CarlosCaPe
UserOpen-source AI Agent OS: a folder of plain-text files that gives your AI coding assistant a lasting memory, house rules, sealed per-client work and a receipt for every run (v8 kernel). Not a chatbot, no people inside. MIT.
Categories
Indexed Skills (49)
cloudflare
Comprehensive Cloudflare platform skill covering Workers, Pages, storage (KV, D1, R2), AI (Workers AI, Vectorize, Agents SDK), feature flags (Flagship), networking (Tunnel, Spectrum), security (WAF, DDoS), and infrastructure-as-code (Terraform, Pulumi). Use for any Cloudflare development task. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.
4d-spec
Orchestrator that merges the 4D Paradigm with Spec-Driven Development (SDD). Classifies task complexity and activates SDD phases only when warranted. Use at the START of any implementation task to determine the right workflow depth.
ado-refactor-performance-gate
Mandatory performance gate for Azure DevOps SQL refactor tickets. Use when a ticket includes stored procedure refactor/review and you must validate execution plans, index usage, parameter sniffing risk, and query structure optimization opportunities.
anthropic-enterprise-analytics
Pull Anthropic's Admin API usage_report into ~/.claude/analytics/ so brain-digest can reconcile estimated cost (from session JSONL list-price math) against actual billed cost (from Anthropic). Closes the estimated-vs-billed gap that any operator running on Pro/Max/Enterprise has.
batch-import-relative-paths
When you batch-add an `import` line to N source files via sed/awk, the relative path must be computed PER-FILE (depth varies). Vite/esbuild often silently normalize bad `../` and the bug hides across multiple deploys until a larger rebuild forces strict module resolution.
browser-bearer-graph-auth
Conditional-Access-resilient OAuth alternative for Microsoft Graph: drive a Playwright + Edge persistent context to capture the bearer token during normal sign-in. Works when Device Code Flow / headless OAuth is blocked by AADSTS53003 (Device state: Unregistered). Outlook Web grants a broader scope set than Teams Web. Hard-won workaround that should NOT be the production answer.
cache-bust-deploy-validation
After a production deploy of a CDN-fronted site, force cache-bust on every validation request and inspect Age/cache-status headers — the CDN can serve a stale 200 with old content for hours, hiding a broken deploy. Use whenever validating a freshly-deployed web app, debugging "deploy completed but the live site shows the old version", or building a post-deploy smoke test.
command-boundary-hook-matching
Pattern-match what a Bash command actually does in a PreToolUse hook without false-firing on mentions inside quoted args, commit messages, or echo strings. Use when building any hook that decides based on command semantics.
config-driven-diagrams
Build config-driven architecture diagrams as dark-themed SVG/PNG with swimlanes, embedded logos, auto-layout, and overlap validation. Use when the user asks for architecture diagrams, data flow diagrams, system topology, or any visual diagram that should be rendered programmatically from a JSON config. Trigger on: diagram, architecture diagram, data flow, swimlane, render SVG, render PNG, system diagram, topology.
cotizacion-legal-baseline
Clausulado legal base Mexico B2B que TODA cotizacion o propuesta lleva desde el borrador 1: propiedad intelectual, LFPDPPP, confidencialidad, limite de responsabilidad, garantia, licenciamiento e IVA.
coworking-concept-collision
Protocol for when two live sessions are codifying the SAME concept concurrently (not just sharing a working tree). Detect semantic friction BEFORE committing, defer ownership to whoever is further ahead, and integrate from an isolated dimension. Trigger — a file you are about to reference or claim primacy over shows as modified (M) by another live session, or your new skill overlaps a concept another dimension is actively editing.
arm-onboarding
Step-by-step protocol to create a new client arm: required files, sync-ai-docs, the arm's sealed lineage graph, QueryMaster registration and gitignore hygiene. Triggers on 'crear un arm' or 'onboard a un cliente'.
