud providers with data-driven, weighted analysis and actionable recommendations.
When NOT to use: trivial decisions between similar tools (use team preference), mandated technology choices (decision already made), emergency production issues (use monitoring tools).
Before the evaluation, confirm these inputs. If any is unknown or vague, ASK — do not assume:
Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.
All scripts are Python library modules — import the class and call its methods. See references/tool-reference.md for full parameters and outputs.
| Tool | Purpose | Entry point |
|------|---------|-------------|
| stack_comparator.py | Weighted comparison across 8 categories | from stack_comparator import StackComparator |
| tco_calculator.py | Multi-year TCO incl. hidden costs | from tco_calculator import TCOCalculator |
| ecosystem_analyzer.py | Ecosystem health & viability scoring | from ecosystem_analyzer import EcosystemAnalyzer |
| security_assessor.py | Security posture & compliance readiness | from security_assessor import SecurityAssessor |
| migration_analyzer.py | Migration complexity, effort, risks | from migration_analyzer import MigrationAnalyzer |
| report_generator.py | Context-aware report rendering | from report_generator import ReportGenerator |
| format_detector.py | Detect/parse JSON, YAML, URL, or text input | from format_detector import FormatDetector |
Load the reference that matches the task — keep this file lean and pull detail on demand:
Covers:
Does NOT cover:
engineering/senior-qa for test execution)ra-qm-team compliance skills for regulatory guidance)hr-operations/talent-acquisition for staffing analysis)| Skill | Integration | Data Flow |
|-------|-------------|-----------|
| engineering/senior-security | Feed security assessor output into deeper vulnerability analysis | SecurityAssessor results → security review input |
| engineering/senior-devops | Use TCO hosting projections to inform infrastructure planning | TCOCalculator hosting/scaling data → DevOps capacity models |
| engineering/senior-qa | Migration test coverage scores inform QA test planning | MigrationAnalyzer testing_requirements → QA test strategy |
| ra-qm-team/compliance-auditor | Compliance readiness gaps feed into formal audit preparation | SecurityAssessor.assess_compliance() missing features → audit checklist |
| c-level-advisor/cto-advisor | Executive summaries and TCO reports support CTO decision-making | ReportGenerator executive summary → strategic technology decisions |
| product-team/product-manager | Ecosystem viability and migration timelines inform product roadmaps | EcosystemAnalyzer + MigrationAnalyzer → roadmap planning |
You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
Implement authentication and authorization with Better Auth - a framework-agnostic TypeScript authentication framework. Features include email/password authentication with verification, OAuth providers (Google, GitHub, Discord, etc.), two-factor authentication (TOTP, SMS), passkeys/WebAuthn support, session management, role-based access control (RBAC), rate limiting, and database adapters. Use when adding authentication to applications, implementing OAuth flows, setting up 2FA/MFA, managing user sessions, configuring authorization rules, or building secure authentication systems for web applications.
Package entire code repositories into single AI-friendly files using Repomix. Capabilities include pack codebases with customizable include/exclude patterns, generate multiple output formats (XML, Markdown, plain text), preserve file structure and context, optimize for AI consumption with token counting, filter by file types and directories, add custom headers and summaries. Use when packaging codebases for AI analysis, creating repository snapshots for LLM context, analyzing third-party libraries, preparing for security audits, generating documentation context, or evaluating unfamiliar codebases.
You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.
Expert patterns for HubSpot CRM integration including OAuth authentication, CRM objects, associations, batch operations, webhooks, and custom objects. Covers Node.js and Python SDKs.
Perform language and framework specific security best-practice reviews and suggest improvements. Use when the user explicitly requests security best practices guidance, a security review or report, or secure-by-default coding help. Supports Python, JavaScript/TypeScript, and Go. Do NOT use for general code review, debugging, threat modeling (use security-threat-model), or non-security tasks.
Configures API gateways for routing, authentication, rate limiting, and request transformation in microservice architectures. Use when setting up Kong, Nginx, AWS API Gateway, or Traefik for centralized API management.
Take borghei/tech-stack-evaluator from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.