Development Skills

Executes diagnostic investigation tasks to test debugging hypotheses. Runs tests, traces execution, checks git history, and reports evidence. (converted from agent)

Reviews git history and updates CHANGELOG.md with entries for [Unreleased] section (converted from agent)

Explores codebases to find relevant files, trace execution paths, and map architecture with team communication capabilities for collaborative analysis (converted from agent)

Synthesizes exploration findings into unified analysis with deep investigation capabilities (shell commands, git history, dependency analysis) and completeness evaluation (converted from agent)

Produce a structured codebase analysis report with architecture overview, critical files, patterns, and actionable recommendations. Use when asked to "analyze codebase", "explore codebase", "understand this codebase", "map the codebase", "give me an overview of this project", "what does this codebase do", "codebase report", "project analysis", "audit this codebase", or "how is this project structured".

Deep exploration and synthesis workflow using agent teams with dynamic planning and hub-and-spoke coordination. Use when asked for "deep analysis", "deep understanding", "analyze codebase", "explore and analyze", or "investigate codebase".

Generates MkDocs-flavored or standard GitHub-flavored Markdown documentation from codebase analysis findings including API references, architecture guides, standalone markdown files, and change summaries (converted from agent)

Commit staged changes with conventional commit message. Use when user says "commit changes", "commit this", "save my changes", or wants to create a git commit.

Provides language-specific patterns for TypeScript, Python, and React including idioms, best practices, and common patterns. Use when implementing features in these languages.

Guides discovery and application of project-specific conventions including code patterns, naming, structure, and team practices. Use when exploring a codebase or implementing features to match existing patterns.

Prepare and execute a Python package release with verification steps. Use for releasing Python packages with uv and ruff.

Session-start lifecycle hooks for cross-plugin dependency resolution. Creates symlinks so cross-package references work in cached plugin environments.

Prepare and execute a Python package release with verification steps. Use for releasing Python packages with uv and ruff.

Produce a structured codebase analysis report with architecture overview, critical files, patterns, and actionable recommendations. Use when asked to "analyze codebase", "explore codebase", "understand this codebase", "map the codebase", "give me an overview of this project", "what does this codebase do", "codebase report", "project analysis", "audit this codebase", or "how is this project structured".

Deep exploration and synthesis workflow using agent teams with dynamic planning and hub-and-spoke coordination. Use when asked for "deep analysis", "deep understanding", "analyze codebase", "explore and analyze", or "investigate codebase".

Commit staged changes with conventional commit message. Use when user says "commit changes", "commit this", "save my changes", or wants to create a git commit.

Provides language-specific patterns for TypeScript, Python, and React including idioms, best practices, and common patterns. Use when implementing features in these languages.

Guides discovery and application of project-specific conventions including code patterns, naming, structure, and team practices. Use when exploring a codebase or implementing features to match existing patterns.

Standard R&D process orchestrator — guides the full development lifecycle from User Story to CD. Invoke when user says "start a new feature", "new requirement", "我要开发一个新功能", "开始需求", "next step?", "研发流程", or resumes work on an existing feature. Also invoke proactively when any non-trivial feature work begins, even if the user just says "let's build X". Do NOT invoke for one-off bug fixes, hotpatches, or purely exploratory tasks with no deliverable.

Cross-platform code submission workflow - Lint check, non-destructive review, manual verification document, smart staging, clean commit, MR creation. Auto-detects project type (Android/iOS/backend) and adapts to the corresponding lint/build tools. Triggers when the user says "submit code", "prepare to submit", "submit", "start submission flow", or "code submit".

Create and manage GitLab Merge Requests on gitlab.example.com repositories, driving them to a truly mergeable state. Automatically generates User Story documentation, constructs MR descriptions (with blob links), pushes and creates MRs, polls CI pipeline status via API and fixes failures, resolves merge conflicts, and loops until all MR checks pass with no conflicts. Triggers when the user says "submit MR", "create MR", "push and create MR", "merge to main", or needs to submit the current branch for review.

Design and implementation guide for parallel multi-worktree development environments. Use whenever the user mentions multi-worktree development, git worktree, port conflicts, concurrent dev environments, feature branch isolation, local environment setup, or multi-developer collaboration conflicts. Even if the user casually says "we have several worktrees running simultaneously", this Skill should be triggered to guide them toward a proper layered environment.

Perform local secret scanning, remote repository scanning, pre-commit integration, and single-credential verification using TruffleHog CLI. Triggers when the user mentions trufflehog, secret scan, leaked credential investigation, Git history scan, remote repo scan, pre-commit, or post-rotation credential verification.

