AppVerk
OrganizationPlugins for Claude Code - code review, security scanning, web auditing, and developer workflows for Python, TypeScript, and PHP projects.
Categories
Indexed Skills (33)
architecture-analysis
Analyzes codebase for SOLID principles violations, DDD patterns compliance, Clean Architecture layer dependencies, and common anti-patterns. Works with Python and TypeScript, with language-agnostic pattern detection.
dependency-scanning
Scans project dependencies for known vulnerabilities (CVEs). Supports Python (uv, pip, poetry), JavaScript, Go, Java, and other languages. Addresses OWASP A03:2025 - Software Supply Chain Failures.
developer-plugins-integration
Detects installed developer plugins (python-developer, frontend-developer, php-developer) and project stack, then provides a list of relevant skills to load for code review and fix workflows. Supports Python (FastAPI, SQLAlchemy, Pydantic, Django, Celery, asyncio, uv), Frontend (React, Tailwind, Zustand, TanStack, pnpm), and PHP (Symfony, Doctrine, DDD).
linter-integration
Auto-detects and runs project-specific linters, formatters, and typecheckers. Supports Python (ruff, mypy, black, flake8, pylint) and TypeScript (eslint, tsc, prettier). Uses existing project configuration.
sast-analysis
Static Application Security Testing (SAST) for multi-language codebases. Uses Semgrep and language-specific tools to detect vulnerabilities across Python, JavaScript, TypeScript, Go, Java, and more.
secret-scanning
Detects and handles sensitive information in code. Use when reviewing code for secret leaks and hard-coded credentials.
standards-discovery
Discovers and parses project coding standards, style guides, and architecture documentation. Searches for CONTRIBUTING, CODING_STANDARDS, STYLE_GUIDE, CONVENTIONS, ARCHITECTURE files and extracts rules for code review.
be-testing
Backend testing patterns — API request construction, response verification, database state checks, error handling testing, and adaptive tool detection.
fe-testing
Frontend testing patterns using Playwright MCP — navigation, interaction, assertions, screenshots on failure, and common UI testing scenarios.
api-security-checklist
Checklist for passive API security assessment. Covers endpoint discovery, CORS, rate limiting, authentication, GraphQL, and response security.
infrastructure-checklist
Checklist for passive infrastructure security assessment. Covers SSL/TLS, DNS, subdomains, server fingerprinting, CDN/WAF detection, port scanning, and exposed paths.
performance-checklist
Checklist for passive web performance assessment. Covers Core Web Vitals, images, fonts, JavaScript, CSS, caching, compression, and resource hints.
seo-checklist
Checklist for passive technical SEO assessment. Covers indexability, metadata quality, structured data, rendering, internal linking, OpenGraph, internationalization, and sitemap analysis.
docs-fact-registry
Use when checking or reporting docs↔code drift — a declarative registry (claim → source of truth → policy) with a three-way classification: mechanical facts auto-fixable, judgment calls escalated, dead references flagged as inconsistencies whose fix is a decision.
finding-falsification
Use when authoring or reviewing any code-review reporting agent, or when a code-review agent is about to report findings — mandates a self-falsification pass: every finding survives a refutation battery before reporting; rejected findings and doctrine-gap candidates are recorded in dedicated sections, never silently dropped.
verdict-protocol
Use when writing or reviewing the definition of a reporting agent or command (a review, audit, verification, or test-run agent), before its closing contract is finalized.
bun-package-manager
Bun package management, lockfile policy, workspaces, CI integration, and Bun-native tooling
coding-standards
TypeScript + React coding standards, architecture patterns, naming conventions, ESLint configuration
form-patterns
React Hook Form with Zod validation, server-side error handling, mutation integration, and reusable form components
pnpm-package-manager
pnpm package management, workspace setup, dependency updates, and CI integration
state-combination-modeling
Use when a component or view is driven by two or more independent boolean inputs (flags, permissions, connection states) — enumerate the full 2^N product, confirm which combinations are real, never collapse independent axes into one exclusive switch.
tailwind-patterns
Tailwind CSS v4, CVA component variants, shadcn/ui patterns, semantic tokens, responsive design
tanstack-query-patterns
TanStack Query v5 server state management with queryOptions, mutations, caching, and error handling
tanstack-router-patterns
TanStack Router type-safe routing with file-based conventions, loaders, search params validation, and protected routes
tdd-workflow
Test-driven development workflow with Vitest, React Testing Library, MSW v2, and Playwright
zustand-patterns
Zustand store management with slices, middleware, selectors, and TypeScript patterns
loop-engineering
Use when designing, authoring, or reviewing a closed agent loop (test→fix→retest, audit→fix→re-audit, generate→verify→correct) in this marketplace — the minimum-bar checklist, the ground-truth oracle taxonomy, and the anti-patterns, anchored to /qa:loop as the reference implementation.
reader-context-hygiene
Use when authoring or reviewing a fan-out reader/scout agent that ingests an external source (a design board, a live site, a large document) on behalf of a consumer.
report-format
Test report format with QA-XXX issue IDs compatible with code-review plugin. Defines report structure, severity levels, issue format, and detailed results.
test-plan-format
Test plan structure, naming conventions, edge case generation rules, and file saving conventions for QA test plans.
pipeline-security
Security scanning templates and HARD-RULES for CI/CD pipeline configuration. Covers Semgrep SAST and TruffleHog secret scanning across Bitbucket, GitHub Actions, GitLab CI, and Azure DevOps.
lens-catalog
Lens roster, panel-selection rules, and severity/needs-decision anchors for the /superutils:spec-review loop. Load when composing a review panel or grading findings.
spec-report-format
Report structure, sidecar schema, SR-id rules, outcome enum, and terminal statuses for the /superutils:spec-review loop. Load when reading or writing spec-review loop state or reports. (Distinct from qa:report-format, which is the QA test-report format.)
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.