canary-symbiont
Cross-plane sentinel: a watcher on plane B detects the SILENT death of plane A's scheduler (billing block, cron load-shedding) and alerts by email. Fail-open. Includes the mandatory live test.
capture-ends-with-triage
A scheduled pipeline that only dumps raw data forces the human to synthesize, and that is why it gets skipped. Every capture must close with a TRIAGE step that diagnoses cause and next action. Applies when building or reviewing any periodic job.
client-doc-lint
QA reflex before sending a generated deliverable to a client: checks broken accents, em-dashes, dates already past, a missing tax note when amounts appear, and inventories every amount. Run it before saying 'listo para enviar' (ready to send).
4d-paradigm-protocol
Full 4D paradigm protocol (Describe, Delegate, Diligent, Disclose): the 2D 3-question gate, the Change Manifest format, the 3D validation matrix and the Impact Radius. CLAUDE.md only carries the summary. Load before writing files or assembling a manifest.
agent-proof-approval-gate
Build a fail-closed PreToolUse gate for merge/deploy/destructive actions that the AI agent provably cannot self-bypass. Use when you need human-only override for a consequential action the agent orchestrates.
agents-sdk
Build AI agents on Cloudflare Workers using the Agents SDK. Load when creating stateful agents, durable workflows, real-time WebSocket apps, scheduled tasks, MCP servers, chat applications, voice agents, or browser automation. Covers Agent class, state management, callable RPC, Workflows, durable execution, queues, retries, observability, and React hooks. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.
claude-mem-persistent-memory
Persistent cross-session memory for coding agents: captures the session, compresses it and re-injects what is relevant later, with ~75% fewer tokens. Apache-2.0 upstream, permissive.
cloudflare-email-service
Send and receive transactional email with Cloudflare Email Service (Sending plus Routing), through a Workers binding or REST. Covers deliverability, SPF, DKIM, DMARC and wrangler setup.
atomic-3phase-ddl-scripts
Atomic 3-Phase DDL Scripts
backward-compatible-schema-changes
Backward-Compatible Schema Changes
case-insensitive-uniqueness
Case-Insensitive Uniqueness (Functional Indexes)
column-renames-metadata-only
Column Renames (Metadata-Only)
connection-pooling-timeout-safety
Connection Pooling & Timeout Safety
content-deduplication-discipline
Content Deduplication Discipline
claude-plugins-official
Official, Anthropic-managed directory of high quality Claude Code Plugins.
arm-synthetics
Per-arm health check templates. Each arm defines a synthetics.yaml with endpoints to probe + expected responses + cron schedule. The skill ships the template + GH Action runner. Failures open issues IN THE ARM REPO (not the brain) to preserve octopus arm isolation. Use when onboarding a new arm or when an arm's health monitoring needs a scheduled probe.
aspnet-core
Build, review, refactor, or architect ASP.NET Core web applications using current official guidance for .NET web development. Use when working on Blazor Web Apps, Razor Pages, MVC, Minimal APIs, controller-based Web APIs, SignalR, gRPC, middleware, dependency injection, configuration, authentication, authorization, testing, performance, deployment, or ASP.NET Core upgrades.
bug-hunter
Adversarial bug hunting with a sequential-first pipeline (Recon, Hunter, Skeptic, Referee) that can optionally use safe read-only parallel triage. Finds, verifies, and auto-fixes real bugs by default (with --scan-only opt-out) using checkpointed verification and resume state for large codebases. Use this skill whenever the user wants bug finding, security audits, regression checks, or code review focused on runtime behavior.
commit-security-scan
Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks for PR security review, commit-diff scanning, staged-change security checks, branch-comparison security review, or pre-merge security analysis of changed code.
doc-lookup
Unified documentation lookup for Bug Hunter agents. Uses Context Hub (chub) as primary source with Context7 API fallback. Provides verified library/framework documentation to prevent false positives and ensure correct fix patterns.