INVOKE THIS SKILL when auditing an AI agent or LLM app for regulatory compliance. Covers EU AI Act, GPAI Code of Practice, GDPR, NIST AI RMF, Colorado AI Act, HIPAA, and ISO 42001. Scans the codebase for compliance gaps, cross-references Arize instrumentation for audit trail coverage, and produces an actionable remediation checklist tailored to the selected frameworks.

Manages Arize users, organizations, spaces, projects, roles, role bindings, resource restrictions, and API keys via the ax CLI. Use for enterprise admin workflows: inviting and offboarding users, onboarding new teams, creating custom roles for SAML/SSO mappings, assigning roles to users, restricting project-level access, and managing service keys for multi-tenant architectures. Covers ax users, ax organizations, ax spaces, ax projects, ax roles, ax role-bindings, and ax api-keys.

Creates and manages annotation configs (categorical, continuous, freeform label schemas) and annotation queues (human review workflows) on Arize. Applies human annotations to project spans via the Python SDK. Use when the user mentions annotation config, annotation queue, label schema, human feedback, bulk annotate spans, update_annotations, labeling queue, annotate record, or human review.

Downloads, exports, and inspects existing Arize traces and spans to understand what an LLM app is doing or debug runtime issues. Covers exporting traces by ID, spans by ID, sessions by ID, and root-cause investigation using the ax CLI. Use when the user wants to look at existing trace data, see what their LLM app is doing, export traces, download spans, investigate errors, or analyze behavior regressions.

Use when one Python service must send each agent's, tenant's, team's, or request's spans to its correct Arize space and project using application metadata. Covers dynamic OpenTelemetry routing for custom agent builders and multi-tenant applications, including register_with_routing, set_routing_context, multi-space tracing, and custom span routing.

Use when AI-written code needs structural cleanup or when implementing a change under a guard against AI coding slop — duplicated reimplementations of existing helpers, try-import fallbacks, broad exception swallowing, speculative abstraction layers, _v2 copies, dead "for future use" code, narrating comments — including requests to "deslop", "remove AI slop", "humanize code", review an AI-generated PR beyond tests passing, or prevent these patterns in the current change.

Git workflow best practices including commit messages, branching strategies, pull requests, and collaboration patterns. Use when working with Git version control.

Python development best practices including PEP 8 style guidelines, type hints, docstring conventions, and common patterns. Use when writing or modifying Python code.

Audit code integrity and coherence - duplication, hallucinated references, Tambon signatures, spec drift, Frankenstein patterns, mystery code. THIS DOMAIN incorporates findings from the Tambon hunt and most of the blind-spots walk. Run as part of /audit Phase E.

Conduct a full technical due diligence audit of a vibe-coded codebase. Use when the user types `/audit`, asks for a "full audit," asks for a "due diligence review," asks "is this codebase ready to ship-", or asks for a comprehensive code review of an entire repository (not a single PR). Coordinates the 13 domain skills, the hard-stop hunt, the Tambon LLM-signature hunt, and the blind-spot walk. Produces a single dual-layer report (founder view + technical evidence).

Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).

Analyze codebase and generate proper CLAUDE.md + AGENTS.md with MemoryMaster integration, real commands, and architecture boundaries. Run in any project to set up or refresh agent instructions. Use when entering a new project, when asked to "set up instructions", "generate CLAUDE.md", "configure this project for agents", or when project instructions are missing/outdated.

Use when reviewing GitHub pull requests with gh CLI - creates pending reviews with code suggestions, batches comments, and chooses appropriate event types (COMMENT/APPROVE/REQUEST_CHANGES)

Use when the user wants to integrate a Kafka client into an existing application or scaffold a Java Kafka client project (Maven or Gradle based) for Confluent Cloud, local Docker, or WarpStream. Covers the Apache Kafka Java clients (KafkaProducer/KafkaConsumer/KafkaShareConsumer) with Avro, JSON Schema, or Protobuf serializers. Also use when the user wants to optimize Java Kafka client configuration for WarpStream. Do NOT trigger for Kafka Streams apps (use kafka-streams-programming), Flink, connectors, or Kafka Python client (use developing-kafka-python-client).

Use when the user wants to build a Python Kafka producer or consumer, add Schema Registry to existing Python code, migrate from raw JSON to schema-backed serialization, or scaffold a confluent-kafka-python project for Confluent Cloud, local Docker, or WarpStream. Also use when user wants to optimize Python Kafka client configuration for WarpStream.

