atifgul99
UserEngineering-readiness audits for AI-built apps. A Claude Code and Codex plugin that finds production risks across ten domains—with plain-language findings and verified fixes.
Categories
Indexed Skills (12)
craft-ai
The Craftsman standard for LLM-powered features — prompt-injection surface, key and spend protection, PII reaching model APIs, and reliability/eval discipline. Use whenever work touches an LLM integration: a chatbot or agent, a RAG pipeline, an LLM call from a route or job, tool/function-calling, or reviewing prompts and completions. Trigger even on "add an AI feature", "is my chatbot secure", "my OpenAI bill exploded", or "why did the model call the wrong tool" without naming a provider or framework. Handoffs: see "Scope boundaries" in the body.
craft-backend
The Craftsman standard for building and reviewing backend code — API routes, request validation, the authentication boundary, service/business logic, error handling, route rate-limit middleware, third-party integrations, and background jobs. Use this WHENEVER the work touches the server side: adding or reviewing a route, validating input, authenticating a request, tracing a 500, writing a service layer, wiring an integration, or handling a job. Trigger even when the user only says "add an endpoint", "validate this input", "why is this returning 500", or "secure this route" without naming a framework. Handoffs: see "Scope boundaries" in the body.
craft-frontend
The Craftsman standard for frontend application architecture — components, state management, data fetching, forms, routing, client/server boundaries, performance, error boundaries, and bundle size. Use this WHENEVER the work touches the application layer of a frontend: building components, wiring up API calls, deciding where state lives, handling loading/error/empty states, managing form validation, splitting bundles, or diagnosing slow pages. Trigger even when the user only says "wire up the API", "this page is slow", "manage this state", or "build the form" without naming a framework. Visual polish and design tokens → craft-ux; further handoffs in "Scope boundaries".
craft-lint
The Craftsman standard for linting and static quality gates — ESLint version policy, resolved-rule extraction, typed TypeScript linting, React/Next/a11y/security rule hardening, zero-warning CI gates, pre-commit alignment, and migration from weak default configs to an enterprise-grade lint setup. Use this WHENEVER the work touches ESLint, lint rules, lint failures, lint config migration, quality scripts, pre-commit linting, or "standardize linting". Scope is **JS/TS ESLint surfaces** — with no ESLint surface (Python/Ruff, Biome-only, Go), mark the domain N-A rather than forcing a migration. Whole-project readiness → craft-audit.
craft-observability
The Craftsman standard for production observability — error tracking (Sentry), metrics & dashboards (Grafana), structured logging, tracing, SLOs, and alerting. Use this WHENEVER the work touches observability: adding or reviewing Sentry, wiring Grafana/Prometheus/OpenTelemetry, setting up structured logs, defining alerts or SLOs, instrumenting a service, or debugging "we have no visibility into X". Trigger even when the user only says "add monitoring", "why can't we see errors", "set up dashboards", or "make this observable" without naming a tool. Deploy, runtime, and CI production-readiness → craft-infra; whole-project readiness → craft-audit.
craft-security
The Craftsman standard for defensive security hardening — authorization policy (per-resource authZ, IDOR/tenant scoping), input validation & injection prevention, secrets, security headers, CORS, dependency vulnerabilities, XSS/CSRF, and data exposure. Use WHENEVER work touches security: harden an endpoint, review auth, handle secrets, lock down headers, audit dependencies, or production-harden a service. Trigger on "is this secure", "harden this", "review for vulnerabilities", or "handle secrets properly". Owns authZ, abuse-defense policy, and security review of auth flows — see "Scope boundaries" in the body for handoffs.
craft-audit
The front door to the craft skills — a whole-project production-readiness orchestrator that drives the ten per-domain craft skills (ux, frontend, backend, db, security, infra, observability, testing, lint, ai) instead of auditing one surface at a time. It discovers the project's shape, plans an audit per surface, and tracks findings in a resumable `.craftsman/` workspace. Use WHENEVER the user wants a whole-project assessment rather than a single-file review: "is my app production-ready", "take this from MVP to production", "I vibe-coded this with Lovable/Replit/Claude and want it enterprise-grade", or "what would a senior engineer fix here". Trigger even without a named surface area — the whole point is finding the applicable ones. Does NOT fire on single-surface requests ("how do I fix this one bug", "add a feature to this component") — use that domain's craft skill directly.
craft-fix
The Craftsman standard for driving fixes against an existing `craft-audit` workspace — "fix the findings", "fix SEC-003", "work through the audit", "start the climb". An ACTION skill, not a domain: it picks findings off the master tracker's climb sequence, re-verifies each is still real, gets the user's approval, and executes a batched fix with a regression test — it never re-audits or re-ranks. Fires with no finding ID named ("start the climb" means the top 5 open items) and on handoffs like "regression test for finding X" or "work on TEST-004". REQUIRES an existing `.craftsman/` workspace at the project root. Without one, a scoped fix request goes to the relevant domain craft skill and a whole-project assessment goes to `craft-audit` first.
craft-infra
The Craftsman standard for production infrastructure — deployment, env/config, CI/CD, IaC, health/readiness, scaling, platform/edge rate limiting, build/release, rollback. Use WHENEVER work touches infra: deploy, CI gates, env vars, IaC, load failures, platform rate limiting, pooling runtime constraints, or production runtime. Trigger on "deploy this", "set up CI", "add rate limiting", "configure env vars", or "why did it fall over under load". Owns the platform layer — see "Scope boundaries" in the body for handoffs to craft-backend, craft-security, craft-db, craft-testing, and craft-observability.
craft-testing
Craftsman standard for automated testing: strategy, unit/integration/e2e selection, refactor-proof design, flaky tests, mocking boundaries, deterministic data, and merge-gate policy. Use WHENEVER work touches tests: writing/reviewing tests, strategy, "add tests", "why is this flaky", "what should I test", "tests pass but prod breaks", Testing Library / Playwright / Vitest / Jest / Pytest, mocks, fixtures, or adequacy. Trigger on "add tests", "write a test", "is this tested enough", or "make the tests reliable". Owns which suites gate merge and what "green" means — see "Scope boundaries" in the body for handoffs to craft-infra, craft-security, and craft-ux.
craft-ux
The Craftsman standard for UI/UX — design tokens, component patterns, pixel-perfect standards, Tailwind/React implementation, motion craft, an AI-tells anti-pattern catalog, and a two-pass review protocol (static review + live browser audit). Use this whenever designing, building, reviewing, auditing, redesigning, or polishing UI — a component, page, dashboard, landing page, modal, form, or layout; standing up or hardening a design system; checking spacing, typography, color, motion, or accessibility; or hunting AI-generated "tells". Trigger even on "make this look better", "fix the styling", "audit my design tokens", or "test it in the browser" without naming a tool or framework. App architecture (state, data fetching, bundles, routing) → craft-frontend. Does NOT fire on backend, database, CI/CD, or infra requests, or UI-free code-quality asks.
craft-db
The Craftsman standard for database work — schema design, migrations, query writing, indexing, and multi-tenant data scoping. Use this WHENEVER the work touches the database in any form: designing or changing schema, writing migrations, modeling tables or relations, writing or optimizing queries, adding indexes, handling soft-deletes, scoping data to a tenant, or wiring up connection pooling. Trigger even when the user only says "add a column", "this query is slow", "design the data model", or "write a migration" without naming an ORM or dialect.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.