Shape agent capabilities into your workflow.

gut-check reads the idea, code, stated goals, available history, and current commitments, then restates the problem and classifies it as a personal tool, market product, or hybrid. When web access exists, it adds competitor, pricing, and recent-market signals; otherwise it states the limitation. A fixed verdict covers weaknesses, a pivot or kill path, a six-month simulation, near-term actions, and one metric, with a three-round pushback protocol that distinguishes new evidence from repetition.

Production Canvas brings player journeys, session-time math, GDD gaps, dependencies, risk heatmaps, forecast-versus-actuals, and endowment audits into seven views of one event dataset before design lock. It includes an interactive React template and a fully populated demo that needs no API calls. Forecasts are rough calculations from stated assumptions, sentiment scoring is keyword arithmetic, and the canvas cannot assess anything that was never mapped.

n-plus-one-hunter statically reviews controllers, serializers, resolvers, and query code for classic or nested N+1s, per-row aggregates, cartesian eager-load blowups, and related patterns. It selects ORM-specific preload or join strategies for Rails, Django, Prisma, SQLAlchemy, and other listed stacks, explains the scaling cost, and reports a before-and-after query count. The proposed fix still needs verification against the actual ORM version, indexes, access pattern, and realistic data.

aham-ppt turns documents, data, and notes into professional, editable PPTX decks through a staged process: load brand rules, extract claims, build the narrative, approve sample pages, design the full deck, and run a delivery check. It offers 39 parameterized layout IDs, three visual styles, and chart or annotation APIs. The skill favors one conclusion per page and evidence-backed wording over quick template output.

terraform-blast-radius reviews Terraform or OpenTofu plans and configuration diffs for forced replacements, resource renames, count-index shifts, dangerous state operations, and shared-resource cascades, distinguishing downtime from data-loss risk. It can propose prevent_destroy, create_before_destroy, moved blocks, for_each, or snapshot-based migrations without cloud access. Its output is a pre-apply review, not a guarantee, so the real plan, provider version, and tested backups still need checking.

api-break-check reviews API specifications, schemas, protobuf definitions, or implementation changes for removed response fields, newly required inputs, narrowed types, removed enum values, reused field numbers, and other breaking effects. It reasons about request-versus-response direction, explains which consumers fail, and proposes additive fields, deprecation windows, versioning, or reserved numbers. It is a pre-merge review rather than a substitute for contract-diff tools and direct consumer validation.

aham-word centralizes page, font, color, paragraph, table, header, footer, and logo values in word-tokens.json, while a specification covering 16 document elements guides a Python generation engine. It produces editable DOCX files with covers, automatic tables of contents, heading levels, horizontal-rule tables, and page-number fields. Changing the token file rethemes the output without code edits, and missing facts are marked for completion rather than invented.

fullstack-ts-scaffold regenerates a secret-free full-stack TypeScript starter with a Next.js 15 client, Express API, rotating JWT refresh tokens, a worker, PWA, OpenAPI, tests, and CI. It supports Postgres/Prisma, MongoDB/Mongoose, and Supabase backends from one template. Full verification uses Docker-backed databases; --fast limits the gate to lint, type-check, and build.

llm-cost-guard statically reviews LLM-calling code for repeated uncached prefixes, oversized model tiers, bloated context, unbounded output, unbudgeted agent loops, and repeated embeddings. It estimates the dominant tokens-times-price-times-volume term, then proposes prompt caching, model routing, context trimming, output caps, or batching while naming latency and quality trade-offs. It has no billing access, and projected savings still require current prices and evaluation results.

prompt-injection-review maps trust boundaries in LLM applications that use RAG, external content, tools, agents, or model-rendered output, tracing untrusted sources through the model to outbound actions, execution, data access, or UI sinks. It recommends least privilege, human approval, egress controls, structured validation, and authorization enforced in code. It explicitly treats prompt injection as having no complete fix: the goal is to contain what a successful injection can reach, not to rely on filters for false certainty.

fullstack-ts-scaffold regenerates a secret-free full-stack TypeScript starter with a Next.js 15 client, Express API, rotating JWT refresh tokens, a worker, PWA, OpenAPI, tests, and CI. It supports Postgres/Prisma, MongoDB/Mongoose, and Supabase backends from one template. Full verification uses Docker-backed databases; --fast limits the gate to lint, type-check, and build.

video-mockup-extraction uses ffmpeg to turn a screen recording into a three-level visual reference: contact sheets for overview, 1280px frames for selection, and full-resolution stills for close inspection. It combines scene detection with interval sampling to cover both hard cuts and scrolling, and works as either a Claude Code skill or standalone CLI.

audit-20 checks a completed code change across twenty failure categories, including injection, authorization, races, leaks, idempotency, contracts, and test gaps. It blocks completion until every pass runs and confirmed findings are fixed, then uses a final skeptical pass to remove duplicates, verify guards, and rescore severity.

Claudii Exploratores packages a catalog of 898 OSINT tools across 24 categories as an Agent Skill and MCP server. It classifies indicators and builds matching search URLs, with offline IBAN validation and reversible PII redaction; it does not open pages itself, and its alpha-stage outputs should be independently verified.

android-update-deps analyzes an Android project’s Gradle version catalog, grouping BOMs and coupled versions instead of treating every number independently. It checks compatibility, hidden SDK requirements, vulnerabilities, and license changes, pauses for explicit approval, then builds the app and isolates a problematic bump if verification fails.

feature-plan moves a rough feature idea through three ordered stages: shape the problem, stress-test it against the project’s vocabulary and context documents, then produce a plan spanning product, design, engineering, and developer experience. Its defining constraint is keeping the domain-language check between ideation and architecture review.

blind-vault is a macOS-only local secret tool that stores credentials in Keychain and exposes only pointer metadata such as names, scopes, and dates to the agent. Its CLI injects a value into a child-process environment without printing it, and scope checks can block mismatched commands. It keeps secrets out of chats, files, and ordinary tool output, but it is not an HSM and does not protect against malware running as the same user, brief process observation, or clipboard sniffing.

Vox Director takes a one-line topic through beat mapping, a visual style choice, collage keyframes, motion, narration, music, captions, and ffmpeg assembly. It runs as an agent skill with Atlas Cloud models plus local ffmpeg, and pauses for approval of the narrative beats and visual direction before rendering the final MP4.