Build and deploy Apache Flink user-defined functions (UDFs) in Java for stream processing over Kafka. Use this skill when users want to create scalar UDFs, user-defined table functions (UDTFs), or process table functions (PTFs) in Java, deploy them to Confluent Cloud or local Docker environments, and invoke them from Flink SQL or the Table API. Trigger on: Flink UDF, custom Flink function, process table function, PTF, UDTF, Flink user defined, extend Flink SQL, stateful stream processing with Flink. Do NOT trigger for: Kafka Streams UDFs (use kafka-streams-programming skill), general Flink job development without custom functions, CDC streaming data piplines that include Flink (prefer the confluent-cloud-cdc-tableflow skill), Flink connector setup, or Kafka producer/consumer code.

Use when adding, fixing, or improving authentication in any app — login, logout, signup, route protection, JWT/access token validation, refresh token rotation, MFA, passkeys, step-up auth, SSO, RBAC, Organizations for B2B multi-tenant SaaS, custom login domains, ACUL, or Universal Login branding. Use to audit a tenant (CheckMate) or fix findings. Use even if Auth0 isn't mentioned — any time a developer asks how to authenticate users, secure an API, debug a 401, CORS error, callback URL mismatch, redirect loop, or 429 rate limit, or migrate from Clerk, NextAuth.js, Firebase, Supabase, Cognito, or Passport.js. Covers React, Next.js, Vue, Nuxt, Angular, Express, Flask, FastAPI, Spring Boot, Go, Swift, Android, Flutter, PHP, Laravel, ASP.NET Core, React Native, Expo, Ionic, and all Auth0 SDKs.

>- Builds complete, optimized Claude prompts and Project scaffolds from task descriptions. Use when building, designing, creating, or structuring a prompt for," "create a system prompt," "write a Claude prompt," "design a prompt for," "help me write a prompt," "scaffold a Claude Project," "design a Project for." Uses a four-stage methodology (Parse, Select, Construct, Validate) and a tested 5-layer architecture (Identity, Objective, Context, Reasoning, Output + Quality Control). In Project Mode, the Compiler is global-layer-aware — checks User Preferences, installed Skills, and MCP Connectors to avoid redundancy and flag gaps. Do NOT use for auditing existing prompts (use rootnode-prompt-validation if available) or diagnosing existing Projects (use rootnode-project-audit if available). Run on Opus 5 or Sonnet 5 at `high` effort (both defaults); depth reduces on legacy models.

>- Audits Claude Code repositories. Two-phase workflow — Phase 1 sweeps 14 hygiene categories (permissions, hooks, CLAUDE.md bloat, Skills hygiene, process-abstraction, plus structural) and an optional 7-layer leak check. Phase 2 executes [APPROVED] markers from the report file. Use for repo cleanup, pre-distribution sanity, post-feature hygiene, environment audit, process-abstraction discovery. Trigger on "audit my CC repo," "sweep my repository for hygiene," "check this CC environment," "find process abstraction candidates," "review my CLAUDE.md," "clean up my .claude directory," "pre-distribution hygiene check," "find layer leaks in my CC setup." Routes structural findings to rootnode-cc-design REMEDIATE. Composes with rootnode-critic-gate. CC-only — does not scan Claude Projects. Do NOT use for building a Skill (use rootnode-skill-builder), compiling a prompt (use rootnode-prompt-compilation), scoring a single prompt (use rootnode-prompt-validation), or auditing a Project (use rootnode-project-audit).

Use `asc` CLI for App Store Connect command discovery, auth, output formats, pagination, schemas, canonical verbs, Apple Ads, and timeout behavior.

Use when the requested App Store artifact is What's New release notes or promotional text, drafted from git history, bullets, or free text and optionally localized. Not for full listing translation, canonical metadata field sync, or subscription/IAP display names.

Submit or update a Wall of Apps entry in the App-Store-Connect-CLI repository using `asc apps wall submit`. Use when the user says "submit to wall of apps", "add my app to the wall", or "wall-of-apps".

Build, run, and debug local macOS apps or desktop executables with shell-first Xcode/Swift workflows. Use for Mac app builds, launch scripts, compiler/linker/startup failures, logs, telemetry, or desktop runtime debugging.

Analyze Swift Package Manager dependencies, plugins, module variants, branch pins, package graph shape, macros, binary targets, and CI/local build overhead that slow Xcode builds.

Use for Next.js App Router, React Server Components, server actions, API routes, auth, database integration, caching, deployment, or full-stack product features.