fixer
Surgical code fixer for Bug Hunter. Implements minimal, precise fixes for verified bugs. Uses doc-lookup (Context Hub + Context7) to verify correct API usage in patches. Respects fix strategy classifications (safe-autofix vs manual-review vs larger-refactor).
hunter
Deep behavioral code analysis agent for Bug Hunter. Performs multi-phase scanning to find logic errors, security vulnerabilities, race conditions, and runtime bugs. Uses doc-lookup (Context Hub + Context7) for framework verification. Reports structured JSON findings.
recon
Codebase reconnaissance agent for Bug Hunter. Maps architecture, identifies trust boundaries, classifies files by risk priority, and detects service boundaries. Does NOT find bugs — finds where bugs hide.
referee
Final arbiter for Bug Hunter. Receives Hunter findings and Skeptic challenges, independently re-reads code, and delivers authoritative verdicts with CVSS scoring and proof-of-concept generation for security findings.
skeptic
Adversarial code reviewer for Bug Hunter. Rigorously challenges each reported bug to determine if it's real or a false positive. Uses doc-lookup (Context Hub + Context7) to verify framework claims before disproval. The immune system that kills false positives.
claude-usage-report
Aggregate Claude Code usage (tokens, sessions, API-equivalent cost) by day, week, month, model, and project from local JSONL session logs. Use when the user asks about their Claude Code usage, consumption, costs, "cuánto he usado", "uso diario/semanal/mensual", or wants to audit which projects/models are eating the most tokens.
cloudflare-deploy
Deploy applications and infrastructure to Cloudflare using Workers, Pages, and related platform services. Use when the user asks to deploy, host, publish, or set up a project on Cloudflare. Also use when the user needs to purge or clear Cloudflare cache after deploys, or automate cache invalidation.
coolify-self-hosted-paas
Alternativa autoalojada a Vercel, Heroku y Render: despliega apps, bases y servicios en tu propio servidor con git-push, SSL automatico y sin costo por asiento. Apache 2.0.
ado-pr-merge-via-api
Completes Pull Request merges in Azure DevOps through the REST API when the UI fails or you need to script them in bulk. Covers 403s from unresolved threads, votes stuck in 'waiting for author' and stale CI gates.
agent-browser
Rust-native browser automation CLI for agents, no Playwright. Navigates, fills forms, clicks, takes screenshots and extracts data. Triggers on 'abre el sitio', 'toma screenshot', 'prueba esta web', 'QA'.
ask-with-recommendation
Every multiple-choice question to the operator carries an explicit marked recommendation plus its reason (impact, scope, time, risk of waiting). Applies to every AskUserQuestion and to every 'quieres X o Y?' written in prose.
bruno-postman-alternative
Open-source API client where collections are text files in the repo, reviewable by PR, with no cloud and no per-seat licenses. MIT. For teams that live in git or when Postman gets expensive.
ccxt-python
CCXT library for crypto exchanges in Python, REST and WebSocket: connect, pull market data, place orders and stream tickers. For trading bots and analysis, sync or asyncio.
chatgpt-apps
Build and debug ChatGPT Apps SDK apps that pair an MCP server with a widget UI: defining tools, registering UI resources, the MCP Apps bridge, metadata, CSP and domains. Check the docs before generating code.
security-review
Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Use whenever the user asks for a full security audit, repository security review, weekly security scan, PR security review with deeper validation, or wants dependency CVEs and threat-model context combined into one workflow.
threat-model-generation
Generate or refresh a STRIDE-based threat model for the current repository using Bug Hunter-native artifacts. Use whenever the repository has no threat model yet, the architecture changed materially, a security review needs fresh trust-boundary context, or the user explicitly asks for a threat model.
vulnerability-validation
Validate security findings for exploitability, reachability, and real-world impact using Bug Hunter-native findings artifacts. Use after security scans, before patch generation, or whenever the user wants confirmation that a suspected vulnerability is actually exploitable.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.